# Vulnerabilities published in 2026


- [CVE-2026-14381](https://insights.sbomify.com/CVE-2026-14381/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-14380](https://insights.sbomify.com/CVE-2026-14380/): DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile (high 8.8)
- [CVE-2026-1438](https://insights.sbomify.com/CVE-2026-1438/): Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface (medium 5.3)
- [CVE-2026-14379](https://insights.sbomify.com/CVE-2026-14379/): GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter (medium 6.4)
- [CVE-2026-14378](https://insights.sbomify.com/CVE-2026-14378/): Auth bypass in DevKit Pro (critical 9.8)
- [CVE-2026-14373](https://insights.sbomify.com/CVE-2026-14373/): Nomad Docker driver Linux host namespace bypass (high 7.7)
- [CVE-2026-14372](https://insights.sbomify.com/CVE-2026-14372/): Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter (high 7.1)
- [CVE-2026-14371](https://insights.sbomify.com/CVE-2026-14371/): Command injection in XClarity Integrator for Microsoft Windows Admin Center (high 8.8)
- [CVE-2026-1437](https://insights.sbomify.com/CVE-2026-1437/): Reflected Cross-Site Scripting (XSS) vulnerability in Graylog Web Interface (medium 5.3)
- [CVE-2026-14368](https://insights.sbomify.com/CVE-2026-14368/): Off-by-one out-of-bounds NUL write in Zephyr LwM2M JSON string parser (medium 5.4)
- [CVE-2026-14367](https://insights.sbomify.com/CVE-2026-14367/): I3C IBI work-node free-list data race between ISR and workqueue thread (low 3.1)
- [CVE-2026-14366](https://insights.sbomify.com/CVE-2026-14366/): SiWx91x WiFi driver double-unref / use-after-free of caller-owned TX net_pkt (medium 6.4)
- [CVE-2026-14365](https://insights.sbomify.com/CVE-2026-14365/): TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id' (critical 9.8)
- [CVE-2026-14364](https://insights.sbomify.com/CVE-2026-14364/): TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' (critical 9.8)
- [CVE-2026-14363](https://insights.sbomify.com/CVE-2026-14363/): Cargo Extension: SQLi in Special:Drilldown (medium 6.9)
- [CVE-2026-14362](https://insights.sbomify.com/CVE-2026-14362/): Denial of service via crafted push/pull gossip message in memberlist (medium 4.9)
- [CVE-2026-14361](https://insights.sbomify.com/CVE-2026-14361/): Consul-template is vulnerable to path redirection in writeToFile through symlink attack (medium 4.7)
- [CVE-2026-1436](https://insights.sbomify.com/CVE-2026-1436/): Improper Access Control (IDOR) vulnerability in Graylog Web Interface (high 7.1)
- [CVE-2026-14359](https://insights.sbomify.com/CVE-2026-14359/): Privilege escalation in YITH WooCommerce Waitlist Premium (high 8.8)
- [CVE-2026-14358](https://insights.sbomify.com/CVE-2026-14358/): Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title (medium 6.9)
- [CVE-2026-14357](https://insights.sbomify.com/CVE-2026-14357/): Missing authorization in DevKit Pro (high 8.8)
- [CVE-2026-14356](https://insights.sbomify.com/CVE-2026-14356/): Missing authorization in FleekDash V2 (high 8.8)
- [CVE-2026-14355](https://insights.sbomify.com/CVE-2026-14355/): ext/openssl: Memory corruption in openssl_encrypt with AES-WRAP-PAD (medium 5.6)
- [CVE-2026-14354](https://insights.sbomify.com/CVE-2026-14354/): Information disclosure in EcoStruxure™ Cybersecurity Admin Expert (high 8.7)
- [CVE-2026-14352](https://insights.sbomify.com/CVE-2026-14352/): AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal to Arbitrary File Read via 'file' Parameter (high 7.5)
- [CVE-2026-14351](https://insights.sbomify.com/CVE-2026-14351/): Exposure of Sensitive Information Through Metadata in GitLab (medium 4.3)
- [CVE-2026-14350](https://insights.sbomify.com/CVE-2026-14350/): Vulnerabilities exists in IBM Cloud Pak for Data System (medium 5.3)
- [CVE-2026-1435](https://insights.sbomify.com/CVE-2026-1435/): Incorrect management of session invalidation vulnerability in Graylog Web Interface (critical 9.3)
- [CVE-2026-14349](https://insights.sbomify.com/CVE-2026-14349/): Missing authorization in TrueBooker – Appointment Booking and Scheduler System (critical 9.8)
- [CVE-2026-14345](https://insights.sbomify.com/CVE-2026-14345/): WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter (critical 9.8)
- [CVE-2026-14344](https://insights.sbomify.com/CVE-2026-14344/): Inconsistent authorization checks in Mattermost Boards endpoints (medium 4.3)
- [CVE-2026-14343](https://insights.sbomify.com/CVE-2026-14343/): Cross-site scripting in Download Manager (medium 6.4)
- [CVE-2026-14342](https://insights.sbomify.com/CVE-2026-14342/): Mail Mint <= 1.24.2 - Authenticated (Administrator+) SQL Injection via 'contact_ids' Parameter (medium 4.9)
