# Vulnerabilities published in 2026


- [CVE-2026-115609](https://insights.sbomify.com/CVE-2026-115609/): WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-115608](https://insights.sbomify.com/CVE-2026-115608/): WordPress JetEngine plugin <= 3.9.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-115607](https://insights.sbomify.com/CVE-2026-115607/): WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-115606](https://insights.sbomify.com/CVE-2026-115606/): WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-115605](https://insights.sbomify.com/CVE-2026-115605/): WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-115603](https://insights.sbomify.com/CVE-2026-115603/): WordPress Advanced Ads – Tracking plugin < 4.0.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-115602](https://insights.sbomify.com/CVE-2026-115602/): WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-115601](https://insights.sbomify.com/CVE-2026-115601/): WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-1156](https://insights.sbomify.com/CVE-2026-1156/): Totolink LR350 cstecgi.cgi setWiFiBasicCfg buffer overflow (high 8.7)
- [CVE-2026-115599](https://insights.sbomify.com/CVE-2026-115599/): WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability (high 7.5)
- [CVE-2026-115598](https://insights.sbomify.com/CVE-2026-115598/): WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-115597](https://insights.sbomify.com/CVE-2026-115597/): WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-115596](https://insights.sbomify.com/CVE-2026-115596/): WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-115595](https://insights.sbomify.com/CVE-2026-115595/): WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-115594](https://insights.sbomify.com/CVE-2026-115594/): WordPress Media LIbrary Assistant plugin <= 3.42 - Sensitive Data Exposure vulnerability (medium 6.5)
- [CVE-2026-115593](https://insights.sbomify.com/CVE-2026-115593/): Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) (high 7.1)
- [CVE-2026-115592](https://insights.sbomify.com/CVE-2026-115592/): WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-115591](https://insights.sbomify.com/CVE-2026-115591/): WordPress Contact Form by Supsystic plugin <= 1.10.5 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-115590](https://insights.sbomify.com/CVE-2026-115590/): WordPress Dokan plugin <= 5.3.1 - PHP Object Injection vulnerability (high 7.2)
- [CVE-2026-11559](https://insights.sbomify.com/CVE-2026-11559/): CodeAstro Payroll System view_account.php sql injection (medium 5.3)
- [CVE-2026-115586](https://insights.sbomify.com/CVE-2026-115586/): virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it (regression in 21.14.9) (high 7.1)
- [CVE-2026-115585](https://insights.sbomify.com/CVE-2026-115585/): pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up) (high 7.1)
- [CVE-2026-115580](https://insights.sbomify.com/CVE-2026-115580/): pypdf: Possible long runtimes for large xref table header limits (high 7.1)
- [CVE-2026-11558](https://insights.sbomify.com/CVE-2026-11558/): CodeAstro Payroll System home_salary.php sql injection (medium 5.3)
- [CVE-2026-115572](https://insights.sbomify.com/CVE-2026-115572/): pypdf: Possible long runtimes for repeated references to the same missing object (high 7.1)
- [CVE-2026-115570](https://insights.sbomify.com/CVE-2026-115570/): Electron: Mitigation for compromised eMudhra intermediate certificates (high 7.4)
- [CVE-2026-11557](https://insights.sbomify.com/CVE-2026-11557/): Tenda F451 Web Management Natlimit fromNatlimit stack-based overflow (high 8.7)
- [CVE-2026-115569](https://insights.sbomify.com/CVE-2026-115569/): Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root (low 3.3)
- [CVE-2026-115567](https://insights.sbomify.com/CVE-2026-115567/): Tokio: Race condition in `tokio::time::Interval` (medium 5.8)
- [CVE-2026-11556](https://insights.sbomify.com/CVE-2026-11556/): Tenda F451 Web Management WriteFacMac formWriteFacMac os command injection (high 8.7)
- [CVE-2026-115557](https://insights.sbomify.com/CVE-2026-115557/): Distrust compromised intermediate certificates in ssl module (critical 9.4)
- [CVE-2026-11555](https://insights.sbomify.com/CVE-2026-11555/): D-Link DGS-1100-08PD Web boa.conf least privilege violation (medium 6.3)
- [CVE-2026-115547](https://insights.sbomify.com/CVE-2026-115547/): Command Execution via Admin Console Input in Okta Access Gateway (critical 9.1)
- [CVE-2026-115546](https://insights.sbomify.com/CVE-2026-115546/): Authentication Source Verification Issue in Okta Access Gateway (high 8.1)
- [CVE-2026-11554](https://insights.sbomify.com/CVE-2026-11554/): TOTOLINK CP450 vsftpd vsftpd.conf least privilege violation (medium 5.3)
