# Vulnerabilities published in 2026


- [CVE-2026-1304](https://insights.sbomify.com/CVE-2026-1304/): Cross-site scripting in Membership Plugin – Restrict Content (medium 4.4)
- [CVE-2026-13039](https://insights.sbomify.com/CVE-2026-13039/): Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API (medium 5.3)
- [CVE-2026-13038](https://insights.sbomify.com/CVE-2026-13038/): Use after free in Chrome (high 8.8)
- [CVE-2026-13037](https://insights.sbomify.com/CVE-2026-13037/): Use after free in Chrome (high 7.8)
- [CVE-2026-13036](https://insights.sbomify.com/CVE-2026-13036/): Use after free in Chrome (high 8.8)
- [CVE-2026-13035](https://insights.sbomify.com/CVE-2026-13035/): Use after free in Chrome (high 8.8)
- [CVE-2026-13034](https://insights.sbomify.com/CVE-2026-13034/): Security feature bypass in Chrome (medium 4.7)
- [CVE-2026-13033](https://insights.sbomify.com/CVE-2026-13033/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-13032](https://insights.sbomify.com/CVE-2026-13032/): Use after free in Chrome (critical 9.6)
- [CVE-2026-13031](https://insights.sbomify.com/CVE-2026-13031/): Use after free in Chrome (high 8.8)
- [CVE-2026-13030](https://insights.sbomify.com/CVE-2026-13030/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-1303](https://insights.sbomify.com/CVE-2026-1303/): MailChimp Campaigns <= 3.2.4 - Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection (medium 5.3)
- [CVE-2026-13029](https://insights.sbomify.com/CVE-2026-13029/): Use after free in Chrome (high 7.5)
- [CVE-2026-13028](https://insights.sbomify.com/CVE-2026-13028/): Use after free in Chrome (critical 9.6)
- [CVE-2026-13027](https://insights.sbomify.com/CVE-2026-13027/): Use after free in Chrome (high 8.8)
- [CVE-2026-13026](https://insights.sbomify.com/CVE-2026-13026/): Use after free in Chrome (high 8.8)
- [CVE-2026-13025](https://insights.sbomify.com/CVE-2026-13025/): Race condition in Chrome (high 8.3)
- [CVE-2026-13024](https://insights.sbomify.com/CVE-2026-13024/): Security feature bypass in Chrome (medium 4.2)
- [CVE-2026-13023](https://insights.sbomify.com/CVE-2026-13023/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-13022](https://insights.sbomify.com/CVE-2026-13022/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-13021](https://insights.sbomify.com/CVE-2026-13021/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-13020](https://insights.sbomify.com/CVE-2026-13020/): Weak Password Recovery Mechanism in Portal for ArcGIS (high 8.1)
- [CVE-2026-1302](https://insights.sbomify.com/CVE-2026-1302/): Meta-box GalleryMeta <= 3.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via Image Caption (medium 4.4)
- [CVE-2026-13019](https://insights.sbomify.com/CVE-2026-13019/): Missing Authentication (critical 9.8)
- [CVE-2026-13018](https://insights.sbomify.com/CVE-2026-13018/): Memory corruption in Chrome (medium 4.3)
- [CVE-2026-13016](https://insights.sbomify.com/CVE-2026-13016/): Unauthenticated SQL Injection in ServiceNow AI Platform (critical 9.3)
- [CVE-2026-13015](https://insights.sbomify.com/CVE-2026-13015/): WP Google Review Slider <= 18.1 - Reflected Cross-Site Scripting via 'place' Parameter (medium 6.1)
- [CVE-2026-13014](https://insights.sbomify.com/CVE-2026-13014/): Remote Code Execution vulnerability in "Suspicious" application (critical 9.2)
- [CVE-2026-13011](https://insights.sbomify.com/CVE-2026-13011/): SQL injection in ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce (medium 6.5)
- [CVE-2026-13010](https://insights.sbomify.com/CVE-2026-13010/): JoomSport <= 5.7.9 - Authenticated (Contributor+) SQL Injection via 'event' Shortcode Attribute (medium 6.5)
- [CVE-2026-1301](https://insights.sbomify.com/CVE-2026-1301/): Out-of-bounds Write in o6 Automation GmbH Open62541 (medium 6.8)
- [CVE-2026-13009](https://insights.sbomify.com/CVE-2026-13009/): AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter (medium 6.5)
- [CVE-2026-13007](https://insights.sbomify.com/CVE-2026-13007/): Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure (high 8.5)
- [CVE-2026-13006](https://insights.sbomify.com/CVE-2026-13006/): Incomplete protection against CVE-2025-11226 (high 7.0)
- [CVE-2026-13005](https://insights.sbomify.com/CVE-2026-13005/): MxChat <= 3.2.10 - Authenticated (Admin+) Stored Cross-Site Scripting via 'intro_message' Setting (medium 4.4)
- [CVE-2026-13002](https://insights.sbomify.com/CVE-2026-13002/): Dnsmasq: infinite loop dos in dnssec nsec/nsec3 type bitmap parsing (medium 4.4)
