# Vulnerabilities published in 2026


- [CVE-2026-11588](https://insights.sbomify.com/CVE-2026-11588/): EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation (medium 6.1)
- [CVE-2026-115877](https://insights.sbomify.com/CVE-2026-115877/): Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value (medium 5.4)
- [CVE-2026-11587](https://insights.sbomify.com/CVE-2026-11587/): Authenticated SQL Injection via PHP Array Key in ACL Management (Resources & Actions) — Centreon 26.03.0 (high 7.2)
- [CVE-2026-115863](https://insights.sbomify.com/CVE-2026-115863/): Memory corruption in ConnMan (high 7.6)
- [CVE-2026-11586](https://insights.sbomify.com/CVE-2026-11586/): WS Auto-PONG memory exhaustion (high 7.5)
- [CVE-2026-11585](https://insights.sbomify.com/CVE-2026-11585/): CodeAstro Student Attendance Management System createClassArms.php sql injection (medium 5.3)
- [CVE-2026-115845](https://insights.sbomify.com/CVE-2026-115845/): Incomplete validation in the run_script Python sandbox in AWS MCP Server (medium 5.3)
- [CVE-2026-11584](https://insights.sbomify.com/CVE-2026-11584/): CodeAstro Student Attendance Management System createClass.php edit sql injection (medium 5.3)
- [CVE-2026-11583](https://insights.sbomify.com/CVE-2026-11583/): CodeAstro Student Attendance Management System createClass.php sql injection (medium 5.3)
- [CVE-2026-115825](https://insights.sbomify.com/CVE-2026-115825/): HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length. (not scored)
- [CVE-2026-115824](https://insights.sbomify.com/CVE-2026-115824/): Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies (not scored)
- [CVE-2026-115823](https://insights.sbomify.com/CVE-2026-115823/): Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections. (not scored)
- [CVE-2026-115822](https://insights.sbomify.com/CVE-2026-115822/): Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies. (not scored)
- [CVE-2026-115821](https://insights.sbomify.com/CVE-2026-115821/): Cross-site scripting in NewsmanApp (high 7.2)
- [CVE-2026-11582](https://insights.sbomify.com/CVE-2026-11582/): CodeAstro Student Attendance Management System index.php sql injection (medium 6.9)
- [CVE-2026-115817](https://insights.sbomify.com/CVE-2026-115817/): Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers. (not scored)
- [CVE-2026-115813](https://insights.sbomify.com/CVE-2026-115813/): Server-side request forgery in the model download path in Amazon Web Services Multi Model Server (medium 6.9)
- [CVE-2026-115812](https://insights.sbomify.com/CVE-2026-115812/): Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server (critical 9.3)
- [CVE-2026-115810](https://insights.sbomify.com/CVE-2026-115810/): Tandoor Recipes before 2.7.0 SSRF via Pestle Importer Image URL (medium 6.3)
- [CVE-2026-11581](https://insights.sbomify.com/CVE-2026-11581/): Kali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field Caption (medium 5.9)
- [CVE-2026-115807](https://insights.sbomify.com/CVE-2026-115807/): Privilege escalation in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (high 7.1)
- [CVE-2026-115806](https://insights.sbomify.com/CVE-2026-115806/): Deserialization in Prime Mover – Backup and Migration (critical 9.8)
- [CVE-2026-115805](https://insights.sbomify.com/CVE-2026-115805/): Rapid7 Insight Agent Local Privilege Escalation via Shell Injection in mcp.json Configuration Path (high 7.8)
- [CVE-2026-115804](https://insights.sbomify.com/CVE-2026-115804/): Consul vulnerable to an authorization bypass in health check registration (medium 6.4)
