# Vulnerabilities published in 2026


- [CVE-2026-1341](https://insights.sbomify.com/CVE-2026-1341/): Missing Authentication for Critical Function in Avation Light Engine Pro (critical 9.3)
- [CVE-2026-13407](https://insights.sbomify.com/CVE-2026-13407/): Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails (medium 6.1)
- [CVE-2026-13406](https://insights.sbomify.com/CVE-2026-13406/): Royal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure (medium 5.3)
- [CVE-2026-13405](https://insights.sbomify.com/CVE-2026-13405/): Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder (medium 6.6)
- [CVE-2026-13404](https://insights.sbomify.com/CVE-2026-13404/): Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init (medium 5.3)
- [CVE-2026-13402](https://insights.sbomify.com/CVE-2026-13402/): Royal Elementor Addons < 1.7.1063 - Unauthenticated Private Mega Menu Template Disclosure (medium 5.3)
- [CVE-2026-13401](https://insights.sbomify.com/CVE-2026-13401/): XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes (high 7.5)
- [CVE-2026-13400](https://insights.sbomify.com/CVE-2026-13400/): Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information (medium 6.1)
- [CVE-2026-1340](https://insights.sbomify.com/CVE-2026-1340/): Ivanti Endpoint Manager Mobile (EPMM) Code Injection (critical 9.8, exploited in the wild)
- [CVE-2026-13399](https://insights.sbomify.com/CVE-2026-13399/): Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order (high 7.5)
- [CVE-2026-13397](https://insights.sbomify.com/CVE-2026-13397/): HTML::Bare versions through 0.04 for Perl will hang in an infinite loop when parsing malformed attributes (high 7.5)
- [CVE-2026-13395](https://insights.sbomify.com/CVE-2026-13395/): Bookly < 27.8 - Unauthenticated SQL Injection via staff_id (high 8.6)
- [CVE-2026-13393](https://insights.sbomify.com/CVE-2026-13393/): ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite) (low 3.5)
- [CVE-2026-13392](https://insights.sbomify.com/CVE-2026-13392/): ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite) (high 7.2)
- [CVE-2026-13390](https://insights.sbomify.com/CVE-2026-13390/): The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation (medium 5.3)
- [CVE-2026-13389](https://insights.sbomify.com/CVE-2026-13389/): Missing authorization in webtoffee-cookie-consent (medium 6.5)
- [CVE-2026-13385](https://insights.sbomify.com/CVE-2026-13385/): Security feature bypass in Router (critical 9.5)
- [CVE-2026-13384](https://insights.sbomify.com/CVE-2026-13384/): WatchGuard Firebox wgagent Out of Bounds Write Vulnerability (high 8.6)
- [CVE-2026-13383](https://insights.sbomify.com/CVE-2026-13383/): WatchGuard Firebox ikestubd Out of Bounds Write Vulnerability (high 8.6)
- [CVE-2026-13381](https://insights.sbomify.com/CVE-2026-13381/): VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion (high 8.7)
- [CVE-2026-13380](https://insights.sbomify.com/CVE-2026-13380/): VSee Clinic and API Exposes Cleartext SFTP Credentials in Unauthenticated HTTP Responses (critical 9.0)
- [CVE-2026-1338](https://insights.sbomify.com/CVE-2026-1338/): Authorization Bypass Through User-Controlled Key in GitLab (medium 4.3)
- [CVE-2026-13379](https://insights.sbomify.com/CVE-2026-13379/): Memory corruption in OpenVPN (medium 5.1)
- [CVE-2026-13378](https://insights.sbomify.com/CVE-2026-13378/): Form Vibes <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field (high 7.2)
- [CVE-2026-13377](https://insights.sbomify.com/CVE-2026-13377/): WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in SIP Proxy Configuration (medium 4.8)