- [CVE-2026-14341](https://insights.sbomify.com/CVE-2026-14341/): Missing Authorization in GitLab (medium 4.9)
- [CVE-2026-14340](https://insights.sbomify.com/CVE-2026-14340/): Missing authorization in Enterprise Server (medium 5.3)
- [CVE-2026-1434](https://insights.sbomify.com/CVE-2026-1434/): Reflected XSS in Omega-PSIR (medium 5.1)
- [CVE-2026-14337](https://insights.sbomify.com/CVE-2026-14337/): Cross-site scripting in Pega Infinity (medium 4.6)
- [CVE-2026-14336](https://insights.sbomify.com/CVE-2026-14336/): Server-side request forgery in Eclipse CSI - PIA (high 8.2)
- [CVE-2026-14335](https://insights.sbomify.com/CVE-2026-14335/): Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters (high 7.2)
- [CVE-2026-14334](https://insights.sbomify.com/CVE-2026-14334/): Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload (high 8.8)
- [CVE-2026-14333](https://insights.sbomify.com/CVE-2026-14333/): Information disclosure in Demi (high 7.5)
- [CVE-2026-14332](https://insights.sbomify.com/CVE-2026-14332/): Ecwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action (medium 5.4)
- [CVE-2026-14331](https://insights.sbomify.com/CVE-2026-14331/): Subscribe2 < 10.46 - Reflected XSS via email Parameter (medium 6.1)
- [CVE-2026-14330](https://insights.sbomify.com/CVE-2026-14330/): Pipewire: pulse server alloca stack overflow (medium 5.5)
- [CVE-2026-1433](https://insights.sbomify.com/CVE-2026-1433/): Information disclosure in uniFLOW ULM (Universal Login Manager) Standalone (medium 4.8)
- [CVE-2026-14328](https://insights.sbomify.com/CVE-2026-14328/): Privilege escalation in Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress (high 8.8)
- [CVE-2026-14327](https://insights.sbomify.com/CVE-2026-14327/): AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Read via 'file' Parameter (high 7.5)
- [CVE-2026-14326](https://insights.sbomify.com/CVE-2026-14326/): Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR (low 3.8)
- [CVE-2026-14325](https://insights.sbomify.com/CVE-2026-14325/): Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting (low 3.5)
- [CVE-2026-14324](https://insights.sbomify.com/CVE-2026-14324/): Pipewire: raop rtsp null deref (medium 6.5)
- [CVE-2026-14323](https://insights.sbomify.com/CVE-2026-14323/): Path traversal in Printcart Store – Web to Print Product Designer for WooCommerce (high 7.5)
- [CVE-2026-14322](https://insights.sbomify.com/CVE-2026-14322/): Timetics < 1.0.57 - Unauthenticated Booking Auto-Approval via Arbitrary payment_method (medium 5.3)
- [CVE-2026-14321](https://insights.sbomify.com/CVE-2026-14321/): Divi Dash < 1.0.7 - Unauthenticated Denial of Service via IP Address Spoofing (high 8.2)
- [CVE-2026-1432](https://insights.sbomify.com/CVE-2026-1432/): SQL injection (SQLi) on the Buroweb platform (critical 9.3)
- [CVE-2026-14319](https://insights.sbomify.com/CVE-2026-14319/): GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure (high 7.5)
- [CVE-2026-14318](https://insights.sbomify.com/CVE-2026-14318/): GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings (medium 6.8)
- [CVE-2026-14317](https://insights.sbomify.com/CVE-2026-14317/): GiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass (medium 5.3)
- [CVE-2026-14316](https://insights.sbomify.com/CVE-2026-14316/): Heap buffer overflow in boks_sshd revoked-key error handling (high 8.1)
- [CVE-2026-14315](https://insights.sbomify.com/CVE-2026-14315/): Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission (medium 6.5)
- [CVE-2026-14314](https://insights.sbomify.com/CVE-2026-14314/): PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Image Attachment Disclosure via IDOR (medium 5.3)
- [CVE-2026-14313](https://insights.sbomify.com/CVE-2026-14313/): PeproDev WooCommerce Receipt Uploader <= 2.8.0 - Unauthenticated Order Receipt Tampering via IDOR (medium 5.3)
- [CVE-2026-14311](https://insights.sbomify.com/CVE-2026-14311/): Missing authorization in Booking for Appointments and Events Calendar – Amelia (medium 5.4)
- [CVE-2026-14310](https://insights.sbomify.com/CVE-2026-14310/): Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection (medium 5.4)
- [CVE-2026-1431](https://insights.sbomify.com/CVE-2026-1431/): Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure (medium 5.3)
- [CVE-2026-14309](https://insights.sbomify.com/CVE-2026-14309/): Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass (high 8.1)
- [CVE-2026-14308](https://insights.sbomify.com/CVE-2026-14308/): Insufficient Signature Validation (medium 4.9)
- [CVE-2026-14307](https://insights.sbomify.com/CVE-2026-14307/): Geotargeting WP < 3.5.6.2 - Reflected XSS (high 7.1)