- [CVE-2026-115803](https://insights.sbomify.com/CVE-2026-115803/): Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization (medium 5.3)
- [CVE-2026-115802](https://insights.sbomify.com/CVE-2026-115802/): InternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere (medium 5.3)
- [CVE-2026-115801](https://insights.sbomify.com/CVE-2026-115801/): Kakao khaiii JSON Config File Linear.cpp open out-of-bounds (medium 4.8)
- [CVE-2026-115800](https://insights.sbomify.com/CVE-2026-115800/): UbiquitousLearning mllm Convertor __init__.py load_model path traversal (medium 4.8)
- [CVE-2026-11580](https://insights.sbomify.com/CVE-2026-11580/): Kali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDOR (medium 5.5)
- [CVE-2026-1158](https://insights.sbomify.com/CVE-2026-1158/): Totolink LR350 POST Request cstecgi.cgi setWizardCfg buffer overflow (high 8.7)
- [CVE-2026-115797](https://insights.sbomify.com/CVE-2026-115797/): Tenda F6 Web Management cleartext transmission (medium 6.3)
- [CVE-2026-115796](https://insights.sbomify.com/CVE-2026-115796/): Tenda F6 Web Management cross-site request forgery (medium 5.3)
- [CVE-2026-115795](https://insights.sbomify.com/CVE-2026-115795/): Out-of-bounds read of DCP block header in DCP Set and Identify request parsing (medium 5.3)
- [CVE-2026-115794](https://insights.sbomify.com/CVE-2026-115794/): Alarm data length not validated against received frame length (low 2.3)
- [CVE-2026-115793](https://insights.sbomify.com/CVE-2026-115793/): Resource exhaustion from RPC sessions kept for requests to unknown interface (high 8.7)
- [CVE-2026-11579](https://insights.sbomify.com/CVE-2026-11579/): Kali Forms < 2.4.17 - Unauthenticated Media Upload (medium 5.3)
- [CVE-2026-115786](https://insights.sbomify.com/CVE-2026-115786/): Zimbra Collaboration Suite Shared-File Mailbox Quota Accounting Error Enables Quota Exhaustion (medium 6.5)
- [CVE-2026-115785](https://insights.sbomify.com/CVE-2026-115785/): Zimbra Collaboration Suite Data Source Test SMTP Command Injection via Unsanitized Email Address (medium 4.3)
- [CVE-2026-11578](https://insights.sbomify.com/CVE-2026-11578/): Fluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDOR (low 2.7)
- [CVE-2026-115778](https://insights.sbomify.com/CVE-2026-115778/): Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation Buffer (high 7.5)
- [CVE-2026-115776](https://insights.sbomify.com/CVE-2026-115776/): Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer (high 7.5)
- [CVE-2026-115775](https://insights.sbomify.com/CVE-2026-115775/): Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element Tree (high 8.7)
- [CVE-2026-115774](https://insights.sbomify.com/CVE-2026-115774/): Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH (medium 4.9)
- [CVE-2026-11576](https://insights.sbomify.com/CVE-2026-11576/): Memory corruption in Eclipse ThreadX - NetX Duo (high 7.5)
- [CVE-2026-115754](https://insights.sbomify.com/CVE-2026-115754/): serialize-javascript 7.0.1 before 7.1.3 XSS via unescaped </script in function body (low 2.3)
- [CVE-2026-115752](https://insights.sbomify.com/CVE-2026-115752/): Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon (low 2.3)
- [CVE-2026-115751](https://insights.sbomify.com/CVE-2026-115751/): mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname (medium 6.3)
- [CVE-2026-115750](https://insights.sbomify.com/CVE-2026-115750/): mcp-from-openapi from 2.5.0 before 2.9.0 Credential Leak via Cross-Origin Redirects (medium 6.3)
- [CVE-2026-11575](https://insights.sbomify.com/CVE-2026-11575/): PhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged Callback (high 7.5)
