# Vulnerabilities published in 2026


- [CVE-2026-114702](https://insights.sbomify.com/CVE-2026-114702/): WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-114701](https://insights.sbomify.com/CVE-2026-114701/): WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-114700](https://insights.sbomify.com/CVE-2026-114700/): Cross-site scripting in Restaurant Menu – Food Ordering System – Table Reservation (medium 6.5)
- [CVE-2026-11470](https://insights.sbomify.com/CVE-2026-11470/): hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversal (medium 5.3)
- [CVE-2026-1147](https://insights.sbomify.com/CVE-2026-1147/): Cross-site scripting in Patients Waiting Area Queue Management System (medium 5.1)
- [CVE-2026-114699](https://insights.sbomify.com/CVE-2026-114699/): WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-114698](https://insights.sbomify.com/CVE-2026-114698/): WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability (medium 5.4)
- [CVE-2026-114697](https://insights.sbomify.com/CVE-2026-114697/): WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-114696](https://insights.sbomify.com/CVE-2026-114696/): WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-114695](https://insights.sbomify.com/CVE-2026-114695/): WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-114694](https://insights.sbomify.com/CVE-2026-114694/): WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-114693](https://insights.sbomify.com/CVE-2026-114693/): WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-11469](https://insights.sbomify.com/CVE-2026-11469/): Server-side request forgery in jshERP (medium 5.1)
- [CVE-2026-11468](https://insights.sbomify.com/CVE-2026-11468/): SourceCodester Hospitals Patient Records Management System page room_types cross site scripting (medium 4.8)
- [CVE-2026-11467](https://insights.sbomify.com/CVE-2026-11467/): jishenghua jshERP addAccountHeadAndDetail Endpoint AccountHeadService.java path traversal (medium 5.3)
- [CVE-2026-114665](https://insights.sbomify.com/CVE-2026-114665/): Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare (high 7.1)
- [CVE-2026-114664](https://insights.sbomify.com/CVE-2026-114664/): Frappe before 16.33.0 Blind SQL Injection via get_events (high 7.1)
- [CVE-2026-114663](https://insights.sbomify.com/CVE-2026-114663/): Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments (high 8.6)
- [CVE-2026-114662](https://insights.sbomify.com/CVE-2026-114662/): Obot before 0.26.0 API Key Theft via CLI Login Token Request (high 8.6)
- [CVE-2026-114661](https://insights.sbomify.com/CVE-2026-114661/): OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints (critical 9.0)
- [CVE-2026-114660](https://insights.sbomify.com/CVE-2026-114660/): Grav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form Directives (high 7.0)
- [CVE-2026-11466](https://insights.sbomify.com/CVE-2026-11466/): zilliztech deep-searcher collection_router.py CollectionRouter.invoke access control (medium 5.3)
- [CVE-2026-114659](https://insights.sbomify.com/CVE-2026-114659/): Grav Flex Objects 1.4.0 before 1.4.17 Authorization Bypass via Pages API Routes (high 7.1)
- [CVE-2026-114658](https://insights.sbomify.com/CVE-2026-114658/): Grav Login plugin 3.6.0 before 3.9.13 Privilege Escalation via login.invite (high 8.7)
- [CVE-2026-114657](https://insights.sbomify.com/CVE-2026-114657/): Grav 2.0.0 before 2.2.5 HTTP Basic Credential Disclosure via Twig Uri (medium 6.9)
- [CVE-2026-114656](https://insights.sbomify.com/CVE-2026-114656/): Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher (medium 6.9)
- [CVE-2026-114655](https://insights.sbomify.com/CVE-2026-114655/): KMS request injection via unsanitized key vault and provider values in libmongocrypt (medium 6.0)
- [CVE-2026-114654](https://insights.sbomify.com/CVE-2026-114654/): BSON output corruption via out-of-range binary subtype bypassing UUID and OldBinary guards (medium 6.9)
- [CVE-2026-114653](https://insights.sbomify.com/CVE-2026-114653/): Silent client-side encryption bypass via unescaped field-name regex in CSFLE schema builder (high 7.1)
- [CVE-2026-114652](https://insights.sbomify.com/CVE-2026-114652/): Update operator injection via single-element list rewriting in the update builder (high 7.1)
