# Vulnerabilities published in 2026 - [CVE-2026-116014](https://insights.sbomify.com/CVE-2026-116014/): open62541 1.5.0 before 1.5.7 Integer Overflow Heap Buffer Overflow via Custom DataType (critical 9.2) - [CVE-2026-116013](https://insights.sbomify.com/CVE-2026-116013/): OpenResty lua-resty-dns before 0.24 Denial of Service via DNS Response Parsing (medium 6.3) - [CVE-2026-116012](https://insights.sbomify.com/CVE-2026-116012/): Ghidra before 12.2 Integer Truncation in PackedDecode::skipAttribute Decompiler Parser (low 2.0) - [CVE-2026-116011](https://insights.sbomify.com/CVE-2026-116011/): Crow before 1.3.4 Denial of Service via Deeply Nested JSON in crow::json::load() (high 8.7) - [CVE-2026-116010](https://insights.sbomify.com/CVE-2026-116010/): RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers (medium 5.3) - [CVE-2026-11601](https://insights.sbomify.com/CVE-2026-11601/): WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete (medium 5.3) - [CVE-2026-116009](https://insights.sbomify.com/CVE-2026-116009/): Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action (high 8.7) - [CVE-2026-116008](https://insights.sbomify.com/CVE-2026-116008/): DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign (medium 5.3) - [CVE-2026-116007](https://insights.sbomify.com/CVE-2026-116007/): Auth bypass in ruoyi-vue-pro (medium 6.3) - [CVE-2026-116006](https://insights.sbomify.com/CVE-2026-116006/): YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication (medium 6.9) - [CVE-2026-116004](https://insights.sbomify.com/CVE-2026-116004/): onyx-dot-app Onyx PreviewTab.tsx cross site scripting (medium 5.1) - [CVE-2026-116000](https://insights.sbomify.com/CVE-2026-116000/): Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request forgery (medium 6.9) - [CVE-2026-11600](https://insights.sbomify.com/CVE-2026-11600/): Missing authorization in Envo's Templates & Widgets for Elementor and WooCommerce (medium 4.3) - [CVE-2026-1160](https://insights.sbomify.com/CVE-2026-1160/): PHPGurukul Directory Management System Search index.php sql injection (medium 6.9) - [CVE-2026-115999](https://insights.sbomify.com/CVE-2026-115999/): mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection (medium 6.9) - [CVE-2026-115998](https://insights.sbomify.com/CVE-2026-115998/): IDOR: User reads and modifies findings from other people's projects (medium 4.3) - [CVE-2026-115997](https://insights.sbomify.com/CVE-2026-115997/): pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection (medium 5.3) - [CVE-2026-115996](https://insights.sbomify.com/CVE-2026-115996/): Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate validation (medium 6.3) - [CVE-2026-115995](https://insights.sbomify.com/CVE-2026-115995/): Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection (critical 9.4) - [CVE-2026-115994](https://insights.sbomify.com/CVE-2026-115994/): BOLA Allows Cross-Project Target Tampering (medium 5.4) - [CVE-2026-115993](https://insights.sbomify.com/CVE-2026-115993/): Stored XSS in the “Notes” field of project checklists (medium 6.8) - [CVE-2026-115982](https://insights.sbomify.com/CVE-2026-115982/): phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting (medium 5.3) - [CVE-2026-115981](https://insights.sbomify.com/CVE-2026-115981/): phpIPAM index.php cross site scripting (medium 4.8) - [CVE-2026-11598](https://insights.sbomify.com/CVE-2026-11598/): Shortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute (medium 5.0) - [CVE-2026-115975](https://insights.sbomify.com/CVE-2026-115975/): Broken access control in JiraController (high 7.1) - [CVE-2026-115973](https://insights.sbomify.com/CVE-2026-115973/): FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery (medium 6.9) - [CVE-2026-115972](https://insights.sbomify.com/CVE-2026-115972/): FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization (medium 6.9) - [CVE-2026-115971](https://insights.sbomify.com/CVE-2026-115971/): Travisun Opptrix preParsing handler webhook Buffer.concat denial of service (medium 6.9) - [CVE-2026-115970](https://insights.sbomify.com/CVE-2026-115970/): Travisun Opptrix Import Endpoint import code injection (medium 6.9) - [CVE-2026-11597](https://insights.sbomify.com/CVE-2026-11597/): Cross-site scripting in Surbma | Infusionsoft Shortcode (medium 6.4) - [CVE-2026-115969](https://insights.sbomify.com/CVE-2026-115969/): Travisun Opptrix Schedule