# Vulnerabilities published in 2026


- [CVE-2026-12082](https://insights.sbomify.com/CVE-2026-12082/): Missing authorization in Praison AI SEO (high 7.5)
- [CVE-2026-12081](https://insights.sbomify.com/CVE-2026-12081/): Deserialization in Database for Contact Form 7, WPforms, Elementor forms (medium 5.0)
- [CVE-2026-12080](https://insights.sbomify.com/CVE-2026-12080/): Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys (high 7.3)
- [CVE-2026-1208](https://insights.sbomify.com/CVE-2026-1208/): Friendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-12079](https://insights.sbomify.com/CVE-2026-12079/): Dokan Pro <= 5.0.4 - Authenticated (Subscriber+) SQL Injection via 'orderby' Parameter (medium 6.5)
- [CVE-2026-12077](https://insights.sbomify.com/CVE-2026-12077/): Dokan Pro <= 5.0.4 - Unauthenticated SQL Injection via 'latitude' and 'longitude' Parameters (high 7.5)
- [CVE-2026-12076](https://insights.sbomify.com/CVE-2026-12076/): SQL Injection in Raytha CMS (critical 9.3)
- [CVE-2026-12073](https://insights.sbomify.com/CVE-2026-12073/): Auth bypass in ProfileGrid – User Profiles, Groups and Communities (critical 9.8)
- [CVE-2026-12071](https://insights.sbomify.com/CVE-2026-12071/): TeamDavid: Header Injection leading to Open Redirect via URL-encoded characters (medium 5.3)
- [CVE-2026-12070](https://insights.sbomify.com/CVE-2026-12070/): TeamDavid: Arbitrary File Deletion via form field 'scjob' (high 8.4)
- [CVE-2026-1207](https://insights.sbomify.com/CVE-2026-1207/): Potential SQL injection via raster lookups on PostGIS (medium 5.4)
- [CVE-2026-12068](https://insights.sbomify.com/CVE-2026-12068/): Avira Password Manager credential disclosure via cross-origin autofill in Firefox (high 7.4)
- [CVE-2026-12066](https://insights.sbomify.com/CVE-2026-12066/): PbootCMS Password MemberController.php retrieve password recovery (medium 6.9)
- [CVE-2026-12065](https://insights.sbomify.com/CVE-2026-12065/): Groww Stock, Mutual Fund, Gold App WebView URL improper authorization in handler for custom url scheme (low 1.0)
- [CVE-2026-12064](https://insights.sbomify.com/CVE-2026-12064/): proto-default skips SSH verification (high 7.5)
- [CVE-2026-12060](https://insights.sbomify.com/CVE-2026-12060/): Hepta Platforms｜Heptabase - Exposed Dangerous (medium 6.9)
- [CVE-2026-1206](https://insights.sbomify.com/CVE-2026-1206/): Missing authorization in Elementor Website Builder – more than just a page builder (medium 4.3)
- [CVE-2026-12059](https://insights.sbomify.com/CVE-2026-12059/): Cellopoint｜CelloOS - Improper Access Control (high 8.7)
- [CVE-2026-12058](https://insights.sbomify.com/CVE-2026-12058/): Security feature bypass in PcSuite (medium 5.3)
- [CVE-2026-12057](https://insights.sbomify.com/CVE-2026-12057/): DoS + Remote Code Execution via PDF JavaScript in Foxit AI (high 8.6)
- [CVE-2026-12054](https://insights.sbomify.com/CVE-2026-12054/): Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter (medium 6.1)
- [CVE-2026-12053](https://insights.sbomify.com/CVE-2026-12053/): Insertion of Sensitive Information into Log File in GitLab (high 8.6)
- [CVE-2026-12052](https://insights.sbomify.com/CVE-2026-12052/): Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response (medium 5.2)
- [CVE-2026-12051](https://insights.sbomify.com/CVE-2026-12051/): NULL pointer dereference in USB DFU device_next download handler (handle_download) (medium 4.6)
- [CVE-2026-12050](https://insights.sbomify.com/CVE-2026-12050/): pgAdmin 4: SQL injection in named restore point endpoint (medium 5.3)
- [CVE-2026-12049](https://insights.sbomify.com/CVE-2026-12049/): pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter (medium 5.3)
- [CVE-2026-12048](https://insights.sbomify.com/CVE-2026-12048/): pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser (critical 9.3)
- [CVE-2026-12047](https://insights.sbomify.com/CVE-2026-12047/): pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text (medium 4.8)
- [CVE-2026-12046](https://insights.sbomify.com/CVE-2026-12046/): Deserialization in pgAdmin 4 (critical 9.5)
- [CVE-2026-12045](https://insights.sbomify.com/CVE-2026-12045/): pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution (critical 9.4)
- [CVE-2026-12044](https://insights.sbomify.com/CVE-2026-12044/): pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates (high 8.7)