- [CVE-2026-13376](https://insights.sbomify.com/CVE-2026-13376/): WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module (medium 4.8)
- [CVE-2026-13375](https://insights.sbomify.com/CVE-2026-13375/): WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Autotask Technology Integration Configuration (medium 4.8)
- [CVE-2026-13374](https://insights.sbomify.com/CVE-2026-13374/): WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in ConnectWise Technology Integration Configuration (medium 4.8)
- [CVE-2026-13373](https://insights.sbomify.com/CVE-2026-13373/): WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Tigerpaw Technology Integration Configuration (medium 4.8)
- [CVE-2026-13372](https://insights.sbomify.com/CVE-2026-13372/): Code injection in Remote Desktop Manager (high 7.2)
- [CVE-2026-13371](https://insights.sbomify.com/CVE-2026-13371/): WatchGuard Firebox Management Web UI Denial of Service via Unsafe Deserialization (medium 6.9)
- [CVE-2026-1337](https://insights.sbomify.com/CVE-2026-1337/): Insufficient escaping of unicode characters in query log (low 1.1)
- [CVE-2026-13369](https://insights.sbomify.com/CVE-2026-13369/): Path traversal in Ninja Forms - File Uploads (high 7.5)
- [CVE-2026-13368](https://insights.sbomify.com/CVE-2026-13368/): WatchGuard Firebox Race Condition and Use-After-Free in Mobile VPN with IKEv2 LDAP Authentication (critical 9.2)
- [CVE-2026-13367](https://insights.sbomify.com/CVE-2026-13367/): IBM Informix Dynamic Server Privilege Escalation Vulnerability in oninit Utility (high 7.8)
- [CVE-2026-13365](https://insights.sbomify.com/CVE-2026-13365/): IBM Planning Analytics Local is affected by security vulnerabilities (high 7.1)
- [CVE-2026-13362](https://insights.sbomify.com/CVE-2026-13362/): Cross-site scripting in SendPulse Email Marketing Newsletter (medium 6.4)
- [CVE-2026-13361](https://insights.sbomify.com/CVE-2026-13361/): IBM Informix Server Vulnerability in SQL Interface Handler Could Allow Remote Code Execution (high 8.8)
- [CVE-2026-13360](https://insights.sbomify.com/CVE-2026-13360/): Cross-site scripting in WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode (high 7.2)
- [CVE-2026-1336](https://insights.sbomify.com/CVE-2026-1336/): Missing authorization in AI ChatBot with ChatGPT and Content Generator by AYS (medium 5.3)
- [CVE-2026-13359](https://insights.sbomify.com/CVE-2026-13359/): Cross-site scripting in Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress (high 7.2)
- [CVE-2026-13358](https://insights.sbomify.com/CVE-2026-13358/): Missing authorization in Simply Schedule Appointments (medium 6.5)
- [CVE-2026-13357](https://insights.sbomify.com/CVE-2026-13357/): Houzez Property Feed <= 2.5.46 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (medium 4.9)
- [CVE-2026-13356](https://insights.sbomify.com/CVE-2026-13356/): Interrupted navigation could allow address bar origin spoofing in Firefox for iOS (medium 6.3)
- [CVE-2026-13355](https://insights.sbomify.com/CVE-2026-13355/): Privilege escalation in Meta Box Frontend Submission (critical 9.8)
- [CVE-2026-13354](https://insights.sbomify.com/CVE-2026-13354/): Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content (high 7.2)
- [CVE-2026-13353](https://insights.sbomify.com/CVE-2026-13353/): Code injection in WP Ultimate CSV Importer – WordPress Import & Export for CSV, XML & Excel (high 8.8)
- [CVE-2026-13352](https://insights.sbomify.com/CVE-2026-13352/): File upload in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (high 8.8)
- [CVE-2026-13351](https://insights.sbomify.com/CVE-2026-13351/): net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets (high 7.5)
