# Vulnerabilities published in 2026


- [CVE-2026-15043](https://insights.sbomify.com/CVE-2026-15043/): DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text (critical 9.8)
- [CVE-2026-15041](https://insights.sbomify.com/CVE-2026-15041/): 389-ds-base: 389-ds-base: non-constant-time comparison in pbkdf2-sha256 password verification (low 3.7)
- [CVE-2026-1504](https://insights.sbomify.com/CVE-2026-1504/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-15039](https://insights.sbomify.com/CVE-2026-15039/): Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-15038](https://insights.sbomify.com/CVE-2026-15038/): InfiniteWP Client < 1.13.6 - Unauthenticated Administrator Account Takeover on Multisite (critical 9.8)
- [CVE-2026-15037](https://insights.sbomify.com/CVE-2026-15037/): XML injection vulnerability in QDom comment, CDATA and processing-instruction serialization (low 2.9)
- [CVE-2026-15036](https://insights.sbomify.com/CVE-2026-15036/): Harness gitspaces Endpoint list_all.go getAuthorizedSpaces authorization (medium 5.3)
- [CVE-2026-15035](https://insights.sbomify.com/CVE-2026-15035/): bentoml OpenLLM Model Repository Directory Name common.py async_run_command command injection (medium 4.8)
- [CVE-2026-15034](https://insights.sbomify.com/CVE-2026-15034/): flask-dashboard Flask-MonitoringDashboard cross-site request forgery (medium 5.3)
- [CVE-2026-15033](https://insights.sbomify.com/CVE-2026-15033/): christopherthielen check-peer-dependencies peerDependencies packageUtils.js shelljs.exec os command injection (medium 5.3)
- [CVE-2026-15032](https://insights.sbomify.com/CVE-2026-15032/): wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion (medium 6.1)
- [CVE-2026-15030](https://insights.sbomify.com/CVE-2026-15030/): Memory corruption in Business Manager (medium 5.6)
- [CVE-2026-1503](https://insights.sbomify.com/CVE-2026-1503/): login_register <= 1.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 4.3)
- [CVE-2026-15029](https://insights.sbomify.com/CVE-2026-15029/): Memory corruption in Business Manager (high 8.4)
- [CVE-2026-15028](https://insights.sbomify.com/CVE-2026-15028/): Libarchive: heap overflow oob read while parsing a tar archive contains a pax extended header (low 3.9)
- [CVE-2026-15027](https://insights.sbomify.com/CVE-2026-15027/): Changing｜CGServiSign - OS Command Injection (high 8.6)
- [CVE-2026-15026](https://insights.sbomify.com/CVE-2026-15026/): Missing authorization in Import and export users and customers (medium 4.3)
- [CVE-2026-15025](https://insights.sbomify.com/CVE-2026-15025/): Missing authorization in Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin (high 7.5)
- [CVE-2026-15023](https://insights.sbomify.com/CVE-2026-15023/): SQL injection in Events Manager – Calendar, Bookings, Tickets, and more! (medium 6.5)
- [CVE-2026-15022](https://insights.sbomify.com/CVE-2026-15022/): Tutor LMS <= 4.0.0 - Authenticated (Subscriber+) SQL Injection via Stored Quiz Answer Array (medium 6.5)
- [CVE-2026-15021](https://insights.sbomify.com/CVE-2026-15021/): wpForo Forum <= 3.1.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'location' Profile Field (medium 6.4)
- [CVE-2026-1502](https://insights.sbomify.com/CVE-2026-1502/): HTTP client proxy tunnel headers not validated for CR/LF (medium 5.7)
- [CVE-2026-15019](https://insights.sbomify.com/CVE-2026-15019/): Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment (high 7.5)
- [CVE-2026-15018](https://insights.sbomify.com/CVE-2026-15018/): Database Collation Fix <= 1.2.10 - Unauthenticated SQL Injection via 'force-collation-algorithm' Parameter (medium 5.3)
- [CVE-2026-15017](https://insights.sbomify.com/CVE-2026-15017/): Privilege escalation in MDJM Event Management (high 8.8)
- [CVE-2026-15016](https://insights.sbomify.com/CVE-2026-15016/): Cross-site scripting in Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions (medium 6.4)
- [CVE-2026-15015](https://insights.sbomify.com/CVE-2026-15015/): Missing authorization in MountDev AI MCP Connector for WordPress (critical 9.8)
- [CVE-2026-15014](https://insights.sbomify.com/CVE-2026-15014/): SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter (critical 9.8)
- [CVE-2026-15013](https://insights.sbomify.com/CVE-2026-15013/): Auth bypass in SAML Single Sign On – SSO Login (critical 9.8)
- [CVE-2026-15012](https://insights.sbomify.com/CVE-2026-15012/): Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy (medium 5.3)
- [CVE-2026-15011](https://insights.sbomify.com/CVE-2026-15011/): Customer Support Ticket System & Helpdesk <= 6.0.5 - Unauthenticated Code Injection via 'path' Parameter (critical 9.8)