- [CVE-2026-114651](https://insights.sbomify.com/CVE-2026-114651/): Cross-document data leak via malformed BSON array parsing in reused thread buffer (medium 6.3)
- [CVE-2026-114650](https://insights.sbomify.com/CVE-2026-114650/): Plaintext exposure of encrypted fields via ANSI code-page corruption of database name (medium 6.9)
- [CVE-2026-11465](https://insights.sbomify.com/CVE-2026-11465/): songquanpeng one-api Redemption Code Top-Up Endpoint redemption.go Redeem logic error (low 2.3)
- [CVE-2026-114649](https://insights.sbomify.com/CVE-2026-114649/): Authentication bypass via issuer-and-serial-only certificate equality in shared cluster cache (high 7.6)
- [CVE-2026-114648](https://insights.sbomify.com/CVE-2026-114648/): NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys (high 7.2)
- [CVE-2026-114647](https://insights.sbomify.com/CVE-2026-114647/): NoSQL operator injection via unvalidated replacement document in findOneAndReplace (medium 5.3)
- [CVE-2026-114646](https://insights.sbomify.com/CVE-2026-114646/): NoSQL command injection via mismatched raw BSON length prefix written verbatim to the wire (medium 6.9)
- [CVE-2026-114645](https://insights.sbomify.com/CVE-2026-114645/): Heap overflow via 32-bit length wrap of the URI username in Windows Kerberos auth message wrapping (medium 5.7)
- [CVE-2026-114644](https://insights.sbomify.com/CVE-2026-114644/): Memory-exhaustion denial of service via unbounded symbol interning during BSON/JSON deserialization (high 8.2)
- [CVE-2026-114643](https://insights.sbomify.com/CVE-2026-114643/): Duplicate geometry fields via unvalidated GeoJSON extra members (medium 5.3)
- [CVE-2026-114642](https://insights.sbomify.com/CVE-2026-114642/): Traefik before 2.11.58 and 3.7.14 TLS Config Bypass via NTLM/Kerberos Round Tripper (high 7.0)
- [CVE-2026-114641](https://insights.sbomify.com/CVE-2026-114641/): Traefik before 2.11.58 and 3.7.14 Race Condition in NTLM/Kerberos Round Tripper (medium 6.3)
- [CVE-2026-114640](https://insights.sbomify.com/CVE-2026-114640/): Traefik v3.7.0 before v3.7.14 mTLS Header Spoofing via Ingress-NGINX HTTP Router (high 7.0)
- [CVE-2026-11464](https://insights.sbomify.com/CVE-2026-11464/): JeecgBoot User List Endpoint SysUserController.java queryPageList information disclosure (low 2.3)
- [CVE-2026-114639](https://insights.sbomify.com/CVE-2026-114639/): Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool (high 7.0)
- [CVE-2026-114638](https://insights.sbomify.com/CVE-2026-114638/): Traefik v3.7.0 before v3.7.14 Client CA Mix-up via auth-tls-secret Name Collision (high 7.0)
- [CVE-2026-114637](https://insights.sbomify.com/CVE-2026-114637/): Traefik v3.2.0 before v3.7.14 FastProxy NTLM/Negotiate Connection Pool Identity Leak (high 7.0)
- [CVE-2026-114636](https://insights.sbomify.com/CVE-2026-114636/): Traefik v3.7.13 Authentication Bypass via ssl-passthrough Ingress HTTP Router (high 7.0)
- [CVE-2026-114635](https://insights.sbomify.com/CVE-2026-114635/): Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme (high 7.0)
- [CVE-2026-114634](https://insights.sbomify.com/CVE-2026-114634/): WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect (medium 5.3)
- [CVE-2026-114633](https://insights.sbomify.com/CVE-2026-114633/): WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php (high 7.0)
- [CVE-2026-11463](https://insights.sbomify.com/CVE-2026-11463/): USCiLab Cereal Shared Pointer type confusion (medium 6.3)
- [CVE-2026-114629](https://insights.sbomify.com/CVE-2026-114629/): Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. (not scored)
- [CVE-2026-114625](https://insights.sbomify.com/CVE-2026-114625/): Arista VeloCloud Orchestrator SQL Injection (critical 9.4, exploited in the wild)
- [CVE-2026-114624](https://insights.sbomify.com/CVE-2026-114624/): baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity (high 7.2)
- [CVE-2026-114623](https://insights.sbomify.com/CVE-2026-114623/): baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure (medium 6.5)
- [CVE-2026-114622](https://insights.sbomify.com/CVE-2026-114622/): baserCMS: Encoded path traversal bypass in the theme file API (high 7.2)
- [CVE-2026-114621](https://insights.sbomify.com/CVE-2026-114621/): baserCMS: SQL injection in the admin panel and admin API (high 8.8)
