# Vulnerabilities published in 2026


- [CVE-2026-1317](https://insights.sbomify.com/CVE-2026-1317/): WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name (medium 6.5)
- [CVE-2026-13169](https://insights.sbomify.com/CVE-2026-13169/): Eventin < 4.1.21 - Contributor+ Arbitrary Event Modification, Deletion and Ownership Takeover via IDOR (high 8.1)
- [CVE-2026-13168](https://insights.sbomify.com/CVE-2026-13168/): Eventin < 4.1.20 - Contributor+ Customer PII Disclosure via REST API (medium 6.5)
- [CVE-2026-13167](https://insights.sbomify.com/CVE-2026-13167/): Missing authorization in Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI (medium 4.3)
- [CVE-2026-13165](https://insights.sbomify.com/CVE-2026-13165/): Remote Code Execution in SzafirHost (high 8.6)
- [CVE-2026-13164](https://insights.sbomify.com/CVE-2026-13164/): Unauthenticated self-registration in MailerUp allows access to stored email data (high 8.8)
- [CVE-2026-13163](https://insights.sbomify.com/CVE-2026-13163/): Lack of input validation in Mailerup input parameter leads to Open Redirect (medium 5.3)
- [CVE-2026-13162](https://insights.sbomify.com/CVE-2026-13162/): Command injection in CoreTec 4 (high 7.7)
- [CVE-2026-13161](https://insights.sbomify.com/CVE-2026-13161/): TrueBooker <= 1.2.2 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-1316](https://insights.sbomify.com/CVE-2026-1316/): Customer Reviews for WooCommerce <= 5.97.0 - Unauthenticated Stored Cross-Site Scripting via media[].href Parameter (high 7.2)
- [CVE-2026-13159](https://insights.sbomify.com/CVE-2026-13159/): Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation (medium 4.3)
- [CVE-2026-13158](https://insights.sbomify.com/CVE-2026-13158/): Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2026-13157](https://insights.sbomify.com/CVE-2026-13157/): Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2026-13156](https://insights.sbomify.com/CVE-2026-13156/): MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF (medium 5.4)
- [CVE-2026-13154](https://insights.sbomify.com/CVE-2026-13154/): Essential Blocks < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint (high 7.5)
- [CVE-2026-13153](https://insights.sbomify.com/CVE-2026-13153/): Essential Blocks < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint (high 7.5)
- [CVE-2026-13152](https://insights.sbomify.com/CVE-2026-13152/): Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation (high 8.1)
- [CVE-2026-13150](https://insights.sbomify.com/CVE-2026-13150/): SSRF in Pentestify PDF generation endpoint via Host header (medium 6.9)
- [CVE-2026-1315](https://insights.sbomify.com/CVE-2026-1315/): Unauthenticated Denial of Service via Firmware Update Endpoint on TP-Link Tapo C220 & C520WS (high 7.1)
- [CVE-2026-13149](https://insights.sbomify.com/CVE-2026-13149/): brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups (high 7.7)
- [CVE-2026-13148](https://insights.sbomify.com/CVE-2026-13148/): Memory leak in scan method (medium 6.3)
- [CVE-2026-13147](https://insights.sbomify.com/CVE-2026-13147/): Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis (critical 9.1)
- [CVE-2026-13146](https://insights.sbomify.com/CVE-2026-13146/): WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR (low 3.7)
- [CVE-2026-13145](https://insights.sbomify.com/CVE-2026-13145/): WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR (medium 4.3)
- [CVE-2026-13144](https://insights.sbomify.com/CVE-2026-13144/): WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset (low 3.7)
- [CVE-2026-13143](https://insights.sbomify.com/CVE-2026-13143/): WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN (medium 5.3)
