# Vulnerabilities published in 2026


- [CVE-2026-12536](https://insights.sbomify.com/CVE-2026-12536/): Avada Builder <= 3.15.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Title (medium 6.4)
- [CVE-2026-12535](https://insights.sbomify.com/CVE-2026-12535/): Formatter Field - Critical - PHP object injection - SA-CONTRIB-2026-048 (critical 9.8)
- [CVE-2026-12530](https://insights.sbomify.com/CVE-2026-12530/): Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages() (high 8.4)
- [CVE-2026-1253](https://insights.sbomify.com/CVE-2026-1253/): Missing authorization in Group Chat & Video Chat by AtomChat (medium 4.3)
- [CVE-2026-12529](https://insights.sbomify.com/CVE-2026-12529/): Missing authorization in CET Automated Grading System with AI Predictive Analytics (medium 6.9)
- [CVE-2026-12528](https://insights.sbomify.com/CVE-2026-12528/): 389-ds-base: 389-ds-base: heap-buffer-overflows in __aclp__normalize_acltxt() (medium 5.4)
- [CVE-2026-12527](https://insights.sbomify.com/CVE-2026-12527/): Auth bypass in V380 IP Camera / AppFHE1 V1.0.6.0 (medium 6.0)
- [CVE-2026-12526](https://insights.sbomify.com/CVE-2026-12526/): Missing authorization in Advanced Custom Fields: Extended (high 8.1)
- [CVE-2026-12525](https://insights.sbomify.com/CVE-2026-12525/): Redux Framework < 4.5.13 - Subscriber+ Privilege Escalation to Administrator (high 8.8)
- [CVE-2026-12523](https://insights.sbomify.com/CVE-2026-12523/): Resource exhaustion in quiche HTTP/3 and QPACK layers (high 7.5)
- [CVE-2026-12522](https://insights.sbomify.com/CVE-2026-12522/): Stack buffer overflow in Zephyr hl7800 modem driver parsing network-supplied +CGCONTRDP address fields (high 8.8)
- [CVE-2026-12520](https://insights.sbomify.com/CVE-2026-12520/): Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers (medium 6.4)
- [CVE-2026-1252](https://insights.sbomify.com/CVE-2026-1252/): Events Listing Widget <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field (medium 6.4)
- [CVE-2026-12519](https://insights.sbomify.com/CVE-2026-12519/): Out-of-bounds stack read and write in Zephyr WNC-M14A2A modem socket-notify parsing (medium 5.0)
- [CVE-2026-12518](https://insights.sbomify.com/CVE-2026-12518/): Local privilege escalation in the Logi Options+ updater service on Windows (high 8.5)
- [CVE-2026-12517](https://insights.sbomify.com/CVE-2026-12517/): Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Site Info Endpoint (medium 5.3)
- [CVE-2026-12516](https://insights.sbomify.com/CVE-2026-12516/): Fediverse Embeds < 1.5.8 - Unauthenticated SSRF via Media Proxy (medium 5.3)
- [CVE-2026-12515](https://insights.sbomify.com/CVE-2026-12515/): Katello: missing repository authorization in content_uploads exposes cross-product content existence (medium 4.3)
- [CVE-2026-12514](https://insights.sbomify.com/CVE-2026-12514/): Shared Files < 1.7.70 - Unauthenticated Limited File Upload (medium 5.3)
- [CVE-2026-12513](https://insights.sbomify.com/CVE-2026-12513/): Shared Files < 1.7.68 - Unauthenticated Arbitrary File Deletion via Path Traversal (medium 6.8)
- [CVE-2026-12512](https://insights.sbomify.com/CVE-2026-12512/): Quotes Llama < 3.1.6 - Unauthenticated SQL Injection via sc Parameter (high 8.6)
- [CVE-2026-12511](https://insights.sbomify.com/CVE-2026-12511/): AI Engine < 3.5.5 - Editor+ Arbitrary File Write via Path Traversal (high 8.1)
- [CVE-2026-12510](https://insights.sbomify.com/CVE-2026-12510/): AI Engine < 3.5.5 - Subscriber+Chatbot Discussion Disclosure and Takeover via IDOR (medium 5.9)
- [CVE-2026-1251](https://insights.sbomify.com/CVE-2026-1251/): Missing authorization in SupportCandy – Helpdesk & Customer Support Ticket System (medium 5.4)
- [CVE-2026-12505](https://insights.sbomify.com/CVE-2026-12505/): Cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall (high 7.8)
- [CVE-2026-12504](https://insights.sbomify.com/CVE-2026-12504/): Loytec LINX firmware: Improper Authentication in PAM configuration (high 8.4)
- [CVE-2026-12503](https://insights.sbomify.com/CVE-2026-12503/): Loytec LINX firmware: Improper Link Resolution in /usr/bin/larm_starter (critical 9.2)
- [CVE-2026-12502](https://insights.sbomify.com/CVE-2026-12502/): Loytec LINX firmware: Improper Privilege Management in /usr/bin/ltsudo (high 8.4)
- [CVE-2026-12501](https://insights.sbomify.com/CVE-2026-12501/): WP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification (medium 5.3)
- [CVE-2026-12500](https://insights.sbomify.com/CVE-2026-12500/): WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update (high 7.5)