- [CVE-2026-115749](https://insights.sbomify.com/CVE-2026-115749/): hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module Import (medium 4.8)
- [CVE-2026-115748](https://insights.sbomify.com/CVE-2026-115748/): Apache Vysper: Authorization bypass (high 8.8)
- [CVE-2026-115730](https://insights.sbomify.com/CVE-2026-115730/): i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl (low 2.3)
- [CVE-2026-11573](https://insights.sbomify.com/CVE-2026-11573/): Uncontrolled recursion in QDomDocument/QDomNode serialization causes stack exhaustion (QtXml) (high 7.1)
- [CVE-2026-115729](https://insights.sbomify.com/CVE-2026-115729/): @pdfme/common 5.5.10 before 6.2.6 SSRF via isUrlSafeToFetch Bypass (high 8.9)
- [CVE-2026-115728](https://insights.sbomify.com/CVE-2026-115728/): @hapi/content 6.0.1 before 6.0.3 ReDoS via Content.disposition() Parameter Parsing (high 8.7)
- [CVE-2026-115727](https://insights.sbomify.com/CVE-2026-115727/): AgenticSeek before commit 409840c RCE via Exposed Werkzeug Debugger in llm_server (critical 9.2)
- [CVE-2026-115726](https://insights.sbomify.com/CVE-2026-115726/): Aider through 0.86.2 Command Execution via Repository .aider.conf.yml Settings (high 8.5)
- [CVE-2026-115725](https://insights.sbomify.com/CVE-2026-115725/): Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id (low 2.3)
- [CVE-2026-115724](https://insights.sbomify.com/CVE-2026-115724/): VLC for Android before 3.7.2 File Overwrite via Spoofed Mail Attachment Provider (low 2.1)
- [CVE-2026-115723](https://insights.sbomify.com/CVE-2026-115723/): Snap7 through 1.4.3 Out-of-Bounds Write via BRecv and CheckAsBRecvCompletion (high 8.3)
- [CVE-2026-115722](https://insights.sbomify.com/CVE-2026-115722/): RPly through 1.1.4 Out-of-Bounds Function Pointer Index via PLY Header (medium 6.9)
- [CVE-2026-115721](https://insights.sbomify.com/CVE-2026-115721/): Apache Vysper: Unbounded allocation (high 7.5)
- [CVE-2026-115720](https://insights.sbomify.com/CVE-2026-115720/): Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect (medium 5.3)
- [CVE-2026-11572](https://insights.sbomify.com/CVE-2026-11572/): degit has a Command Injection issue (high 8.7)
- [CVE-2026-115718](https://insights.sbomify.com/CVE-2026-115718/): Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt (medium 5.3)
- [CVE-2026-115717](https://insights.sbomify.com/CVE-2026-115717/): Frappe Builder before 1.36.1 SSRF via convert_to_webp (medium 6.3)
- [CVE-2026-115713](https://insights.sbomify.com/CVE-2026-115713/): Path traversal in Elastic Cloud Enterprise (high 7.5)
- [CVE-2026-115712](https://insights.sbomify.com/CVE-2026-115712/): Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings (medium 4.3)
- [CVE-2026-115711](https://insights.sbomify.com/CVE-2026-115711/): Information disclosure in Elastic Cloud Enterprise (medium 6.4)
- [CVE-2026-11571](https://insights.sbomify.com/CVE-2026-11571/): Everest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV Artifacts (high 7.5)
- [CVE-2026-115709](https://insights.sbomify.com/CVE-2026-115709/): Path traversal in Elastic Cloud Enterprise (high 8.2)
- [CVE-2026-115708](https://insights.sbomify.com/CVE-2026-115708/): Auth bypass in Elastic Cloud Enterprise (high 7.2)
- [CVE-2026-115707](https://insights.sbomify.com/CVE-2026-115707/): Information disclosure in Elastic Cloud Enterprise (medium 6.4)
- [CVE-2026-115706](https://insights.sbomify.com/CVE-2026-115706/): Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation (medium 6.8)
