# Vulnerabilities published in 2026


- [CVE-2026-12202](https://insights.sbomify.com/CVE-2026-12202/): Intelliants Subrion CMS Blocks Endpoint cross site scripting (medium 4.8)
- [CVE-2026-12201](https://insights.sbomify.com/CVE-2026-12201/): IObit Malware Fighter DLL permission (medium 4.8)
- [CVE-2026-12200](https://insights.sbomify.com/CVE-2026-12200/): Ritlabs TinyWeb Server Header libeay32.dll.html stack-based overflow (medium 6.9)
- [CVE-2026-1220](https://insights.sbomify.com/CVE-2026-1220/): Race condition in Chrome (high 7.5)
- [CVE-2026-12199](https://insights.sbomify.com/CVE-2026-12199/): Unauthenticated Denial of Service in nltk.app.wordnet_app (high 7.5)
- [CVE-2026-12198](https://insights.sbomify.com/CVE-2026-12198/): Microweber API Endpoint thumbnail_img userfiles_path path traversal (medium 6.9)
- [CVE-2026-12197](https://insights.sbomify.com/CVE-2026-12197/): Ruijie EG105G-P JSON-RPC Diagnose Endpoint diagnose nslookup command injection (high 8.6)
- [CVE-2026-12196](https://insights.sbomify.com/CVE-2026-12196/): HestiaCP Admin Takeover (high 8.3)
- [CVE-2026-12195](https://insights.sbomify.com/CVE-2026-12195/): Command injection in vesta (high 8.5)
- [CVE-2026-12194](https://insights.sbomify.com/CVE-2026-12194/): PHPIPAM Authenticated LFI (low 2.3)
- [CVE-2026-12193](https://insights.sbomify.com/CVE-2026-12193/): VS Revo RevoUninstaller IOCTL RevoDetector.sys IOCtl_Handler heap-based overflow (high 8.5)
- [CVE-2026-12192](https://insights.sbomify.com/CVE-2026-12192/): GALAYOU Y4 Web Server buffer overflow (high 8.7)
- [CVE-2026-12191](https://insights.sbomify.com/CVE-2026-12191/): Comma AI Openpilot Pickle modeld.py pickle.loads deserialization (high 8.5)
- [CVE-2026-12190](https://insights.sbomify.com/CVE-2026-12190/): Genspark AI Workspace App ai.mainfunc.genspark improper authorization in handler for custom url scheme (medium 4.8)
- [CVE-2026-1219](https://insights.sbomify.com/CVE-2026-1219/): Missing authorization in MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar (medium 5.3)
- [CVE-2026-12189](https://insights.sbomify.com/CVE-2026-12189/): Moovit Bus & Public Transit App com.tranzmate improper authorization in handler for custom url scheme (medium 4.8)
- [CVE-2026-12188](https://insights.sbomify.com/CVE-2026-12188/): Grit42 Grit GritEntityController grit_entity_controller.rb sql injection (medium 5.3)
- [CVE-2026-12187](https://insights.sbomify.com/CVE-2026-12187/): GL.iNet GL-MT3000 Online Firmware Upgrade one_click_upgrade command injection (high 8.7)
- [CVE-2026-12186](https://insights.sbomify.com/CVE-2026-12186/): GL.iNet GL-MT3000 Tor Proxy Service Configuration tor replace_country command injection (high 8.7)
- [CVE-2026-12185](https://insights.sbomify.com/CVE-2026-12185/): BKS/UBER keystore allocates from untrusted lengths before integrity check (high 7.1)
- [CVE-2026-12183](https://insights.sbomify.com/CVE-2026-12183/): Auth bypass in BUK TS-G Gas Station Automation System (critical 9.3)
- [CVE-2026-1218](https://insights.sbomify.com/CVE-2026-1218/): XML external entity in Zhiyou ERP (medium 5.3)
- [CVE-2026-12176](https://insights.sbomify.com/CVE-2026-12176/): SourceCodester CET Automated Grading System with AI Predictive Analytics index.php cross site scripting (medium 5.3)
- [CVE-2026-12175](https://insights.sbomify.com/CVE-2026-12175/): CodeAstro Student Attendance Management System createStudents.php sql injection (medium 5.1)
- [CVE-2026-12174](https://insights.sbomify.com/CVE-2026-12174/): D-Link DCS-935L HTTP rhea snprintf format string (high 8.7)
- [CVE-2026-12171](https://insights.sbomify.com/CVE-2026-12171/): Code injection in auto-changelog (high 8.4)