- [CVE-2026-1250](https://insights.sbomify.com/CVE-2026-1250/): Court Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2026-12497](https://insights.sbomify.com/CVE-2026-12497/): ProfilePress < 4.16.18 - Unauthenticated Privilege Escalation via Registration Role Selection (high 7.5)
- [CVE-2026-12496](https://insights.sbomify.com/CVE-2026-12496/): Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server (high 8.7)
- [CVE-2026-12495](https://insights.sbomify.com/CVE-2026-12495/): Stack-Based Buffer Overflow in the Mercusys MB115-4G (medium 5.3)
- [CVE-2026-12493](https://insights.sbomify.com/CVE-2026-12493/): Clover Payment Gateway by Zaytech for WooCommerce < 1.3.6 - Unauthenticated Payment Bypass via check_order (high 7.5)
- [CVE-2026-12492](https://insights.sbomify.com/CVE-2026-12492/): Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user (critical 9.8)
- [CVE-2026-12491](https://insights.sbomify.com/CVE-2026-12491/): vLLM: image EXIF Rotation & PNG tRNS Transparency Not Normalized, Causing Mismatch Between Model Input and Expectations (medium 4.8)
- [CVE-2026-12490](https://insights.sbomify.com/CVE-2026-12490/): Bypass of client certificate verification with transfer over TLS (high 8.2)
- [CVE-2026-1249](https://insights.sbomify.com/CVE-2026-1249/): Server-side request forgery in MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar (medium 5.0)
- [CVE-2026-12489](https://insights.sbomify.com/CVE-2026-12489/): Privilege escalation in EX3501-T0 firmware (medium 6.5)
- [CVE-2026-12488](https://insights.sbomify.com/CVE-2026-12488/): GeoVision GV-VMS V20 GV-Cloud memory corruption vulnerability (medium 6.2)
- [CVE-2026-12486](https://insights.sbomify.com/CVE-2026-12486/): GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability (critical 9.1)
- [CVE-2026-12485](https://insights.sbomify.com/CVE-2026-12485/): GeoVision GV-I/O Box DVRSearch buffer overflow vulnerabilities in CMD_IP_SET command (critical 10.0)
- [CVE-2026-12484](https://insights.sbomify.com/CVE-2026-12484/): Unsafe Deserialization in keras.layers.TorchModuleWrapper.from_config (high 7.8)
- [CVE-2026-12483](https://insights.sbomify.com/CVE-2026-12483/): LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler (high 7.5)
- [CVE-2026-12482](https://insights.sbomify.com/CVE-2026-12482/): Path Traversal via Symlink Name Validation Bypass in keras-team/keras (low 3.1)
- [CVE-2026-12481](https://insights.sbomify.com/CVE-2026-12481/): Deserialization of Untrusted Data in keras-team/keras (high 8.8)
- [CVE-2026-12480](https://insights.sbomify.com/CVE-2026-12480/): Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras (medium 5.5)
- [CVE-2026-1248](https://insights.sbomify.com/CVE-2026-1248/): IBM Business Automation Workflow information leak (medium 4.3)
- [CVE-2026-12479](https://insights.sbomify.com/CVE-2026-12479/): Path Traversal in keras-team/keras (medium 6.1)
- [CVE-2026-12478](https://insights.sbomify.com/CVE-2026-12478/): Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path) (medium 4.8)
- [CVE-2026-12477](https://insights.sbomify.com/CVE-2026-12477/): Gravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter (medium 4.4)
- [CVE-2026-12476](https://insights.sbomify.com/CVE-2026-12476/): Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter (high 7.2)
- [CVE-2026-12473](https://insights.sbomify.com/CVE-2026-12473/): OHIF Viewers DICOM Server-Side request forgery (high 8.3)
- [CVE-2026-12472](https://insights.sbomify.com/CVE-2026-12472/): Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer (medium 5.3)
- [CVE-2026-12471](https://insights.sbomify.com/CVE-2026-12471/): Spexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation (medium 4.3)
- [CVE-2026-12470](https://insights.sbomify.com/CVE-2026-12470/): Privilege escalation in CMP – Coming Soon & Maintenance Plugin by NiteoThemes (high 7.2)
- [CVE-2026-1247](https://insights.sbomify.com/CVE-2026-1247/): Survey <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (medium 4.4)
- [CVE-2026-12469](https://insights.sbomify.com/CVE-2026-12469/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-12468](https://insights.sbomify.com/CVE-2026-12468/): Race condition in Chrome (high 8.3)
- [CVE-2026-12467](https://insights.sbomify.com/CVE-2026-12467/): Use after free in Chrome (high 8.3)