- [CVE-2026-12043](https://insights.sbomify.com/CVE-2026-12043/): Heap double-free in AWS Common Runtime aws-c-http (high 8.7)
- [CVE-2026-12042](https://insights.sbomify.com/CVE-2026-12042/): WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter (medium 4.4)
- [CVE-2026-12041](https://insights.sbomify.com/CVE-2026-12041/): Cross-site scripting in Chatra Live Chat + ChatBot + Cart Saver (medium 4.4)
- [CVE-2026-12039](https://insights.sbomify.com/CVE-2026-12039/): Docker Sandboxes network egress allowlist bypass via unfiltered DNS resolution (medium 5.7)
- [CVE-2026-12037](https://insights.sbomify.com/CVE-2026-12037/): Server-side request forgery in Asset CleanUp: Page Speed Booster (medium 5.5)
- [CVE-2026-12036](https://insights.sbomify.com/CVE-2026-12036/): Privilege escalation in Vantage (medium 6.9)
- [CVE-2026-12035](https://insights.sbomify.com/CVE-2026-12035/): Use after free in Chrome (high 8.8)
- [CVE-2026-12034](https://insights.sbomify.com/CVE-2026-12034/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-12033](https://insights.sbomify.com/CVE-2026-12033/): Memory corruption in Chrome (medium 5.3)
- [CVE-2026-12032](https://insights.sbomify.com/CVE-2026-12032/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-12031](https://insights.sbomify.com/CVE-2026-12031/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-12030](https://insights.sbomify.com/CVE-2026-12030/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-1203](https://insights.sbomify.com/CVE-2026-1203/): CRMEB JSON Token LoginServices.php remoteRegister improper authentication (medium 6.3)
- [CVE-2026-12029](https://insights.sbomify.com/CVE-2026-12029/): Use after free in Chrome (high 8.3)
- [CVE-2026-12028](https://insights.sbomify.com/CVE-2026-12028/): Use after free in Chrome (high 8.3)
- [CVE-2026-12027](https://insights.sbomify.com/CVE-2026-12027/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-12026](https://insights.sbomify.com/CVE-2026-12026/): Memory corruption in Chrome (medium 5.3)
- [CVE-2026-12025](https://insights.sbomify.com/CVE-2026-12025/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-12024](https://insights.sbomify.com/CVE-2026-12024/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-12023](https://insights.sbomify.com/CVE-2026-12023/): Use after free in Chrome (high 8.3)
- [CVE-2026-12022](https://insights.sbomify.com/CVE-2026-12022/): Race condition in Chrome (high 8.3)
- [CVE-2026-12020](https://insights.sbomify.com/CVE-2026-12020/): Use after free in Chrome (high 8.8)
- [CVE-2026-1202](https://insights.sbomify.com/CVE-2026-1202/): CRMEB LoginController.php appleLogin improper authentication (medium 6.9)
- [CVE-2026-12019](https://insights.sbomify.com/CVE-2026-12019/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-12018](https://insights.sbomify.com/CVE-2026-12018/): Privilege escalation in Chrome (high 8.8)
- [CVE-2026-12017](https://insights.sbomify.com/CVE-2026-12017/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-12016](https://insights.sbomify.com/CVE-2026-12016/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-12015](https://insights.sbomify.com/CVE-2026-12015/): Use after free in Chrome (medium 5.3)
- [CVE-2026-12014](https://insights.sbomify.com/CVE-2026-12014/): Use after free in Chrome (high 8.3)
- [CVE-2026-12012](https://insights.sbomify.com/CVE-2026-12012/): Use after free in Chrome (high 8.1)
- [CVE-2026-12011](https://insights.sbomify.com/CVE-2026-12011/): Use after free in Chrome (high 8.3)
- [CVE-2026-12010](https://insights.sbomify.com/CVE-2026-12010/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-1201](https://insights.sbomify.com/CVE-2026-1201/): Authorization Bypass Through User-Controlled Key in Hubitat Elevation Hubs (critical 9.4)
- [CVE-2026-12009](https://insights.sbomify.com/CVE-2026-12009/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-12008](https://insights.sbomify.com/CVE-2026-12008/): Use after free in Chrome (high 8.3)
- [CVE-2026-12007](https://insights.sbomify.com/CVE-2026-12007/): Use after free in Chrome (high 8.8)
- [CVE-2026-12005](https://insights.sbomify.com/CVE-2026-12005/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 7.2)
- [CVE-2026-12004](https://insights.sbomify.com/CVE-2026-12004/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 8.7)