- [CVE-2026-12170](https://insights.sbomify.com/CVE-2026-12170/): AcyMailing <= 10.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alignment' Attribute (medium 6.4)
- [CVE-2026-1217](https://insights.sbomify.com/CVE-2026-1217/): Yoast Duplicate Post has an Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite (medium 5.4)
- [CVE-2026-12168](https://insights.sbomify.com/CVE-2026-12168/): CVE-2026-12168 (high 7.8)
- [CVE-2026-12167](https://insights.sbomify.com/CVE-2026-12167/): CVE-2026-12167 (high 7.8)
- [CVE-2026-12166](https://insights.sbomify.com/CVE-2026-12166/): CVE-2026-12166 (medium 5.5)
- [CVE-2026-12165](https://insights.sbomify.com/CVE-2026-12165/): Contest Gallery <= 30.0.2 - Authenticated (Author+) Privilege Escalation via 'RegistryUserRole' Parameter (high 8.8)
- [CVE-2026-12164](https://insights.sbomify.com/CVE-2026-12164/): Privilege Escalation in Fortra File Integrity Monitoring (FIM) (medium 4.4)
- [CVE-2026-12163](https://insights.sbomify.com/CVE-2026-12163/): Stored XSS in Fortra File Integrity Monitoring (FIM) (medium 5.5)
- [CVE-2026-12162](https://insights.sbomify.com/CVE-2026-12162/): Information disclosure in Remote Desktop Manager (medium 5.5)
- [CVE-2026-12161](https://insights.sbomify.com/CVE-2026-12161/): Command injection in Remote Desktop Manager (high 8.8)
- [CVE-2026-1216](https://insights.sbomify.com/CVE-2026-1216/): RSS Aggregator <= 5.0.10 - Reflected Cross-Site Scripting via 'template' Parameter (high 7.2)
- [CVE-2026-12158](https://insights.sbomify.com/CVE-2026-12158/): Cross-site request forgery in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (high 8.8)
- [CVE-2026-12157](https://insights.sbomify.com/CVE-2026-12157/): BetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute (medium 6.4)
- [CVE-2026-12155](https://insights.sbomify.com/CVE-2026-12155/): IBM MQ Deserialization of Untrusted Data (medium 6.5)
- [CVE-2026-12154](https://insights.sbomify.com/CVE-2026-12154/): Cross-site scripting in Reviews Widgets for Google, TripAdvisor, Yelp & Recommendations (medium 6.4)
- [CVE-2026-12153](https://insights.sbomify.com/CVE-2026-12153/): Missing authorization in WP Learn Manager (critical 9.8)
- [CVE-2026-12151](https://insights.sbomify.com/CVE-2026-12151/): undici WebSocket client vulnerable to denial of service via fragment count bypass (high 7.5)
- [CVE-2026-12150](https://insights.sbomify.com/CVE-2026-12150/): IBM MQ queue manager is vulnerable to denial of service (high 7.0)
- [CVE-2026-1215](https://insights.sbomify.com/CVE-2026-1215/): MMA Call Tracking <= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Update (medium 4.3)
- [CVE-2026-12148](https://insights.sbomify.com/CVE-2026-12148/): IBM MQ Deserialization of Untrusted Data (high 7.5)
- [CVE-2026-12144](https://insights.sbomify.com/CVE-2026-12144/): Wholesale for WooCommerce <= 2.0.5 - Authenticated (Author+) Privilege Escalation via 'user_role_set' Parameter (high 8.8)
- [CVE-2026-12143](https://insights.sbomify.com/CVE-2026-12143/): form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) (high 8.7)
- [CVE-2026-12142](https://insights.sbomify.com/CVE-2026-12142/): NEX-Forms <= 9.2.2 - Unauthenticated Stored Cross-Site Scripting via '_name[]' Array Parameter (high 7.2)
- [CVE-2026-12141](https://insights.sbomify.com/CVE-2026-12141/): Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets (medium 4.9)
- [CVE-2026-12139](https://insights.sbomify.com/CVE-2026-12139/): Tanium addressed an information disclosure vulnerability in Connect. (medium 4.4)