- [CVE-2026-12466](https://insights.sbomify.com/CVE-2026-12466/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-12465](https://insights.sbomify.com/CVE-2026-12465/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-12464](https://insights.sbomify.com/CVE-2026-12464/): Use after free in Chrome (high 8.3)
- [CVE-2026-12463](https://insights.sbomify.com/CVE-2026-12463/): Cross-site scripting in Chrome (medium 4.7)
- [CVE-2026-12462](https://insights.sbomify.com/CVE-2026-12462/): Use after free in Chrome (high 7.5)
- [CVE-2026-12461](https://insights.sbomify.com/CVE-2026-12461/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-12460](https://insights.sbomify.com/CVE-2026-12460/): Security feature bypass in Chrome (medium 4.2)
- [CVE-2026-1246](https://insights.sbomify.com/CVE-2026-1246/): ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter (medium 4.9)
- [CVE-2026-12459](https://insights.sbomify.com/CVE-2026-12459/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2026-12458](https://insights.sbomify.com/CVE-2026-12458/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-12457](https://insights.sbomify.com/CVE-2026-12457/): Security feature bypass in Chrome (medium 4.2)
- [CVE-2026-12456](https://insights.sbomify.com/CVE-2026-12456/): Security feature bypass in Chrome (medium 4.2)
- [CVE-2026-12455](https://insights.sbomify.com/CVE-2026-12455/): Use after free in Chrome (high 7.5)
- [CVE-2026-12454](https://insights.sbomify.com/CVE-2026-12454/): Race condition in Chrome (high 8.3)
- [CVE-2026-12453](https://insights.sbomify.com/CVE-2026-12453/): Security feature bypass in Chrome (medium 4.2)
- [CVE-2026-12452](https://insights.sbomify.com/CVE-2026-12452/): Use after free in Chrome (high 8.8)
- [CVE-2026-12451](https://insights.sbomify.com/CVE-2026-12451/): Use after free in Chrome (high 8.3)
- [CVE-2026-12450](https://insights.sbomify.com/CVE-2026-12450/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-1245](https://insights.sbomify.com/CVE-2026-1245/): CVE-2026-1245 (medium 6.5)
- [CVE-2026-12449](https://insights.sbomify.com/CVE-2026-12449/): Use after free in Chrome (high 7.8)
- [CVE-2026-12448](https://insights.sbomify.com/CVE-2026-12448/): Privilege escalation in Chrome (high 8.8)
- [CVE-2026-12447](https://insights.sbomify.com/CVE-2026-12447/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-12446](https://insights.sbomify.com/CVE-2026-12446/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-12445](https://insights.sbomify.com/CVE-2026-12445/): Use after free in Chrome (high 7.5)
- [CVE-2026-12444](https://insights.sbomify.com/CVE-2026-12444/): Memory corruption in Chrome (medium 5.5)
- [CVE-2026-12443](https://insights.sbomify.com/CVE-2026-12443/): Use after free in Chrome (high 8.8)
- [CVE-2026-12442](https://insights.sbomify.com/CVE-2026-12442/): Use after free in Chrome (high 8.8)
- [CVE-2026-12441](https://insights.sbomify.com/CVE-2026-12441/): Use after free in Chrome (high 8.8)
- [CVE-2026-12440](https://insights.sbomify.com/CVE-2026-12440/): Use after free in Chrome (critical 9.6)
- [CVE-2026-1244](https://insights.sbomify.com/CVE-2026-1244/): Forms Bridge <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute (medium 6.4)
- [CVE-2026-12439](https://insights.sbomify.com/CVE-2026-12439/): Use after free in Chrome (high 8.8)
- [CVE-2026-12438](https://insights.sbomify.com/CVE-2026-12438/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-12437](https://insights.sbomify.com/CVE-2026-12437/): Use after free in Chrome (high 8.3)
- [CVE-2026-12436](https://insights.sbomify.com/CVE-2026-12436/): Improperly Controlled Modification of Dynamically-Determined Object Attributes in GitLab (high 8.4)
- [CVE-2026-12435](https://insights.sbomify.com/CVE-2026-12435/): Missing authorization in Motors – Car Dealership & Classified Listings Plugin (medium 4.3)
- [CVE-2026-12434](https://insights.sbomify.com/CVE-2026-12434/): Missing authorization in List category posts (medium 4.3)
- [CVE-2026-12433](https://insights.sbomify.com/CVE-2026-12433/): Missing authorization in Hydra Booking — Appointment Scheduling & Booking Calendar (medium 4.3)
- [CVE-2026-12432](https://insights.sbomify.com/CVE-2026-12432/): Missing authorization in Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions (medium 5.3)
- [CVE-2026-12430](https://insights.sbomify.com/CVE-2026-12430/): Blocksy Companion <= 2.1.45 - Authenticated (Editor+) Stored Cross-Site Scripting via 'product_description' Parameter (medium 4.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/884/