- [CVE-2026-115537](https://insights.sbomify.com/CVE-2026-115537/): gedelumbung HospitalManagement URL Validation routing_pages.php simpan redirect (medium 5.3)
- [CVE-2026-115536](https://insights.sbomify.com/CVE-2026-115536/): gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting (medium 5.3)
- [CVE-2026-115535](https://insights.sbomify.com/CVE-2026-115535/): gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting (medium 4.8)
- [CVE-2026-115534](https://insights.sbomify.com/CVE-2026-115534/): gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting (medium 5.3)
- [CVE-2026-115533](https://insights.sbomify.com/CVE-2026-115533/): CVE-2026-115533 (not scored)
- [CVE-2026-11553](https://insights.sbomify.com/CVE-2026-11553/): Tenda HG7/HG9/HG10 formPPPEdit stack-based overflow (high 8.7)
- [CVE-2026-115522](https://insights.sbomify.com/CVE-2026-115522/): Cross-Application Artifact Namespace Isolation in Google Agent Development Kit (ADK) for Python (medium 5.3)
- [CVE-2026-11552](https://insights.sbomify.com/CVE-2026-11552/): SourceCodester Onlne Examination & Learning Management System import_users.php hard-coded password (medium 6.9)
- [CVE-2026-115519](https://insights.sbomify.com/CVE-2026-115519/): Sensitive cookies without 'Secure' and 'HttpOnly' attributes in KNIME Business Hub (low 2.1)
- [CVE-2026-115517](https://insights.sbomify.com/CVE-2026-115517/): Unrestricted network access between execution contexts in KNIME Business Hub (medium 6.4)
- [CVE-2026-115513](https://insights.sbomify.com/CVE-2026-115513/): OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel (medium 6.3)
- [CVE-2026-11551](https://insights.sbomify.com/CVE-2026-11551/): Auth bypass in Branda – White Label & Branding, Free Login Page Customizer (critical 9.8)
- [CVE-2026-115509](https://insights.sbomify.com/CVE-2026-115509/): Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API (low 2.3)
- [CVE-2026-115508](https://insights.sbomify.com/CVE-2026-115508/): Crawl4AI 0.7.0 before 0.9.5 ReDoS via /crawl Regex Fields (high 7.1)
- [CVE-2026-115507](https://insights.sbomify.com/CVE-2026-115507/): Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header (medium 5.1)
- [CVE-2026-115506](https://insights.sbomify.com/CVE-2026-115506/): libexpat through 2.9.0 Denial of Service via Billion Laughs Detection Delay (high 8.7)
- [CVE-2026-115505](https://insights.sbomify.com/CVE-2026-115505/): libsmb2 before 6.3 Integer Overflow in DCE/RPC NDR Decoder via NetrShareEnum (high 7.2)
- [CVE-2026-115504](https://insights.sbomify.com/CVE-2026-115504/): CFITSIO through 4.7.0 Out-of-Bounds Write via ffgcls2 in getcols.c (high 8.5)
- [CVE-2026-115503](https://insights.sbomify.com/CVE-2026-115503/): Ghidra before 12.2 Denial of Service via Compressed Extension Archive (medium 6.8)
- [CVE-2026-115502](https://insights.sbomify.com/CVE-2026-115502/): DataApp links without login expose job information to other user in KNIME Business Hub (medium 6.3)
- [CVE-2026-1155](https://insights.sbomify.com/CVE-2026-1155/): Totolink LR350 cstecgi.cgi setWiFiEasyGuestCfg buffer overflow (high 8.7)
- [CVE-2026-115497](https://insights.sbomify.com/CVE-2026-115497/): Music Store <= 1.4.7 - Unauthenticated Arbitrary File Read via 'f' Parameter (high 7.5)
- [CVE-2026-115496](https://insights.sbomify.com/CVE-2026-115496/): Workflow names may be leaked to unauthenticated users in KNIME Business Hub (medium 6.9)
- [CVE-2026-115495](https://insights.sbomify.com/CVE-2026-115495/): Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket (medium 5.7)
- [CVE-2026-115494](https://insights.sbomify.com/CVE-2026-115494/): CSRF protection could be tricked by forged X-Forwarded-Host header in KNIME Business Hub (medium 5.3)
- [CVE-2026-11549](https://insights.sbomify.com/CVE-2026-11549/): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty Improper Access Control (medium 6.5)
- [CVE-2026-115486](https://insights.sbomify.com/CVE-2026-115486/): Open-iscsi: open-iscsi: ipv6 neighbor discovery missing option length validation in iscsiuio allows arp table poisoning (high 7.1)
- [CVE-2026-115485](https://insights.sbomify.com/CVE-2026-115485/): Open-iscsi: open-iscsi: dhcpv6 vendor option strlen heap out-of-bounds read and 1-byte write in iscsiuio (medium 6.3)
- [CVE-2026-115484](https://insights.sbomify.com/CVE-2026-115484/): Open-iscsi: open-iscsi: dhcpv4 option parser heap out-of-bounds read in iscsiuio parse_msg (high 7.6)
- [CVE-2026-115482](https://insights.sbomify.com/CVE-2026-115482/): Denial of service in lsquic (high 7.5)
- [CVE-2026-115481](https://insights.sbomify.com/CVE-2026-115481/): File upload in basercms (high 8.5)
- [CVE-2026-115480](https://insights.sbomify.com/CVE-2026-115480/): baserCMS: Public Web API mail-form submission bypasses image CAPTCHA (medium 5.3)