- [CVE-2026-12137](https://insights.sbomify.com/CVE-2026-12137/): SysBasics Customize My Account for WooCommerce <= 4.3.6 - Reflected Cross-Site Scripting via 'tab' Parameter (medium 6.1)
- [CVE-2026-12136](https://insights.sbomify.com/CVE-2026-12136/): Cross-site scripting in SysBasics Customize My Account for WooCommerce – Dashboard, Endpoints, Avatar & Menu Manager (medium 6.4)
- [CVE-2026-12135](https://insights.sbomify.com/CVE-2026-12135/): Cross-site scripting in FV Flowplayer Video Player (medium 6.4)
- [CVE-2026-12134](https://insights.sbomify.com/CVE-2026-12134/): Missing authorization in JoomSport – for Sports: Team & League, Football, Hockey & more (medium 4.3)
- [CVE-2026-12133](https://insights.sbomify.com/CVE-2026-12133/): Missing authorization in JoomSport – for Sports: Team & League, Football, Hockey & more (medium 4.3)
- [CVE-2026-12131](https://insights.sbomify.com/CVE-2026-12131/): CodeAstro Human Resource Management System Payroll Invoice Payroll.php sql injection (medium 5.3)
- [CVE-2026-12130](https://insights.sbomify.com/CVE-2026-12130/): CodeAstro Human Resource Management System Projects Management Add_Projects cross site scripting (medium 5.1)
- [CVE-2026-1213](https://insights.sbomify.com/CVE-2026-1213/): Askbot 0.12.2 - Insecure Direct Object Reference (IDOR) (medium 5.3)
- [CVE-2026-12129](https://insights.sbomify.com/CVE-2026-12129/): CodeAstro Human Resource Management System Dashboard add_tod cross site scripting (medium 5.1)
- [CVE-2026-12128](https://insights.sbomify.com/CVE-2026-12128/): Business logic in Pinpoint Booking System – Version 2 (medium 5.3)
- [CVE-2026-12127](https://insights.sbomify.com/CVE-2026-12127/): Other in WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More (medium 5.3)
- [CVE-2026-12126](https://insights.sbomify.com/CVE-2026-12126/): WCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title' (medium 6.4)
- [CVE-2026-12124](https://insights.sbomify.com/CVE-2026-12124/): PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter (medium 5.3)
- [CVE-2026-12123](https://insights.sbomify.com/CVE-2026-12123/): All-in-One Video Gallery <= 4.8.5 - Authenticated (Subscriber+) Server-Side Request Forgery via 'vdl' Parameter (medium 6.4)
- [CVE-2026-12122](https://insights.sbomify.com/CVE-2026-12122/): Missing authorization in Kirki – Freeform Page Builder, Website Builder & Customizer (medium 5.3)
- [CVE-2026-12120](https://insights.sbomify.com/CVE-2026-12120/): FireBox Popups <= 3.1.7 - Unauthenticated Sensitive Information Exposure in 'form_id' Parameter (medium 5.3)
- [CVE-2026-12119](https://insights.sbomify.com/CVE-2026-12119/): Missing authorization in Simple File List (medium 6.5)
- [CVE-2026-12118](https://insights.sbomify.com/CVE-2026-12118/): Deserialization in webMethods Integration (on prem) (critical 9.8)
- [CVE-2026-12117](https://insights.sbomify.com/CVE-2026-12117/): Missing authorization in Devolutions Server (medium 4.3)
- [CVE-2026-12116](https://insights.sbomify.com/CVE-2026-12116/): CVE-2026-12116 (critical 9.8)
- [CVE-2026-12115](https://insights.sbomify.com/CVE-2026-12115/): Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import (medium 6.6)
- [CVE-2026-12114](https://insights.sbomify.com/CVE-2026-12114/): Team Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter (medium 4.4)
- [CVE-2026-12113](https://insights.sbomify.com/CVE-2026-12113/): Missing authorization in Appointment Booking Calendar (medium 4.3)
- [CVE-2026-12112](https://insights.sbomify.com/CVE-2026-12112/): Foreman-mcp-server: mcp server: active session hijacking via insecure session state reuse (high 7.8)