API setup command injection (medium 6.9) - [CVE-2026-115968](https://insights.sbomify.com/CVE-2026-115968/): WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability (critical 9.8) - [CVE-2026-115967](https://insights.sbomify.com/CVE-2026-115967/): WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability (high 8.8) - [CVE-2026-115966](https://insights.sbomify.com/CVE-2026-115966/): WordPress Typing Text – Give your texts many typing effects plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-115965](https://insights.sbomify.com/CVE-2026-115965/): WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability (high 8.5) - [CVE-2026-115964](https://insights.sbomify.com/CVE-2026-115964/): WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability (critical 9.3) - [CVE-2026-115963](https://insights.sbomify.com/CVE-2026-115963/): WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability (high 7.1) - [CVE-2026-115962](https://insights.sbomify.com/CVE-2026-115962/): WordPress myCred plugin <= 4.0.1 - Bypass Vulnerability vulnerability (medium 4.3) - [CVE-2026-115961](https://insights.sbomify.com/CVE-2026-115961/): WordPress B Slider plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-115960](https://insights.sbomify.com/CVE-2026-115960/): WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability (medium 4.3) - [CVE-2026-11596](https://insights.sbomify.com/CVE-2026-11596/): Business logic in ScreenConnect (medium 4.7) - [CVE-2026-115959](https://insights.sbomify.com/CVE-2026-115959/): WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-115958](https://insights.sbomify.com/CVE-2026-115958/): WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability (medium 5.3) - [CVE-2026-115957](https://insights.sbomify.com/CVE-2026-115957/): WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-115956](https://insights.sbomify.com/CVE-2026-115956/): WordPress Panorama Viewer – 360 Degree Image + Video Viewer plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-115955](https://insights.sbomify.com/CVE-2026-115955/): Cross-site scripting in Advanced Post Block - Post Grid for WordPress block editor (medium 6.5) - [CVE-2026-115954](https://insights.sbomify.com/CVE-2026-115954/): WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability (medium 5.4) - [CVE-2026-115953](https://insights.sbomify.com/CVE-2026-115953/): WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-115951](https://insights.sbomify.com/CVE-2026-115951/): WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-115950](https://insights.sbomify.com/CVE-2026-115950/): WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2026-11595](https://insights.sbomify.com/CVE-2026-11595/): IBM WebSphere Application Server is affected by a Path Traversal vulnerability (medium 4.3) - [CVE-2026-115949](https://insights.sbomify.com/CVE-2026-115949/): WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability (medium 6.5) - [CVE-2026-115948](https://insights.sbomify.com/CVE-2026-115948/): WordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability (high 8.5) - [CVE-2026-115943](https://insights.sbomify.com/CVE-2026-115943/): Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. (not scored) - [CVE-2026-115942](https://insights.sbomify.com/CVE-2026-115942/): Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read (not scored) - [CVE-2026-11594](https://insights.sbomify.com/CVE-2026-11594/): IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities (high 8.5) - [CVE-2026-115938](https://insights.sbomify.com/CVE-2026-115938/): Low privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE (high 8.7) - [CVE-2026-115937](https://insights.sbomify.com/CVE-2026-115937/): Unauthenticated payment reuse allows unpaid orders to be marked as paid (high 8.7) - [CVE-2026-115935](https://insights.sbomify.com/CVE-2026-115935/): Control panel only API response emulation replaces "securityKey" and reaches server RCE (high 8.7) - [CVE-2026-115933](https://insights.sbomify.com/CVE-2026-115933/): Forged signed tokens let any registered user take over other users and organizations (critical 9.9) - [CVE-2026-115932](https://insights.sbomify.com/CVE-2026-115932/): Path traversal in post media lets any registered user read server files (critical 9.6) - [CVE-2026-115931](https://insights.sbomify.com/CVE-2026-115931/): Arbitrary file read and backend crash through