- [CVE-2026-13001](https://insights.sbomify.com/CVE-2026-13001/): Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter (critical 9.8)
- [CVE-2026-1300](https://insights.sbomify.com/CVE-2026-1300/): Responsive Header Plugin <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters (medium 4.4)
- [CVE-2026-12999](https://insights.sbomify.com/CVE-2026-12999/): Infineon Airoc Wi-Fi driver leaks TX buffers on send failure, leading to permanent pool exhaustion (medium 5.3)
- [CVE-2026-12998](https://insights.sbomify.com/CVE-2026-12998/): Missing authorization in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (medium 5.3)
- [CVE-2026-12997](https://insights.sbomify.com/CVE-2026-12997/): Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter (high 7.5)
- [CVE-2026-12996](https://insights.sbomify.com/CVE-2026-12996/): Use after free in OpenVPN (medium 6.0)
- [CVE-2026-12995](https://insights.sbomify.com/CVE-2026-12995/): Missing authorization in Custom Field Template (medium 4.3)
- [CVE-2026-12994](https://insights.sbomify.com/CVE-2026-12994/): Missing authorization in WCFM – Frontend Manager for WooCommerce (medium 5.3)
- [CVE-2026-12993](https://insights.sbomify.com/CVE-2026-12993/): Apicurio/apicurio-registry: apicurio-registry: xml entity-expansion denial of service via internal dtd subset (medium 6.5)
- [CVE-2026-12992](https://insights.sbomify.com/CVE-2026-12992/): Apicurio/apicurio-registry: apicurio-registry: ssrf via wsdl4j import dereference in wsdl full validation (high 7.4)
- [CVE-2026-12991](https://insights.sbomify.com/CVE-2026-12991/): Multiple vulnerabilities in Ghost Robotics' Vision 60 (high 8.7)
- [CVE-2026-12990](https://insights.sbomify.com/CVE-2026-12990/): Multiple vulnerabilities in Ghost Robotics' Vision 60 (high 7.7)
- [CVE-2026-1299](https://insights.sbomify.com/CVE-2026-1299/): email BytesGenerator header injection due to unquoted newlines (medium 6.0)
- [CVE-2026-12989](https://insights.sbomify.com/CVE-2026-12989/): Multiple vulnerabilities in Ghost Robotics' Vision 60 (high 8.7)
- [CVE-2026-12988](https://insights.sbomify.com/CVE-2026-12988/): WP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding (medium 6.4)
- [CVE-2026-12987](https://insights.sbomify.com/CVE-2026-12987/): Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration (high 7.5)
- [CVE-2026-12986](https://insights.sbomify.com/CVE-2026-12986/): Payara Server Full has a Cross-Site Request Forgery vulnerability (high 7.3)
- [CVE-2026-12985](https://insights.sbomify.com/CVE-2026-12985/): Mattermost DCR redirect URI allowlist bypass via improper URL component validation (medium 6.8)
- [CVE-2026-12984](https://insights.sbomify.com/CVE-2026-12984/): Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601 (high 8.2)
- [CVE-2026-12983](https://insights.sbomify.com/CVE-2026-12983/): Dinatur <= 1.18 - Unauthenticated SQL Injection via Column Name Injection (high 8.6)
- [CVE-2026-12982](https://insights.sbomify.com/CVE-2026-12982/): Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery (medium 6.1)
- [CVE-2026-12981](https://insights.sbomify.com/CVE-2026-12981/): CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset (high 7.5)
- [CVE-2026-12980](https://insights.sbomify.com/CVE-2026-12980/): Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable (medium 6.8)
- [CVE-2026-1298](https://insights.sbomify.com/CVE-2026-1298/): Easy Replace Image <= 3.5.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Attachment Replacement (medium 4.3)
- [CVE-2026-12979](https://insights.sbomify.com/CVE-2026-12979/): FunnelKit < 3.15.0.6 - Admin+ Arbitrary File Deletion via Path Traversal in Template Importer (medium 5.5)
- [CVE-2026-12978](https://insights.sbomify.com/CVE-2026-12978/): FunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin Form (high 7.1)
- [CVE-2026-12976](https://insights.sbomify.com/CVE-2026-12976/): LearnPress < 4.4.4 - Subscriber+ Sensitive Information Exposure via AI Assistant (medium 6.5)
- [CVE-2026-12975](https://insights.sbomify.com/CVE-2026-12975/): XML external entity in Red Hat build of Apicurio Registry 3.3.1 (high 8.5)
- [CVE-2026-12974](https://insights.sbomify.com/CVE-2026-12974/): Security Policy Bypass in Forcepoint Security Engine (NGFW) (high 7.9)
- [CVE-2026-12973](https://insights.sbomify.com/CVE-2026-12973/): PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification (medium 6.5)
- [CVE-2026-12972](https://insights.sbomify.com/CVE-2026-12972/): PayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Payment Metadata Tampering (medium 5.3)