- [CVE-2026-12111](https://insights.sbomify.com/CVE-2026-12111/): Appointment Booking Calendar <= 1.4.01 - Authenticated (Contributor+) Sensitive Information Exposure via 'id' Parameter (medium 4.3)
- [CVE-2026-12110](https://insights.sbomify.com/CVE-2026-12110/): Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter (medium 6.5)
- [CVE-2026-12109](https://insights.sbomify.com/CVE-2026-12109/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 5.5)
- [CVE-2026-12108](https://insights.sbomify.com/CVE-2026-12108/): Highlighting Code Block <= 2.2.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'font_family' Setting (medium 4.4)
- [CVE-2026-12106](https://insights.sbomify.com/CVE-2026-12106/): Server-side request forgery in Auto Upload Images (medium 6.4)
- [CVE-2026-12105](https://insights.sbomify.com/CVE-2026-12105/): Missing authorization in Devolutions Server (medium 6.5)
- [CVE-2026-12104](https://insights.sbomify.com/CVE-2026-12104/): Authenticated OS Command Injection in Bondix (high 8.6)
- [CVE-2026-12103](https://insights.sbomify.com/CVE-2026-12103/): Missing authorization in Wallet for WooCommerce (medium 4.3)
- [CVE-2026-12102](https://insights.sbomify.com/CVE-2026-12102/): Missing authorization in UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP (low 2.7)
- [CVE-2026-12101](https://insights.sbomify.com/CVE-2026-12101/): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (high 8.1)
- [CVE-2026-12100](https://insights.sbomify.com/CVE-2026-12100/): URL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter (high 7.2)
- [CVE-2026-1210](https://insights.sbomify.com/CVE-2026-1210/): Cross-site scripting in Happy Addons for Elementor (medium 6.4)
- [CVE-2026-12098](https://insights.sbomify.com/CVE-2026-12098/): Cross-site scripting in PowerPress Podcasting plugin by Blubrry (medium 6.4)
- [CVE-2026-12097](https://insights.sbomify.com/CVE-2026-12097/): User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification (medium 5.3)
- [CVE-2026-12095](https://insights.sbomify.com/CVE-2026-12095/): Kargo Takip <= 1.2 - Unauthenticated Server-Side Request Forgery via 'api_url' Parameter (high 7.2)
- [CVE-2026-12094](https://insights.sbomify.com/CVE-2026-12094/): Missing authorization in Advanced Contact Form 7 – Compact DB (medium 5.3)
- [CVE-2026-12093](https://insights.sbomify.com/CVE-2026-12093/): Missing authorization in Simple Membership (medium 5.3)
- [CVE-2026-12091](https://insights.sbomify.com/CVE-2026-12091/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (low 3.7)
- [CVE-2026-12090](https://insights.sbomify.com/CVE-2026-12090/): Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'wppm_proj_filter' Parameter (medium 6.5)
- [CVE-2026-12089](https://insights.sbomify.com/CVE-2026-12089/): WS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3.19 - Authenticated (Editor+) Arbitrary File Read (medium 4.9)
- [CVE-2026-12087](https://insights.sbomify.com/CVE-2026-12087/): Socket versions before 2.041 for Perl have an out-of-bounds heap read (critical 9.1)
- [CVE-2026-12086](https://insights.sbomify.com/CVE-2026-12086/): Information disclosure in UCD - IBM DevOps Deploy (medium 6.2)
- [CVE-2026-12085](https://insights.sbomify.com/CVE-2026-12085/): Information disclosure in UCD - IBM DevOps Deploy (medium 6.5)
- [CVE-2026-12084](https://insights.sbomify.com/CVE-2026-12084/): Misconfiguration in UCD - IBM DevOps Deploy (medium 5.4)
- [CVE-2026-12083](https://insights.sbomify.com/CVE-2026-12083/): Admin and Site Enhancements < 8.8.4 - Unauthenticated Administrator-Role Restoration via reset-for Parameter (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/887/