# Vulnerabilities published in 2026


- [CVE-2026-14933](https://insights.sbomify.com/CVE-2026-14933/): Unblu Spark Cross-Site Scripting in Embedded Co-Browsing (high 8.6)
- [CVE-2026-14932](https://insights.sbomify.com/CVE-2026-14932/): Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart (medium 6.5)
- [CVE-2026-14931](https://insights.sbomify.com/CVE-2026-14931/): JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure (medium 6.5)
- [CVE-2026-14930](https://insights.sbomify.com/CVE-2026-14930/): JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload (high 7.5)
- [CVE-2026-1493](https://insights.sbomify.com/CVE-2026-1493/): Cross-Site Scripting in LEX Baza Dokumentów (medium 4.6)
- [CVE-2026-14929](https://insights.sbomify.com/CVE-2026-14929/): JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR (medium 4.3)
- [CVE-2026-14928](https://insights.sbomify.com/CVE-2026-14928/): JS Help Desk < 3.1.4 - Subscriber+ Sensitive Information Disclosure via checkAIReplyTicketsBySubject (medium 6.5)
- [CVE-2026-14927](https://insights.sbomify.com/CVE-2026-14927/): FluentCart < 1.5.3 - Unauthenticated Order PII Disclosure via Print Routes (low 3.7)
- [CVE-2026-14926](https://insights.sbomify.com/CVE-2026-14926/): FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR (medium 4.2)
- [CVE-2026-14925](https://insights.sbomify.com/CVE-2026-14925/): Import WP < 2.14.23 - Unauthenticated Sensitive Information Exposure via Export File Download (high 7.5)
- [CVE-2026-14924](https://insights.sbomify.com/CVE-2026-14924/): Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification (high 7.5)
- [CVE-2026-14923](https://insights.sbomify.com/CVE-2026-14923/): Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification (medium 6.5)
- [CVE-2026-14922](https://insights.sbomify.com/CVE-2026-14922/): WP Photo Album Plus < 9.2.04.003 - Subscriber+ Stored XSS via Photo Comment (medium 6.1)
- [CVE-2026-14921](https://insights.sbomify.com/CVE-2026-14921/): Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode (medium 6.1)
- [CVE-2026-14920](https://insights.sbomify.com/CVE-2026-14920/): AcyMailing < 10.11.1 - Unauthenticated SQL Injection via subscription[] Parameter (high 8.2)
- [CVE-2026-1492](https://insights.sbomify.com/CVE-2026-1492/): User Registration & Membership <= 5.1.2 - Unauthenticated Privilege Escalation via Membership Registration (critical 9.8)
- [CVE-2026-14919](https://insights.sbomify.com/CVE-2026-14919/): ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute (critical 9.8)
- [CVE-2026-14917](https://insights.sbomify.com/CVE-2026-14917/): Kong API Gateway Enterprise: SAML Authentication bypass (high 7.7)
- [CVE-2026-14916](https://insights.sbomify.com/CVE-2026-14916/): Kong API Gateway Enterprise: JWT Algorithm-Confusion (high 7.7)
- [CVE-2026-14913](https://insights.sbomify.com/CVE-2026-14913/): SQL Injection vulnerability (high 8.8)
- [CVE-2026-14911](https://insights.sbomify.com/CVE-2026-14911/): Cross-site scripting in Router (critical 9.3)
- [CVE-2026-1491](https://insights.sbomify.com/CVE-2026-1491/): Security Vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 5.3)
- [CVE-2026-14909](https://insights.sbomify.com/CVE-2026-14909/): IBM WebSphere Application Server Liberty Information Disclosure (medium 6.5)
- [CVE-2026-14906](https://insights.sbomify.com/CVE-2026-14906/): Path traversal in Firefox for iOS (medium 5.3)
- [CVE-2026-14905](https://insights.sbomify.com/CVE-2026-14905/): IBM DataPower Gateway XXE (high 8.2)
- [CVE-2026-14904](https://insights.sbomify.com/CVE-2026-14904/): RES Auth.GetUserPrivateKey Arbitrary File Read (high 7.1)