- [CVE-2026-13350](https://insights.sbomify.com/CVE-2026-13350/): Missing authorization in Venueless (low 2.3)
- [CVE-2026-1335](https://insights.sbomify.com/CVE-2026-1335/): Memory corruption in SOLIDWORKS eDrawings (high 7.8)
- [CVE-2026-13348](https://insights.sbomify.com/CVE-2026-13348/): Auth bypass in PowerChute™ Serial Shutdown (medium 6.9)
- [CVE-2026-13347](https://insights.sbomify.com/CVE-2026-13347/): Hide My WP Lite <= 1.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'he_wrapper_js' Parameter (high 7.5)
- [CVE-2026-13346](https://insights.sbomify.com/CVE-2026-13346/): pip absolute path traversal during download from malicious package indexes (medium 5.6)
- [CVE-2026-13345](https://insights.sbomify.com/CVE-2026-13345/): Missing authorization in Essential Addons for Elementor (medium 5.3)
- [CVE-2026-13344](https://insights.sbomify.com/CVE-2026-13344/): Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag (medium 4.8)
- [CVE-2026-13343](https://insights.sbomify.com/CVE-2026-13343/): Uninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responder (medium 5.3)
- [CVE-2026-13342](https://insights.sbomify.com/CVE-2026-13342/): Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password (medium 5.3)
- [CVE-2026-13341](https://insights.sbomify.com/CVE-2026-13341/): Prompt Injection and Credential Exposure via Untrusted Analytics Data in Kong Konnect MCP (high 7.4)
- [CVE-2026-13340](https://insights.sbomify.com/CVE-2026-13340/): SVG Support < 2.5.17 - Author+ Stored XSS via .svgz Sanitization Bypass (medium 6.1)
- [CVE-2026-1334](https://insights.sbomify.com/CVE-2026-1334/): Memory corruption in SOLIDWORKS eDrawings (high 7.8)
- [CVE-2026-13339](https://insights.sbomify.com/CVE-2026-13339/): CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter (high 7.5)
- [CVE-2026-13337](https://insights.sbomify.com/CVE-2026-13337/): SQL injection in NetBotz 5 - 750/755 (medium 5.1)
- [CVE-2026-13336](https://insights.sbomify.com/CVE-2026-13336/): Command injection in NetBotz 5 - 750/755 (high 7.3)
- [CVE-2026-13335](https://insights.sbomify.com/CVE-2026-13335/): Cross-site scripting in CodePeople Post Map for Google Maps (medium 6.4)
- [CVE-2026-13334](https://insights.sbomify.com/CVE-2026-13334/): Mang Board WP <= 2.3.4 - Reflected Cross-Site Scripting via 'stag' Parameter (medium 6.1)
- [CVE-2026-13333](https://insights.sbomify.com/CVE-2026-13333/): Groundhogg <= 4.5.5 - Authenticated (Sales Rep+) SQL Injection via 'query[select]' Parameter (medium 6.5)
- [CVE-2026-13332](https://insights.sbomify.com/CVE-2026-13332/): Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service) (critical 9.1)
- [CVE-2026-13331](https://insights.sbomify.com/CVE-2026-13331/): Groundhogg <= 4.5.5 - Authenticated (Marketer+) SQL Injection via 'search' Parameter (medium 6.5)
- [CVE-2026-13330](https://insights.sbomify.com/CVE-2026-13330/): Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload (medium 6.1)
- [CVE-2026-1333](https://insights.sbomify.com/CVE-2026-1333/): Memory corruption in SOLIDWORKS eDrawings (high 7.8)
- [CVE-2026-13329](https://insights.sbomify.com/CVE-2026-13329/): WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund (medium 6.5)
- [CVE-2026-13328](https://insights.sbomify.com/CVE-2026-13328/): TLP Food Menu < 6.0.2 - Unauthenticated Reservation Status Modification (medium 5.3)
- [CVE-2026-13327](https://insights.sbomify.com/CVE-2026-13327/): Security feature bypass in Server (high 8.3)
- [CVE-2026-13326](https://insights.sbomify.com/CVE-2026-13326/): Out-of-bounds read and integer underflow vulnerability in QNdefNfcTextRecord impacts Qt NFC module (medium 6.9)