- [CVE-2026-12971](https://insights.sbomify.com/CVE-2026-12971/): LearnPress < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature (low 2.2)
- [CVE-2026-12970](https://insights.sbomify.com/CVE-2026-12970/): LearnPress < 4.4.1 - Reflected XSS via c_search (high 7.1)
- [CVE-2026-12969](https://insights.sbomify.com/CVE-2026-12969/): Dnsmasq: dnsmasq: out-of-bounds read in find_soa() due to missing extrabytes validation (medium 5.3)
- [CVE-2026-12968](https://insights.sbomify.com/CVE-2026-12968/): Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload (high 8.8)
- [CVE-2026-12966](https://insights.sbomify.com/CVE-2026-12966/): Direct Payments for WooCommerce < 2.5.3 - Unauthenticated Cross-Customer Order Tampering via digages AJAX Actions (medium 5.3)
- [CVE-2026-12965](https://insights.sbomify.com/CVE-2026-12965/): Super Store Finder < 7.11 - Unauthenticated SQL Injection via ssf_tracking (critical 9.1)
- [CVE-2026-12962](https://insights.sbomify.com/CVE-2026-12962/): Misconfiguration in Armoury Crate (medium 5.3)
- [CVE-2026-12960](https://insights.sbomify.com/CVE-2026-12960/): Other in Router app (medium 6.0)
- [CVE-2026-1296](https://insights.sbomify.com/CVE-2026-1296/): Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter (medium 6.1)
- [CVE-2026-12958](https://insights.sbomify.com/CVE-2026-12958/): Arbitrary file write in Language Servers for AWS (high 8.5)
- [CVE-2026-12957](https://insights.sbomify.com/CVE-2026-12957/): Arbitrary Code Execution in Language Servers for AWS (high 8.5)
- [CVE-2026-12956](https://insights.sbomify.com/CVE-2026-12956/): Missing authorization in Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce (medium 5.3)
- [CVE-2026-12955](https://insights.sbomify.com/CVE-2026-12955/): Missing authorization in Cookie Banner for GDPR / CCPA – WPLP Cookie Consent (medium 4.3)
- [CVE-2026-12954](https://insights.sbomify.com/CVE-2026-12954/): Missing authorization in Mapster WP Maps (high 8.8)
- [CVE-2026-12951](https://insights.sbomify.com/CVE-2026-12951/): MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter (medium 6.5)
- [CVE-2026-1295](https://insights.sbomify.com/CVE-2026-1295/): Buy Now Plus <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-12949](https://insights.sbomify.com/CVE-2026-12949/): Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter (critical 9.8)
- [CVE-2026-12948](https://insights.sbomify.com/CVE-2026-12948/): Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2026-12947](https://insights.sbomify.com/CVE-2026-12947/): IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes (high 7.5)
- [CVE-2026-12946](https://insights.sbomify.com/CVE-2026-12946/): Remote Code Execution in CUGA Component CodeAgent (critical 9.9)
- [CVE-2026-12945](https://insights.sbomify.com/CVE-2026-12945/): Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints (high 7.1)
- [CVE-2026-12944](https://insights.sbomify.com/CVE-2026-12944/): Incomplete Security Scanner Blocklist Enables Network-Based Code Execution (critical 9.6)
- [CVE-2026-12943](https://insights.sbomify.com/CVE-2026-12943/): This Power Hardware Management Console update is being released to address (critical 9.8)
- [CVE-2026-12942](https://insights.sbomify.com/CVE-2026-12942/): Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints (high 7.5)
- [CVE-2026-12941](https://insights.sbomify.com/CVE-2026-12941/): MultiVendorX <= 5.0.9 - Authenticated (Store Owner+) SQL Injection via 'order_by' Parameter (medium 6.5)
- [CVE-2026-12940](https://insights.sbomify.com/CVE-2026-12940/): Command injection in Langflow OSS (critical 9.8)
- [CVE-2026-1294](https://insights.sbomify.com/CVE-2026-1294/): All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint (high 7.2)
- [CVE-2026-12939](https://insights.sbomify.com/CVE-2026-12939/): Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute (medium 6.4)
- [CVE-2026-12938](https://insights.sbomify.com/CVE-2026-12938/): Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute (medium 6.4)
- [CVE-2026-12937](https://insights.sbomify.com/CVE-2026-12937/): Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter (high 7.5)
- [CVE-2026-12936](https://insights.sbomify.com/CVE-2026-12936/): Recurio <= 1.1.3 - Authenticated (Shop Manager+) SQL Injection via 'data' Parameter (medium 4.9)
- [CVE-2026-12935](https://insights.sbomify.com/CVE-2026-12935/): Unauthenticated Remote Code Execution in TP-Link TL-WR940N RTSP Conntrack Feature (high 8.7)
- [CVE-2026-12932](https://insights.sbomify.com/CVE-2026-12932/): Denial of service in OpenVPN (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/880/