- [CVE-2026-15010](https://insights.sbomify.com/CVE-2026-15010/): bbp style pack <= 6.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Topic Form Additional Fields (medium 6.4)
- [CVE-2026-1501](https://insights.sbomify.com/CVE-2026-1501/): IBM Concert Software Improper Certificate Validation (low 3.7)
- [CVE-2026-15009](https://insights.sbomify.com/CVE-2026-15009/): Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter (medium 6.1)
- [CVE-2026-15008](https://insights.sbomify.com/CVE-2026-15008/): Deserialization in Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin (high 8.1)
- [CVE-2026-15007](https://insights.sbomify.com/CVE-2026-15007/): Denial of service in Enterprise Server (medium 5.7)
- [CVE-2026-15006](https://insights.sbomify.com/CVE-2026-15006/): Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field (high 7.5)
- [CVE-2026-15005](https://insights.sbomify.com/CVE-2026-15005/): Loco Translate <= 2.8.5 - Cross-Site Request Forgery to Remote Code Execution via 'template' Parameter (high 8.8)
- [CVE-2026-15004](https://insights.sbomify.com/CVE-2026-15004/): Cross-site scripting in FileBird – WordPress Media Library Folders & File Manager (medium 5.4)
- [CVE-2026-15003](https://insights.sbomify.com/CVE-2026-15003/): Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service (medium 5.6)
- [CVE-2026-15002](https://insights.sbomify.com/CVE-2026-15002/): Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter (high 7.2)
- [CVE-2026-15001](https://insights.sbomify.com/CVE-2026-15001/): Privilege escalation in bLoyal: Loyalty & Promotions by bLoyal (high 8.8)
- [CVE-2026-15000](https://insights.sbomify.com/CVE-2026-15000/): Cross-site scripting in Connect Contact Form 7 and Mailchimp (high 7.2)
- [CVE-2026-1500](https://insights.sbomify.com/CVE-2026-1500/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2026-14999](https://insights.sbomify.com/CVE-2026-14999/): IBM DataPower Gateway Improper Verification of Cryptographic Signature (high 7.4)
- [CVE-2026-14996](https://insights.sbomify.com/CVE-2026-14996/): Multiple vulnerabilities in IBM Aspera Faspex (high 8.2)
- [CVE-2026-14995](https://insights.sbomify.com/CVE-2026-14995/): Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path (high 7.2)
- [CVE-2026-14992](https://insights.sbomify.com/CVE-2026-14992/): IBM DataPower Gateway Out-of-bounds Write (critical 9.8)
- [CVE-2026-14991](https://insights.sbomify.com/CVE-2026-14991/): IBM DataPower Gateway Out-of-bounds Write (critical 9.8)
- [CVE-2026-14990](https://insights.sbomify.com/CVE-2026-14990/): IBM DataPower Gateway affected by cross-site scripting (critical 9.3)
- [CVE-2026-1499](https://insights.sbomify.com/CVE-2026-1499/): WP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action (high 8.8)
- [CVE-2026-14989](https://insights.sbomify.com/CVE-2026-14989/): Cross-site scripting in WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode (high 7.2)
- [CVE-2026-14988](https://insights.sbomify.com/CVE-2026-14988/): IBM DataPower Gateway Out-of-bounds Read (medium 6.5)
- [CVE-2026-14987](https://insights.sbomify.com/CVE-2026-14987/): Cross-site scripting in GiveWP – Donation Plugin and Fundraising Platform (medium 6.4)
- [CVE-2026-14986](https://insights.sbomify.com/CVE-2026-14986/): Out-of-bounds write in it51xxx I2C target FIFO ISR on oversized write transaction (medium 6.8)
- [CVE-2026-14985](https://insights.sbomify.com/CVE-2026-14985/): CVE-2026-14985 (high 7.8)
- [CVE-2026-14984](https://insights.sbomify.com/CVE-2026-14984/): Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2 (critical 9.4)
- [CVE-2026-14983](https://insights.sbomify.com/CVE-2026-14983/): Missing Authentication in Teledyne FLIR Robots running Aware2 (high 7.1)
- [CVE-2026-14982](https://insights.sbomify.com/CVE-2026-14982/): WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter (high 8.1)
- [CVE-2026-14981](https://insights.sbomify.com/CVE-2026-14981/): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (high 7.5)
- [CVE-2026-14980](https://insights.sbomify.com/CVE-2026-14980/): IBM WebSphere Application Server Liberty is affected by a cross-site request forgery (high 8.3)
- [CVE-2026-1498](https://insights.sbomify.com/CVE-2026-1498/): WatchGuard Firebox LDAP Injection (high 7.0)
- [CVE-2026-14979](https://insights.sbomify.com/CVE-2026-14979/): IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack (medium 5.3)
- [CVE-2026-14978](https://insights.sbomify.com/CVE-2026-14978/): Unicode normalization mismatch in go-slug ignore pattern matching may bypass intended file exclusions (medium 5.5)
- [CVE-2026-14976](https://insights.sbomify.com/CVE-2026-14976/): Code injection in WebSphere Application Server - Liberty (high 7.1)