- [CVE-2026-13323](https://insights.sbomify.com/CVE-2026-13323/): Cross-site scripting in Eclipse Open VSX (medium 4.1)
- [CVE-2026-13322](https://insights.sbomify.com/CVE-2026-13322/): Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service (low 3.8)
- [CVE-2026-13321](https://insights.sbomify.com/CVE-2026-13321/): DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (high 8.6)
- [CVE-2026-13320](https://insights.sbomify.com/CVE-2026-13320/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 7.3)
- [CVE-2026-1332](https://insights.sbomify.com/CVE-2026-1332/): HAMASTAR Technology｜MeetingHub - Missing Authentication (medium 6.9)
- [CVE-2026-13319](https://insights.sbomify.com/CVE-2026-13319/): Authorization Bypass Through User-Controlled Key in GitLab (medium 4.3)
- [CVE-2026-13318](https://insights.sbomify.com/CVE-2026-13318/): Virt-api-rhel9: kubevirt: kubevirt: ssrf in virt-api port-forward via unvalidated guest-agent-reported ip (medium 6.4)
- [CVE-2026-13316](https://insights.sbomify.com/CVE-2026-13316/): Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman config (medium 4.4)
- [CVE-2026-13314](https://insights.sbomify.com/CVE-2026-13314/): Stored XSS in pretix-digital (low 2.0)
- [CVE-2026-13313](https://insights.sbomify.com/CVE-2026-13313/): Security feature bypass in Router (high 8.9)
- [CVE-2026-13311](https://insights.sbomify.com/CVE-2026-13311/): shell-quote parse() is quadratic in token count, enabling denial of service (high 8.7)
- [CVE-2026-1331](https://insights.sbomify.com/CVE-2026-1331/): AMASTAR Technology｜MeetingHub - Arbitrary File Upload (critical 9.3)
- [CVE-2026-13309](https://insights.sbomify.com/CVE-2026-13309/): Autel MaxiCharger AC Elite Home NFC Stack-based Buffer Overflow Arbitrary Code Execution Vulnerability (medium 6.8)
- [CVE-2026-13308](https://insights.sbomify.com/CVE-2026-13308/): Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-13307](https://insights.sbomify.com/CVE-2026-13307/): Autel MaxiCharger AC Elite Home USB Heap-based Buffer Overflow Arbitrary Code Execution Vulnerability (medium 6.8)
- [CVE-2026-13306](https://insights.sbomify.com/CVE-2026-13306/): Autel MaxiCharger AC Elite Home USB Authentication Bypass Vulnerability (medium 4.3)
- [CVE-2026-13305](https://insights.sbomify.com/CVE-2026-13305/): Security feature bypass in MaxiCharger AC Elite Home (medium 6.4)
- [CVE-2026-13303](https://insights.sbomify.com/CVE-2026-13303/): Boundary vulnerable to server-side request forgery in Vault credential store (high 8.7)
- [CVE-2026-1330](https://insights.sbomify.com/CVE-2026-1330/): HAMASTAR Technology｜MeetingHub - Arbitrary File Read (high 8.7)
- [CVE-2026-13297](https://insights.sbomify.com/CVE-2026-13297/): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (high 7.5)
- [CVE-2026-13295](https://insights.sbomify.com/CVE-2026-13295/): Cross-site scripting in Page Builder by SiteOrigin (medium 6.4)
- [CVE-2026-13293](https://insights.sbomify.com/CVE-2026-13293/): IBM MQ Java messaging is vulnerable to remote code execution (high 8.8)
- [CVE-2026-1329](https://insights.sbomify.com/CVE-2026-1329/): Tenda AX1803 WifiGuestSet fromGetWifiGuestBasic stack-based overflow (high 8.7)
- [CVE-2026-13287](https://insights.sbomify.com/CVE-2026-13287/): IBM MQ Managed File Transfer is vulnerable to XML external entity injection (high 7.1)
- [CVE-2026-13285](https://insights.sbomify.com/CVE-2026-13285/): IBM MQ Managed File Transfer is vulnerable to XML external entity injection (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/877/