- [CVE-2026-14306](https://insights.sbomify.com/CVE-2026-14306/): Tutor LMS < 3.9.14 - Subscriber+ Paid Course Content Disclosure via Enrollment Check Bypass (medium 4.3)
- [CVE-2026-14305](https://insights.sbomify.com/CVE-2026-14305/): WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes (medium 5.3)
- [CVE-2026-14304](https://insights.sbomify.com/CVE-2026-14304/): XML external entity in Eclipse Accessibility Tools Framework (ACTF) (medium 4.6)
- [CVE-2026-14300](https://insights.sbomify.com/CVE-2026-14300/): miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover (high 8.1)
- [CVE-2026-1430](https://insights.sbomify.com/CVE-2026-1430/): WP Lightbox 2 < 3.0.7 - Admin+ Stored XSS (medium 4.8)
- [CVE-2026-14298](https://insights.sbomify.com/CVE-2026-14298/): Boards archive import endpoint allows resource exhaustion via zip bomb and file size limit bypass in Mattermost (medium 6.5)
- [CVE-2026-14297](https://insights.sbomify.com/CVE-2026-14297/): Memory corruption in nRF Connect SDK (high 8.7)
- [CVE-2026-14296](https://insights.sbomify.com/CVE-2026-14296/): nRF54H20: MCUBoot can be tricked to executing unauthenticated code (high 7.5)
- [CVE-2026-14293](https://insights.sbomify.com/CVE-2026-14293/): Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor (high 8.8)
- [CVE-2026-14292](https://insights.sbomify.com/CVE-2026-14292/): WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title (medium 5.4)
- [CVE-2026-14291](https://insights.sbomify.com/CVE-2026-14291/): Security Ninja (Premium) < 5.290 - Two-Factor Authentication Bypass via secnin_skip_2fa (high 7.5)
- [CVE-2026-14290](https://insights.sbomify.com/CVE-2026-14290/): Embed Google Photos Album Easily <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute (medium 6.8)
- [CVE-2026-1429](https://insights.sbomify.com/CVE-2026-1429/): WellChoose｜Single Sign-On Portal System - Reflected Cross-site Scripting (medium 4.8)
- [CVE-2026-14289](https://insights.sbomify.com/CVE-2026-14289/): WP FacturaONE < 5.37 - Unauthenticated Remote Code Execution (critical 9.0)
- [CVE-2026-14288](https://insights.sbomify.com/CVE-2026-14288/): Use of Incorrectly-Resolved Name or Reference in GitLab (low 3.1)
- [CVE-2026-14287](https://insights.sbomify.com/CVE-2026-14287/): TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass (medium 4.7)
- [CVE-2026-14282](https://insights.sbomify.com/CVE-2026-14282/): GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field (critical 9.8)
- [CVE-2026-14281](https://insights.sbomify.com/CVE-2026-14281/): Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter (critical 9.8)
- [CVE-2026-14280](https://insights.sbomify.com/CVE-2026-14280/): Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys (medium 6.6)
- [CVE-2026-1428](https://insights.sbomify.com/CVE-2026-1428/): WellChoose｜Single Sign-On Portal System - OS Command Injection (high 8.7)
- [CVE-2026-14279](https://insights.sbomify.com/CVE-2026-14279/): Wholesale Market <= 2.2.2 - Authenticated (Subscriber+) Privilege Escalation via 'role_required' Parameter (high 8.8)
- [CVE-2026-14277](https://insights.sbomify.com/CVE-2026-14277/): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (medium 6.3)
- [CVE-2026-14276](https://insights.sbomify.com/CVE-2026-14276/): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (medium 6.3)
- [CVE-2026-14275](https://insights.sbomify.com/CVE-2026-14275/): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (medium 6.3)
- [CVE-2026-14273](https://insights.sbomify.com/CVE-2026-14273/): IBM DataPower Gateway Incorrect Authorization (medium 6.5)
- [CVE-2026-14270](https://insights.sbomify.com/CVE-2026-14270/): File upload in Extra Checkout Options - addon for Extra Product Options plugin (high 8.8)
- [CVE-2026-1427](https://insights.sbomify.com/CVE-2026-1427/): WellChoose｜Single Sign-On Portal System - OS Command Injection (high 8.7)
- [CVE-2026-14269](https://insights.sbomify.com/CVE-2026-14269/): IBM DataPower Gateway Buffer Overflow (critical 9.8)
- [CVE-2026-14266](https://insights.sbomify.com/CVE-2026-14266/): 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.0)
- [CVE-2026-14265](https://insights.sbomify.com/CVE-2026-14265/): RCE via Deserialization in AWS Advanced JDBC Wrapper (high 7.7)
- [CVE-2026-14262](https://insights.sbomify.com/CVE-2026-14262/): Auth bypass in Simple JWT Login – Allows you to use JWT on REST endpoints. (high 8.8)
- [CVE-2026-14261](https://insights.sbomify.com/CVE-2026-14261/): CVE-2026-14261 (critical 9.1)
- [CVE-2026-1426](https://insights.sbomify.com/CVE-2026-1426/): Advanced AJAX Product Filters <= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer Compatibility (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/868/