- [CVE-2026-115700](https://insights.sbomify.com/CVE-2026-115700/): SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney (medium 6.9)
- [CVE-2026-11570](https://insights.sbomify.com/CVE-2026-11570/): User Submitted Posts < 20260608 - Unauthenticated Stored XSS via Author Name (medium 4.2)
- [CVE-2026-1157](https://insights.sbomify.com/CVE-2026-1157/): Totolink LR350 cstecgi.cgi setWiFiEasyCfg buffer overflow (high 8.7)
- [CVE-2026-115693](https://insights.sbomify.com/CVE-2026-115693/): Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney (critical 9.1)
- [CVE-2026-11569](https://insights.sbomify.com/CVE-2026-11569/): Quay: quay: stored xss via filedrop svg upload (medium 5.4)
- [CVE-2026-115680](https://insights.sbomify.com/CVE-2026-115680/): Memory corruption in MDK-Middleware (medium 6.5)
- [CVE-2026-11568](https://insights.sbomify.com/CVE-2026-11568/): Product Configurator for WooCommerce < 1.7.3 - Unauthenticated Private/Draft Product Data Disclosure via pc_get_data (high 7.5)
- [CVE-2026-115679](https://insights.sbomify.com/CVE-2026-115679/): Memory corruption in MDK-Middleware (medium 6.5)
- [CVE-2026-115678](https://insights.sbomify.com/CVE-2026-115678/): Memory corruption in MDK-Middleware (medium 5.3)
- [CVE-2026-11567](https://insights.sbomify.com/CVE-2026-11567/): SureForms < 2.11.1 - Unauthenticated Payment Amount Bypass (medium 5.9)
- [CVE-2026-115657](https://insights.sbomify.com/CVE-2026-115657/): KNIME Analytics Platform logs credentials of configured proxy when used as an executor (medium 4.8)
- [CVE-2026-11565](https://insights.sbomify.com/CVE-2026-11565/): Advanced File Manager < 5.4.13 - Authenticated Arbitrary File Read and Write via fma_load_fma_ui (high 8.5)
- [CVE-2026-115644](https://insights.sbomify.com/CVE-2026-115644/): Apache Kafka: Connect Admin REST API Authentication Bypass via Unapplied REST Extensions (not scored)
- [CVE-2026-11564](https://insights.sbomify.com/CVE-2026-11564/): Native CA trust persist (critical 9.1)
- [CVE-2026-115638](https://insights.sbomify.com/CVE-2026-115638/): Denial of service in Ironic (medium 4.3)
- [CVE-2026-115635](https://insights.sbomify.com/CVE-2026-115635/): AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set (medium 6.0)
- [CVE-2026-11563](https://insights.sbomify.com/CVE-2026-11563/): Word Count and Social Shares <= 1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal (critical 9.6)
- [CVE-2026-115627](https://insights.sbomify.com/CVE-2026-115627/): Missing authorization in ash postgres (medium 6.0)
- [CVE-2026-115624](https://insights.sbomify.com/CVE-2026-115624/): Missing authorization in GROWI (medium 6.9)
- [CVE-2026-11562](https://insights.sbomify.com/CVE-2026-11562/): WS Form LITE < 1.11.8 - Subscriber+ Arbitrary Settings Update (medium 4.3)
- [CVE-2026-115614](https://insights.sbomify.com/CVE-2026-115614/): WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-115613](https://insights.sbomify.com/CVE-2026-115613/): Cross-site scripting in Image Gallery block – Create and display photo gallery/photo album. (medium 6.5)
- [CVE-2026-115612](https://insights.sbomify.com/CVE-2026-115612/): WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-115611](https://insights.sbomify.com/CVE-2026-115611/): WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-115610](https://insights.sbomify.com/CVE-2026-115610/): WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-11561](https://insights.sbomify.com/CVE-2026-11561/): SSTI in Soagen Informatics' Apinizer (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/904/