- [CVE-2026-13142](https://insights.sbomify.com/CVE-2026-13142/): Passwordless Login by VentraConnect < 1.4.1 - Unauthenticated Account Takeover via Email OTP Brute Force (high 8.1)
- [CVE-2026-13140](https://insights.sbomify.com/CVE-2026-13140/): Stored Cross-Site Scripting in Canarytokens.org (low 1.1)
- [CVE-2026-1314](https://insights.sbomify.com/CVE-2026-1314/): Missing authorization in 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery (medium 5.3)
- [CVE-2026-13138](https://insights.sbomify.com/CVE-2026-13138/): Improper Authorization in Divasoft Software's Biletiva Ticketing Platform (high 8.6)
- [CVE-2026-13133](https://insights.sbomify.com/CVE-2026-13133/): Other in LINE for Windows (high 8.4)
- [CVE-2026-13132](https://insights.sbomify.com/CVE-2026-13132/): GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability (high 8.3)
- [CVE-2026-13131](https://insights.sbomify.com/CVE-2026-13131/): GeoVision GeoWebPlayer Websocket Server out-of-bounds read vulnerability (high 8.3)
- [CVE-2026-1313](https://insights.sbomify.com/CVE-2026-1313/): Server-side request forgery in MimeTypes Link Icons (high 8.3)
- [CVE-2026-13129](https://insights.sbomify.com/CVE-2026-13129/): Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-13128](https://insights.sbomify.com/CVE-2026-13128/): Foxit PDF Editor/Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-13127](https://insights.sbomify.com/CVE-2026-13127/): Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-13126](https://insights.sbomify.com/CVE-2026-13126/): Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-13125](https://insights.sbomify.com/CVE-2026-13125/): GeoVision GeoWebPlayer 1.1.1.0 Websocket Server function vulnerability (high 8.8)
- [CVE-2026-13122](https://insights.sbomify.com/CVE-2026-13122/): Denial of service in OpenVPN (medium 5.9)
- [CVE-2026-13121](https://insights.sbomify.com/CVE-2026-13121/): Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2026-1312](https://insights.sbomify.com/CVE-2026-1312/): Potential SQL injection via QuerySet.order_by and FilteredRelation (medium 5.4)
- [CVE-2026-13119](https://insights.sbomify.com/CVE-2026-13119/): Registrations for the Events Calendar <= 3.2 - Authenticated (Contributor+) SQL Injection via 'standard' Parameter (medium 6.5)
- [CVE-2026-13117](https://insights.sbomify.com/CVE-2026-13117/): Use after free in OpenVPN (medium 6.0)
- [CVE-2026-13116](https://insights.sbomify.com/CVE-2026-13116/): Missing authorization in PDF Invoices & Packing Slips for WooCommerce (medium 4.3)
- [CVE-2026-13114](https://insights.sbomify.com/CVE-2026-13114/): Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info (high 7.2)
- [CVE-2026-13113](https://insights.sbomify.com/CVE-2026-13113/): Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab (medium 6.5)
- [CVE-2026-13110](https://insights.sbomify.com/CVE-2026-13110/): Missing authorization in StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce (medium 5.3)
- [CVE-2026-1311](https://insights.sbomify.com/CVE-2026-1311/): Worry Proof Backup <= 0.2.4 - Authenticated (Subscriber+) Path Traversal via Backup Upload (high 8.8)
- [CVE-2026-13108](https://insights.sbomify.com/CVE-2026-13108/): Dimension Denial-of-Service (high 8.7)
- [CVE-2026-13107](https://insights.sbomify.com/CVE-2026-13107/): Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026 (high 7.1)
- [CVE-2026-13105](https://insights.sbomify.com/CVE-2026-13105/): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (high 8.8)
- [CVE-2026-13104](https://insights.sbomify.com/CVE-2026-13104/): Privilege escalation in App Store (high 7.0)