- [CVE-2026-14903](https://insights.sbomify.com/CVE-2026-14903/): Path traversal in Xtraction (high 7.7)
- [CVE-2026-14902](https://insights.sbomify.com/CVE-2026-14902/): Open redirect in Xtraction (medium 4.0)
- [CVE-2026-14900](https://insights.sbomify.com/CVE-2026-14900/): Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter (critical 9.8)
- [CVE-2026-1490](https://insights.sbomify.com/CVE-2026-1490/): Auth bypass in Spam protection, Honeypot, Anti-Spam by CleanTalk (critical 9.8)
- [CVE-2026-14899](https://insights.sbomify.com/CVE-2026-14899/): Off-by-one out of bounds read in MIME header parser for forwarding (high 7.5)
- [CVE-2026-14898](https://insights.sbomify.com/CVE-2026-14898/): Information disclosure in Codex desktop app for macOS (medium 6.5)
- [CVE-2026-14896](https://insights.sbomify.com/CVE-2026-14896/): Nomad vulnerable to cross-namespace host volume claim deletion (medium 4.2)
- [CVE-2026-14895](https://insights.sbomify.com/CVE-2026-14895/): String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service (high 7.5)
- [CVE-2026-14894](https://insights.sbomify.com/CVE-2026-14894/): Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) (critical 9.8)
- [CVE-2026-14893](https://insights.sbomify.com/CVE-2026-14893/): IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image (high 7.3)
- [CVE-2026-14892](https://insights.sbomify.com/CVE-2026-14892/): Tanium addressed an improper access controls vulnerability in Tanium Server. (medium 4.3)
- [CVE-2026-14891](https://insights.sbomify.com/CVE-2026-14891/): Nomad vulnerable to sandbox escape in Docker task driver (high 8.7)
- [CVE-2026-14890](https://insights.sbomify.com/CVE-2026-14890/): CVE-2026-14890 (critical 9.1)
- [CVE-2026-1489](https://insights.sbomify.com/CVE-2026-1489/): Glib: glib: memory corruption via integer overflow in unicode case conversion (medium 5.4)
- [CVE-2026-14888](https://insights.sbomify.com/CVE-2026-14888/): IBM DataPower Gateway Buffer Overflow (high 8.1)
- [CVE-2026-14886](https://insights.sbomify.com/CVE-2026-14886/): Vault Enterprise vulnerable to cross-namespace entity deletion (high 8.2)
- [CVE-2026-14882](https://insights.sbomify.com/CVE-2026-14882/): Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta (medium 6.4)
- [CVE-2026-14881](https://insights.sbomify.com/CVE-2026-14881/): Command injection in MongoDB Compass (high 8.4)
- [CVE-2026-14877](https://insights.sbomify.com/CVE-2026-14877/): Cross-site scripting in Data Tables Generator by Supsystic (medium 6.4)
- [CVE-2026-14876](https://insights.sbomify.com/CVE-2026-14876/): Cross-site scripting in Smart Slider 3 (medium 6.4)
- [CVE-2026-14875](https://insights.sbomify.com/CVE-2026-14875/): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (high 7.3)
- [CVE-2026-14873](https://insights.sbomify.com/CVE-2026-14873/): Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset (high 8.0)
- [CVE-2026-14872](https://insights.sbomify.com/CVE-2026-14872/): Database for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id Parameter (medium 6.8)
- [CVE-2026-14871](https://insights.sbomify.com/CVE-2026-14871/): osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure (high 7.1)
- [CVE-2026-14870](https://insights.sbomify.com/CVE-2026-14870/): Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id (high 7.1)
- [CVE-2026-1487](https://insights.sbomify.com/CVE-2026-1487/): LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import (medium 6.5)