- [CVE-2026-14975](https://insights.sbomify.com/CVE-2026-14975/): WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter (medium 6.5)
- [CVE-2026-14974](https://insights.sbomify.com/CVE-2026-14974/): IBM WebSphere Application Server is affected by cross-site scripting and deserialization vulnerabilities (high 8.1)
- [CVE-2026-14973](https://insights.sbomify.com/CVE-2026-14973/): Path Traversal in IBM Desktop App (critical 9.3)
- [CVE-2026-14971](https://insights.sbomify.com/CVE-2026-14971/): This PowerVM Novalink update is being released to address (low 3.9)
- [CVE-2026-14970](https://insights.sbomify.com/CVE-2026-14970/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-1497](https://insights.sbomify.com/CVE-2026-1497/): Incorrect privilege assignment in composite databases (low 2.0)
- [CVE-2026-14969](https://insights.sbomify.com/CVE-2026-14969/): 389-ds-base: 389-ds-base: static initialization vector in aes-cbc/3des-cbc attribute encryption (medium 4.4)
- [CVE-2026-14967](https://insights.sbomify.com/CVE-2026-14967/): Path traversal in github_workflows allows writing artifacts outside output directory (low 3.1)
- [CVE-2026-14966](https://insights.sbomify.com/CVE-2026-14966/): Symlink guard bypass in unarchive module allows planting symlinks during extraction (low 3.1)
- [CVE-2026-14962](https://insights.sbomify.com/CVE-2026-14962/): ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id (high 8.6)
- [CVE-2026-14961](https://insights.sbomify.com/CVE-2026-14961/): CVE-2026-14961 (medium 6.2)
- [CVE-2026-14960](https://insights.sbomify.com/CVE-2026-14960/): CVE-2026-14960 (critical 9.8)
- [CVE-2026-1496](https://insights.sbomify.com/CVE-2026-1496/): Coverity CLI Authentication Bypass (critical 9.3)
- [CVE-2026-14959](https://insights.sbomify.com/CVE-2026-14959/): OS Command Injection in IBM Aspera Faspex (critical 9.1)
- [CVE-2026-14958](https://insights.sbomify.com/CVE-2026-14958/): OS command injection in IBM Aspera Faspex (critical 9.1)
- [CVE-2026-14957](https://insights.sbomify.com/CVE-2026-14957/): FIPS mode assertion failure via malicious CERT payload (high 7.5)
- [CVE-2026-14956](https://insights.sbomify.com/CVE-2026-14956/): Bricksforge <= 3.1.8.6 - Unauthenticated Privilege Escalation via Pro Forms fieldIds Parameter (critical 9.8)
- [CVE-2026-14955](https://insights.sbomify.com/CVE-2026-14955/): Path traversal in Checkout Field Editor for WooCommerce (Pro) (medium 6.5)
- [CVE-2026-14953](https://insights.sbomify.com/CVE-2026-14953/): Missing authorization in FDS 102 (medium 5.3)
- [CVE-2026-14952](https://insights.sbomify.com/CVE-2026-14952/): Missing authorization in FDS 102 (high 8.7)
- [CVE-2026-14951](https://insights.sbomify.com/CVE-2026-14951/): Cross-site request forgery in FDS 102 (high 8.6)
- [CVE-2026-14950](https://insights.sbomify.com/CVE-2026-14950/): Auth bypass in FDS 102 (critical 9.2)
- [CVE-2026-1495](https://insights.sbomify.com/CVE-2026-1495/): Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT Agent (medium 5.7)
- [CVE-2026-14949](https://insights.sbomify.com/CVE-2026-14949/): Privilege escalation in FDS 102 (high 8.5)
- [CVE-2026-14948](https://insights.sbomify.com/CVE-2026-14948/): Information disclosure in FDS 102 (high 8.7)
- [CVE-2026-14947](https://insights.sbomify.com/CVE-2026-14947/): Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious ZIP file (high 8.6)
- [CVE-2026-14946](https://insights.sbomify.com/CVE-2026-14946/): File upload in FDS 102 (high 8.6)
- [CVE-2026-14943](https://insights.sbomify.com/CVE-2026-14943/): Password Protected < 2.8.4 - Unauthenticated Sensitive Information Exposure via REST API (high 7.5)
- [CVE-2026-14941](https://insights.sbomify.com/CVE-2026-14941/): Customer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions (medium 5.4)
- [CVE-2026-14940](https://insights.sbomify.com/CVE-2026-14940/): 389-ds-base: 389-ds-base: heap-buffer-overflow in dn normalization via quoted multivalued rdn (medium 5.3)
- [CVE-2026-14939](https://insights.sbomify.com/CVE-2026-14939/): Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import (medium 6.8)
- [CVE-2026-14938](https://insights.sbomify.com/CVE-2026-14938/): FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR (medium 4.3)
- [CVE-2026-14936](https://insights.sbomify.com/CVE-2026-14936/): Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification (medium 5.3)
- [CVE-2026-14935](https://insights.sbomify.com/CVE-2026-14935/): Security feature bypass in Red Hat Enterprise Linux 10 (low 3.7)
- [CVE-2026-14934](https://insights.sbomify.com/CVE-2026-14934/): Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise (critical 9.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/862/