- [CVE-2026-13103](https://insights.sbomify.com/CVE-2026-13103/): Path traversal in App Store (high 7.0)
- [CVE-2026-1310](https://insights.sbomify.com/CVE-2026-1310/): Simple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion (medium 5.3)
- [CVE-2026-13097](https://insights.sbomify.com/CVE-2026-13097/): Privilege escalation in Red Hat Enterprise Linux 10 (high 8.7)
- [CVE-2026-13094](https://insights.sbomify.com/CVE-2026-13094/): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (high 7.8)
- [CVE-2026-13089](https://insights.sbomify.com/CVE-2026-13089/): Auth bypass in OIDC::Lite (high 7.5)
- [CVE-2026-13086](https://insights.sbomify.com/CVE-2026-13086/): Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint (critical 9.3)
- [CVE-2026-13084](https://insights.sbomify.com/CVE-2026-13084/): Null Pointer Dereference in WatchGuard Fireware OS iked Process (high 8.7)
- [CVE-2026-13083](https://insights.sbomify.com/CVE-2026-13083/): Pen-drive: pen-drive: stored xss via unescaped cluster data in html report (medium 6.9)
- [CVE-2026-13082](https://insights.sbomify.com/CVE-2026-13082/): GD::SecurityImage versions through 1.75 for Perl use rand to generate secrets (medium 5.3)
- [CVE-2026-13080](https://insights.sbomify.com/CVE-2026-13080/): WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter (medium 6.6)
- [CVE-2026-13079](https://insights.sbomify.com/CVE-2026-13079/): WatchGuard Mobile VPN with SSL Windows Client Local Privilege Escalation (high 7.3)
- [CVE-2026-13078](https://insights.sbomify.com/CVE-2026-13078/): Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader (medium 6.3)
- [CVE-2026-13077](https://insights.sbomify.com/CVE-2026-13077/): Out-of-Bounds Heap Read in BSON CodeWScope Element Parsing via Malformed BSONColumn Data (high 7.1)
- [CVE-2026-13076](https://insights.sbomify.com/CVE-2026-13076/): Aggregation Framework Memory Exhaustion Leading to Process Termination (high 7.1)
- [CVE-2026-13075](https://insights.sbomify.com/CVE-2026-13075/): $rankFusion and $scoreFusion Unbounded Memory Allocation During Error Suggestion Generation (high 7.1)
- [CVE-2026-13074](https://insights.sbomify.com/CVE-2026-13074/): Awaitable Hello Command in Exhaust Mode Unthrottled Response Loop Leading to Denial of Service (medium 6.9)
- [CVE-2026-13073](https://insights.sbomify.com/CVE-2026-13073/): MongoDB Aggregation Command Invariant Assertion Failure Leading to Process Termination (medium 5.3)
- [CVE-2026-13072](https://insights.sbomify.com/CVE-2026-13072/): MongoDB Improper Input Validation in Compute Mode External Data Processing Leading to Memory Corruption (critical 9.2)
- [CVE-2026-13071](https://insights.sbomify.com/CVE-2026-13071/): Server-Side JavaScript Aggregation Expression Memory Safety Issue Leading to Process Termination (high 7.1)
- [CVE-2026-13070](https://insights.sbomify.com/CVE-2026-13070/): Improper Validation of OCSP Response During Outbound TLS Handshake Leading to Process Termination (medium 6.0)
- [CVE-2026-1307](https://insights.sbomify.com/CVE-2026-1307/): Ninja Forms <= 3.14.1 - Authenticated (Contributor+) Sensitive Information Disclosure via Block Editor Token (medium 6.5)
- [CVE-2026-13069](https://insights.sbomify.com/CVE-2026-13069/): Queryable Encryption FLE2 Find Payload Missing Input Validation Leading to Resource Exhaustion (high 7.1)
- [CVE-2026-13068](https://insights.sbomify.com/CVE-2026-13068/): MongoDB mongos Improper Authorization Check in Cursor Termination Allowing Cross-Database Privilege Misuse (low 2.3)
- [CVE-2026-13067](https://insights.sbomify.com/CVE-2026-13067/): tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket (high 7.2)