- [CVE-2026-14869](https://insights.sbomify.com/CVE-2026-14869/): terraform-mcp-server vulnerable to server side request forgery leading to token exposure (high 8.6)
- [CVE-2026-14868](https://insights.sbomify.com/CVE-2026-14868/): Weak encryption mechanism for User directory (high 8.4)
- [CVE-2026-14867](https://insights.sbomify.com/CVE-2026-14867/): Insecure password storage in User directory (medium 6.8)
- [CVE-2026-14866](https://insights.sbomify.com/CVE-2026-14866/): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (high 7.7)
- [CVE-2026-14865](https://insights.sbomify.com/CVE-2026-14865/): XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX (medium 5.3)
- [CVE-2026-14864](https://insights.sbomify.com/CVE-2026-14864/): JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode (medium 5.4)
- [CVE-2026-14863](https://insights.sbomify.com/CVE-2026-14863/): FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection (high 8.7)
- [CVE-2026-14862](https://insights.sbomify.com/CVE-2026-14862/): Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization (low 3.7)
- [CVE-2026-14861](https://insights.sbomify.com/CVE-2026-14861/): User Verification <= 2.0.47 - Unauthenticated Arbitrary Account Lockout via IDOR (high 7.5)
- [CVE-2026-14860](https://insights.sbomify.com/CVE-2026-14860/): Podcast Player < 8.3.1 - Unauthenticated Server-Side Request Forgery (medium 5.3)
- [CVE-2026-1486](https://insights.sbomify.com/CVE-2026-1486/): Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant (high 8.8)
- [CVE-2026-14859](https://insights.sbomify.com/CVE-2026-14859/): WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Creation via Missing Authorization (medium 4.3)
- [CVE-2026-14858](https://insights.sbomify.com/CVE-2026-14858/): WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR (medium 4.3)
- [CVE-2026-14857](https://insights.sbomify.com/CVE-2026-14857/): WP Crowdfunding < 2.2.1 - Subscriber+ Campaign Update Modification via IDOR (medium 4.3)
- [CVE-2026-14856](https://insights.sbomify.com/CVE-2026-14856/): Stored Cross-Site Scripting (XSS) in TastyIgniter Media Manager (medium 6.3)
- [CVE-2026-14855](https://insights.sbomify.com/CVE-2026-14855/): Cross-site scripting in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg (medium 6.4)
- [CVE-2026-14854](https://insights.sbomify.com/CVE-2026-14854/): WooCommerce Bookings < 3.11.0 - Unauthenticated Denial of Service (high 7.5)
- [CVE-2026-14853](https://insights.sbomify.com/CVE-2026-14853/): WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization (medium 4.3)
- [CVE-2026-14852](https://insights.sbomify.com/CVE-2026-14852/): mk_sap_hana: Privilege escalation via crafted sapstartsrv process name (medium 5.2)
- [CVE-2026-14851](https://insights.sbomify.com/CVE-2026-14851/): Unauthorised disclosure of information on Copart’s online billing service (critical 9.2)
- [CVE-2026-14850](https://insights.sbomify.com/CVE-2026-14850/): Weak password recovery mechanism for forgotten password in MobiAPParc (high 8.8)
- [CVE-2026-1485](https://insights.sbomify.com/CVE-2026-1485/): Glib: glib: local denial of service via buffer underflow in content type parsing (low 2.8)
- [CVE-2026-14849](https://insights.sbomify.com/CVE-2026-14849/): Paid Member Subscriptions < 3.0.7 - Unauthenticated Sensitive Information Exposure via Residual Export Files (low 3.7)
- [CVE-2026-14848](https://insights.sbomify.com/CVE-2026-14848/): Paid Member Subscriptions < 3.0.8 - Subscriber+ Cross-User Subscription Hijack via process_checkout (medium 5.4)