- [CVE-2026-11548](https://insights.sbomify.com/CVE-2026-11548/): IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty HTTP Request Smuggling (medium 4.8)
- [CVE-2026-115479](https://insights.sbomify.com/CVE-2026-115479/): baserCMS: Mail-form auto-replies accept multiple visitor-controlled recipients (medium 5.3)
- [CVE-2026-115478](https://insights.sbomify.com/CVE-2026-115478/): obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes (high 7.1)
- [CVE-2026-115477](https://insights.sbomify.com/CVE-2026-115477/): obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP (high 7.1)
- [CVE-2026-11546](https://insights.sbomify.com/CVE-2026-11546/): IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability (high 7.1)
- [CVE-2026-115457](https://insights.sbomify.com/CVE-2026-115457/): baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments (high 7.1)
- [CVE-2026-115454](https://insights.sbomify.com/CVE-2026-115454/): Large tables in data apps can bring down execution services in KNIME Hub (medium 5.3)
- [CVE-2026-115453](https://insights.sbomify.com/CVE-2026-115453/): Missing authorization in Ecommerce Template (high 7.1)
- [CVE-2026-115450](https://insights.sbomify.com/CVE-2026-115450/): Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier (high 7.1)
- [CVE-2026-11545](https://insights.sbomify.com/CVE-2026-11545/): IBM WebSphere Application Server is affected by a privilege escalation (low 3.7)
- [CVE-2026-115449](https://insights.sbomify.com/CVE-2026-115449/): Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest (low 3.5)
- [CVE-2026-115425](https://insights.sbomify.com/CVE-2026-115425/): Multiple cross-site scripting (XSS) in OPNsense (medium 5.6)
- [CVE-2026-115424](https://insights.sbomify.com/CVE-2026-115424/): Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination (medium 5.5)
- [CVE-2026-115419](https://insights.sbomify.com/CVE-2026-115419/): Unintended disclosure of data element to wrong session in Strands Agents SDK A2A Server (high 8.6)
- [CVE-2026-115418](https://insights.sbomify.com/CVE-2026-115418/): SQL injection in aws-cdk/aws-redshift-alpha (high 7.0)
- [CVE-2026-115417](https://insights.sbomify.com/CVE-2026-115417/): Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt (high 8.2)
- [CVE-2026-115416](https://insights.sbomify.com/CVE-2026-115416/): Incorrect authorization checks in Amazon Athena engine version 3 query processing (medium 6.3)
- [CVE-2026-115415](https://insights.sbomify.com/CVE-2026-115415/): Secret masking bypass in the environment tool in Strands Agents Tools (medium 5.9)
- [CVE-2026-115414](https://insights.sbomify.com/CVE-2026-115414/): OS command injection in the Terraform hook in AWS SAM CLI (high 8.4)
- [CVE-2026-115413](https://insights.sbomify.com/CVE-2026-115413/): AWS API MCP Server OAuth Token Audience Validation Bypass (high 7.3)
- [CVE-2026-115411](https://insights.sbomify.com/CVE-2026-115411/): crawlseo before 0.2.4 Server-Side Request Forgery via Crawler (medium 5.3)
- [CVE-2026-11541](https://insights.sbomify.com/CVE-2026-11541/): Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms. (high 7.4)
- [CVE-2026-115408](https://insights.sbomify.com/CVE-2026-115408/): ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets (medium 5.5)
- [CVE-2026-115402](https://insights.sbomify.com/CVE-2026-115402/): Race condition in ovpn-dco-win (medium 5.7)
- [CVE-2026-115400](https://insights.sbomify.com/CVE-2026-115400/): crawlseo before 0.2.5 Cleartext Storage of Google OAuth Tokens (medium 6.7)
- [CVE-2026-11540](https://insights.sbomify.com/CVE-2026-11540/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 5.3)
- [CVE-2026-1154](https://insights.sbomify.com/CVE-2026-1154/): SourceCodester E-Learning System Lesson index.php cross site scripting (medium 5.3)
- [CVE-2026-115398](https://insights.sbomify.com/CVE-2026-115398/): Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount (medium 6.8)
- [CVE-2026-115397](https://insights.sbomify.com/CVE-2026-115397/): Ghidra before 12.2 Denial of Service via Extension Archive Install (medium 6.8)
- [CVE-2026-115396](https://insights.sbomify.com/CVE-2026-115396/): Ghidra 10.3 before 12.2 Denial of Service via Compressed Theme Archive (medium 6.8)
- [CVE-2026-115395](https://insights.sbomify.com/CVE-2026-115395/): Ghidra 10.3 before 12.2 Denial of Service via ThemeReader.readZipTheme() (medium 6.8)
- [CVE-2026-115394](https://insights.sbomify.com/CVE-2026-115394/): Ghidra through 12.2 Denial of Service via BinaryField Memory Allocation (medium 6.8)
- [CVE-2026-115393](https://insights.sbomify.com/CVE-2026-115393/): Memory corruption in wasmtime (low 1.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/905/