- [CVE-2026-13066](https://insights.sbomify.com/CVE-2026-13066/): Server-Side JavaScript DBPointer BSON Serialization Memory Disclosure (high 7.1)
- [CVE-2026-13065](https://insights.sbomify.com/CVE-2026-13065/): MongoDB $linearFill Window Function Improper Input Validation Leading to Process Termination (high 7.1)
- [CVE-2026-13064](https://insights.sbomify.com/CVE-2026-13064/): MongoDB $jsonSchema Query Operator Excessive CPU Consumption Leading to Denial of Service (high 7.1)
- [CVE-2026-13063](https://insights.sbomify.com/CVE-2026-13063/): libmongocrypt Improper Input Validation Leading to Process Termination (medium 5.3)
- [CVE-2026-13062](https://insights.sbomify.com/CVE-2026-13062/): MongoDB mongos Improper Validation of Internal Flags in Queryable Encryption Write Commands on Sharded Clusters (high 7.1)
- [CVE-2026-13061](https://insights.sbomify.com/CVE-2026-13061/): Improper Access Control Allowing Cross-User Session Metadata Disclosure in $listSessions Aggregation Stage (medium 5.3)
- [CVE-2026-13060](https://insights.sbomify.com/CVE-2026-13060/): $graphLookup Aggregation Stage Authorization Check Inconsistency Allowing Unauthorized Collection Access (high 7.1)
- [CVE-2026-1306](https://insights.sbomify.com/CVE-2026-1306/): midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action (critical 9.8)
- [CVE-2026-13059](https://insights.sbomify.com/CVE-2026-13059/): Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass (high 8.6)
- [CVE-2026-13058](https://insights.sbomify.com/CVE-2026-13058/): Transaction Command Insufficient Input Validation Leading to Process Termination (high 7.1)
- [CVE-2026-13057](https://insights.sbomify.com/CVE-2026-13057/): Missing authorization in MongoDB Server (medium 6.0)
- [CVE-2026-13056](https://insights.sbomify.com/CVE-2026-13056/): A user with read access can cause a DoS by executing a specifically crafted query to consume a large amount of RAM (high 7.1)
- [CVE-2026-13055](https://insights.sbomify.com/CVE-2026-13055/): Server crash via aggregation pipeline expression with compound wildcard index specification (high 7.1)
- [CVE-2026-13054](https://insights.sbomify.com/CVE-2026-13054/): WatchGuard Firebox Arbitrary File Write via Path Traversal in Management Web UI (high 8.6)
- [CVE-2026-13053](https://insights.sbomify.com/CVE-2026-13053/): WatchGuard Firebox Authenticated Out of Bounds Write in Management CLI Command Handler (high 8.6)
- [CVE-2026-13051](https://insights.sbomify.com/CVE-2026-13051/): Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustio (critical 9.1)
- [CVE-2026-13050](https://insights.sbomify.com/CVE-2026-13050/): WatchGuard Firebox networkd Out of Bounds Write Vulnerability (high 8.6)
- [CVE-2026-1305](https://insights.sbomify.com/CVE-2026-1305/): Japanized for WooCommerce <= 2.8.4 - Missing Authorization to Unauthenticated Paidy Order Manipulation (medium 5.3)
- [CVE-2026-13048](https://insights.sbomify.com/CVE-2026-13048/): Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load (high 8.2)
- [CVE-2026-13046](https://insights.sbomify.com/CVE-2026-13046/): Fireware OS Deserialization of Untrusted Data in samld Allows Remote Code Execution (high 7.5)
- [CVE-2026-13043](https://insights.sbomify.com/CVE-2026-13043/): Auth bypass in Endpoint Security (critical 9.3)
- [CVE-2026-13042](https://insights.sbomify.com/CVE-2026-13042/): RPB Chessboard <= 8.1.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content (high 7.2)
- [CVE-2026-13040](https://insights.sbomify.com/CVE-2026-13040/): NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via 'real_val__' Parameter (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/879/