unrestricted provider method calls (critical 9.9) - [CVE-2026-115930](https://insights.sbomify.com/CVE-2026-115930/): MongoDB Shell (mongosh) bundled with Node.js trusts certificates issued by recoverable eMudhra intermediate CAs (high 7.6) - [CVE-2026-115929](https://insights.sbomify.com/CVE-2026-115929/): MongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs (high 7.6) - [CVE-2026-115927](https://insights.sbomify.com/CVE-2026-115927/): Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks (medium 5.3) - [CVE-2026-115924](https://insights.sbomify.com/CVE-2026-115924/): Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs (high 8.6) - [CVE-2026-115923](https://insights.sbomify.com/CVE-2026-115923/): Backstage catalog rules can be bypassed for URL locations using encoded path segments (medium 6.5) - [CVE-2026-115922](https://insights.sbomify.com/CVE-2026-115922/): ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs (medium 6.2) - [CVE-2026-115921](https://insights.sbomify.com/CVE-2026-115921/): ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute (medium 6.2) - [CVE-2026-115920](https://insights.sbomify.com/CVE-2026-115920/): ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank (medium 6.2) - [CVE-2026-11592](https://insights.sbomify.com/CVE-2026-11592/): Missing authorization in Email Subscribers & Newsletters by Icegram Express – Email Marketing, Post Notifications & WooCommerce Marekting Automation for WordPress (medium 4.3) - [CVE-2026-115919](https://insights.sbomify.com/CVE-2026-115919/): ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check) (medium 6.2) - [CVE-2026-115918](https://insights.sbomify.com/CVE-2026-115918/): vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs (medium 6.5) - [CVE-2026-115917](https://insights.sbomify.com/CVE-2026-115917/): vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server (low 3.4) - [CVE-2026-115916](https://insights.sbomify.com/CVE-2026-115916/): vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS) (medium 6.5) - [CVE-2026-115915](https://insights.sbomify.com/CVE-2026-115915/): vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE (high 8.1) - [CVE-2026-115914](https://insights.sbomify.com/CVE-2026-115914/): vLLM DeepSeek-OCR image processing vulnerable to denial of service (medium 6.5) - [CVE-2026-115913](https://insights.sbomify.com/CVE-2026-115913/): vLLM: Phi-4 multimodal audio encoder materializes and retains full attention matrices: a single max-length audio OOM-crashes the vLLM engine (medium 6.5) - [CVE-2026-115912](https://insights.sbomify.com/CVE-2026-115912/): vLLM: Public multimodal SHM handle forgery reaches worker-side `pickle.loads()` with insecure serialization disabled (high 7.5) - [CVE-2026-115911](https://insights.sbomify.com/CVE-2026-115911/): vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool (medium 6.5) - [CVE-2026-115910](https://insights.sbomify.com/CVE-2026-115910/): Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim (medium 6.8) - [CVE-2026-11591](https://insights.sbomify.com/CVE-2026-11591/): Cross-site scripting in Widgets for Google Reviews (medium 4.4) - [CVE-2026-115909](https://insights.sbomify.com/CVE-2026-115909/): zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction (high 7.5) - [CVE-2026-115908](https://insights.sbomify.com/CVE-2026-115908/): zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (high 7.4) - [CVE-2026-115907](https://insights.sbomify.com/CVE-2026-115907/): zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size (high 7.5) - [CVE-2026-115906](https://insights.sbomify.com/CVE-2026-115906/): zip: AES Entry HMAC Authentication Bypass on Premature EOF (medium 6.5) - [CVE-2026-115905](https://insights.sbomify.com/CVE-2026-115905/): zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE (critical 10.0) - [CVE-2026-115904](https://insights.sbomify.com/CVE-2026-115904/): Topluyo Desktop for Linux has an OS Command Injection issue (critical 9.6) - [CVE-2026-11590](https://insights.sbomify.com/CVE-2026-11590/): WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array Keys (high 8.6) - [CVE-2026-1159](https://insights.sbomify.com/CVE-2026-1159/): itsourcecode Online Frozen Foods Ordering System order_online.php sql injection (medium 6.9) - [CVE-2026-115897](https://insights.sbomify.com/CVE-2026-115897/): Serialize JavaScript: Cross-site scripting (XSS) via unescaped