- [CVE-2026-12003](https://insights.sbomify.com/CVE-2026-12003/): CPython >3.11 Insecure Input Validation resulting in privilege escalation (medium 5.3)
- [CVE-2026-12002](https://insights.sbomify.com/CVE-2026-12002/): Cross-site request forgery in Smash Balloon Social Photo Feed – Easy Social Feeds Plugin (medium 4.7)
- [CVE-2026-12001](https://insights.sbomify.com/CVE-2026-12001/): Hardcoded Credential Vulnerability in Multiple TP-Link Router Models (medium 5.2)
- [CVE-2026-12000](https://insights.sbomify.com/CVE-2026-12000/): Missing authorization in Page and Post Restriction (high 7.5)
- [CVE-2026-1200](https://insights.sbomify.com/CVE-2026-1200/): Remote code execution via segmentation fault in increasebufferto function (medium 6.3)
- [CVE-2026-11999](https://insights.sbomify.com/CVE-2026-11999/): X.509 trust-chain bypass via path-depth exhaustion in wolfSSL_X509_verify_cert() (high 8.2)
- [CVE-2026-11998](https://insights.sbomify.com/CVE-2026-11998/): AngularJS XSS via SCE resource URL sanitization bypass (high 7.6)
- [CVE-2026-11997](https://insights.sbomify.com/CVE-2026-11997/): Bulk SEO Image <= 1.1 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2026-11996](https://insights.sbomify.com/CVE-2026-11996/): Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field (medium 6.4)
- [CVE-2026-11995](https://insights.sbomify.com/CVE-2026-11995/): Missing authorization in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder (medium 5.3)
- [CVE-2026-11994](https://insights.sbomify.com/CVE-2026-11994/): Akaunting 3.1.21 - Authenticated stored XSS in report description rendering (medium 4.8)
- [CVE-2026-11993](https://insights.sbomify.com/CVE-2026-11993/): Fix authenticated members disabling file content indexing server-wide via extraction pool exhaustion (medium 4.3)
- [CVE-2026-11992](https://insights.sbomify.com/CVE-2026-11992/): Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation (medium 4.3)
- [CVE-2026-11990](https://insights.sbomify.com/CVE-2026-11990/): Missing authorization in KiviCare – Clinic & Patient Management System (EHR) (medium 5.3)
- [CVE-2026-1199](https://insights.sbomify.com/CVE-2026-1199/): API and Frontend login lockout race condition (medium 6.9)
- [CVE-2026-11989](https://insights.sbomify.com/CVE-2026-11989/): Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping (medium 6.5)
- [CVE-2026-11988](https://insights.sbomify.com/CVE-2026-11988/): Missing authorization in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (medium 6.5)
- [CVE-2026-11987](https://insights.sbomify.com/CVE-2026-11987/): Missing authorization in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (medium 4.3)
- [CVE-2026-11986](https://insights.sbomify.com/CVE-2026-11986/): Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks (medium 4.9)
- [CVE-2026-11985](https://insights.sbomify.com/CVE-2026-11985/): Cross-thread FPU register leak on ARM when FPU enabled without register sharing (low 3.6)
- [CVE-2026-11984](https://insights.sbomify.com/CVE-2026-11984/): Missing authorization in Ad Inserter – Ad Manager & AdSense Ads (medium 5.3)
- [CVE-2026-11983](https://insights.sbomify.com/CVE-2026-11983/): Ad Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax (medium 5.3)
- [CVE-2026-11982](https://insights.sbomify.com/CVE-2026-11982/): Stored XSS via missing XSS safety check in Admin2 Pages API partial validation (medium 5.1)
- [CVE-2026-11981](https://insights.sbomify.com/CVE-2026-11981/): GiveWP <= 4.15.3 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2026-11980](https://insights.sbomify.com/CVE-2026-11980/): Code execution in IBM Desktop App (high 7.3)
- [CVE-2026-1198](https://insights.sbomify.com/CVE-2026-1198/): SQL Injection in SIMPLE.ERP (high 8.6)
- [CVE-2026-11979](https://insights.sbomify.com/CVE-2026-11979/): Stack-Based Buffer Overflow in libxml2 (low 1.8)
- [CVE-2026-11977](https://insights.sbomify.com/CVE-2026-11977/): WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection (medium 6.5)
- [CVE-2026-11976](https://insights.sbomify.com/CVE-2026-11976/): MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise (critical 10.0)
- [CVE-2026-11975](https://insights.sbomify.com/CVE-2026-11975/): Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interface (medium 6.2)
- [CVE-2026-11974](https://insights.sbomify.com/CVE-2026-11974/): Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/888/