- [CVE-2026-14847](https://insights.sbomify.com/CVE-2026-14847/): Paid Member Subscriptions < 3.0.7 - Subscriber+ Payment Data Disclosure via IDOR (medium 4.3)
- [CVE-2026-14846](https://insights.sbomify.com/CVE-2026-14846/): Incorrect neutralisation in the PrestaShop firmware (medium 4.5)
- [CVE-2026-14845](https://insights.sbomify.com/CVE-2026-14845/): NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget (medium 6.1)
- [CVE-2026-14844](https://insights.sbomify.com/CVE-2026-14844/): Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes (medium 6.8)
- [CVE-2026-14843](https://insights.sbomify.com/CVE-2026-14843/): Events Made Easy < 3.1.4 - Unauthenticated Person Data Modification via IDOR (medium 5.3)
- [CVE-2026-14842](https://insights.sbomify.com/CVE-2026-14842/): Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass (medium 5.3)
- [CVE-2026-14841](https://insights.sbomify.com/CVE-2026-14841/): King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget (medium 6.1)
- [CVE-2026-14840](https://insights.sbomify.com/CVE-2026-14840/): YOP Poll < 7.0.6 - Unauthenticated Vote Restriction Bypass via IP Header Spoofing (medium 5.3)
- [CVE-2026-1484](https://insights.sbomify.com/CVE-2026-1484/): Glib: integer overflow leading to buffer underflow and out-of-bounds write in glib g_base64_encode() (medium 4.2)
- [CVE-2026-14839](https://insights.sbomify.com/CVE-2026-14839/): Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure (high 7.5)
- [CVE-2026-14838](https://insights.sbomify.com/CVE-2026-14838/): Session Token Exposure in URL Leading to Account Takeover in Bilin Software's HUMANIST Digital Human Resources (high 7.4)
- [CVE-2026-14837](https://insights.sbomify.com/CVE-2026-14837/): SSH Enablement Signature Verification Bypass (high 8.5)
- [CVE-2026-14836](https://insights.sbomify.com/CVE-2026-14836/): Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass (high 8.1)
- [CVE-2026-14835](https://insights.sbomify.com/CVE-2026-14835/): SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox (medium 6.8)
- [CVE-2026-14834](https://insights.sbomify.com/CVE-2026-14834/): Mailgun for WordPress < 2.2.1 - Unauthenticated Arbitrary Mailgun List Subscription via add_list AJAX (medium 6.5)
- [CVE-2026-14833](https://insights.sbomify.com/CVE-2026-14833/): Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute (medium 6.8)
- [CVE-2026-14832](https://insights.sbomify.com/CVE-2026-14832/): ShopSmart Loyalty for WooCommerce <= 1.0.0 - Unauthenticated Sensitive Information Disclosure via shopsmart_check_phone (medium 5.3)
- [CVE-2026-14831](https://insights.sbomify.com/CVE-2026-14831/): Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass (medium 5.3)
- [CVE-2026-14830](https://insights.sbomify.com/CVE-2026-14830/): FlxWoo < 3.1.1 - Unauthenticated Payment Bypass (high 7.5)
- [CVE-2026-1483](https://insights.sbomify.com/CVE-2026-1483/): Out-of-band SQL injection in Quatuor Performance Evaluation (critical 9.3)
- [CVE-2026-14829](https://insights.sbomify.com/CVE-2026-14829/): Checkimate <= 1.0.13 - Unauthenticated License Deactivation via Hardcoded Secret (high 8.2)
- [CVE-2026-14828](https://insights.sbomify.com/CVE-2026-14828/): SQL injection in ManageEngine Access Manager Plus (high 8.8)
- [CVE-2026-14827](https://insights.sbomify.com/CVE-2026-14827/): Calendar < 1.3.18 - Contributor+ Stored XSS via event_link Parameter (medium 6.8)
- [CVE-2026-14826](https://insights.sbomify.com/CVE-2026-14826/): Quiz And Survey Master < 11.2.4 - Contributor+ Cross-Quiz Email and Results Configuration Disclosure via IDOR (low 2.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/863/