- [CVE-2026-114620](https://insights.sbomify.com/CVE-2026-114620/): Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF (medium 5.4)
- [CVE-2026-11462](https://insights.sbomify.com/CVE-2026-11462/): Chengdu Everbrite Network Technology BeikeShop Stripe Plugin StripeController.php callback improper authorization (medium 6.9)
- [CVE-2026-114619](https://insights.sbomify.com/CVE-2026-114619/): Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens (medium 4.6)
- [CVE-2026-114618](https://insights.sbomify.com/CVE-2026-114618/): Authlib: Default JWT bearer grant accepts assertions for the wrong audience (medium 6.8)
- [CVE-2026-114617](https://insights.sbomify.com/CVE-2026-114617/): Authlib: ID token can disable its own nonce validation via the nonce_supported claim (medium 4.2)
- [CVE-2026-114616](https://insights.sbomify.com/CVE-2026-114616/): Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512) (high 7.4)
- [CVE-2026-114615](https://insights.sbomify.com/CVE-2026-114615/): Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys (high 7.4)
- [CVE-2026-114614](https://insights.sbomify.com/CVE-2026-114614/): Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts (low 2.6)
- [CVE-2026-114613](https://insights.sbomify.com/CVE-2026-114613/): MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure (high 7.5)
- [CVE-2026-114612](https://insights.sbomify.com/CVE-2026-114612/): LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key (critical 9.9)
- [CVE-2026-114611](https://insights.sbomify.com/CVE-2026-114611/): Auth bypass in OCO-Server (critical 9.1)
- [CVE-2026-114610](https://insights.sbomify.com/CVE-2026-114610/): fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()' (medium 6.5)
- [CVE-2026-11461](https://insights.sbomify.com/CVE-2026-11461/): NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization (medium 5.3)
- [CVE-2026-114609](https://insights.sbomify.com/CVE-2026-114609/): fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content (medium 5.8)
- [CVE-2026-114608](https://insights.sbomify.com/CVE-2026-114608/): Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME (medium 5.4)
- [CVE-2026-114607](https://insights.sbomify.com/CVE-2026-114607/): better-auth: OAuth state can be used as a Magic Link to sign in as another user (critical 9.1)
- [CVE-2026-114606](https://insights.sbomify.com/CVE-2026-114606/): draw.io Desktop: Arbitrary local-file read via read-side IPC (no blessed-path gate) (medium 5.6)
- [CVE-2026-114605](https://insights.sbomify.com/CVE-2026-114605/): dnspython dns.name.from_wire_parser() excessive CPU use (high 7.5)
- [CVE-2026-114603](https://insights.sbomify.com/CVE-2026-114603/): OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api (medium 5.3)
- [CVE-2026-11460](https://insights.sbomify.com/CVE-2026-11460/): Boost Serialization improper validation of specified type of input (medium 6.3)
- [CVE-2026-1146](https://insights.sbomify.com/CVE-2026-1146/): Cross-site scripting in Patients Waiting Area Queue Management System (medium 5.1)
- [CVE-2026-114598](https://insights.sbomify.com/CVE-2026-114598/): Access of resource using incompatible type ('type confusion') in EPICS Base (high 8.7)
- [CVE-2026-114597](https://insights.sbomify.com/CVE-2026-114597/): Improper handling of length parameter inconsistency in EPICS Base (high 8.7)
- [CVE-2026-114596](https://insights.sbomify.com/CVE-2026-114596/): Integer overflow or wraparound in EPICS Base (high 8.8)
- [CVE-2026-114595](https://insights.sbomify.com/CVE-2026-114595/): Integer overflow or wraparound in EPICS Base (critical 9.3)
- [CVE-2026-11459](https://insights.sbomify.com/CVE-2026-11459/): SecureAge CatchPulse IOCTL saappctl.sys information disclosure (medium 4.8)
- [CVE-2026-114583](https://insights.sbomify.com/CVE-2026-114583/): tar filter allows writing outside destination via empty-named symlink (medium 6.9)
- [CVE-2026-11458](https://insights.sbomify.com/CVE-2026-11458/): erzhongxmu JeeWMS Boot Actuator Endpoint actuator information disclosure (medium 6.9)
- [CVE-2026-114577](https://insights.sbomify.com/CVE-2026-114577/): oretnom23 php-travel-agency-system Insertion insert.php sql injection (medium 6.9)
- [CVE-2026-114576](https://insights.sbomify.com/CVE-2026-114576/): Linksys RE6250 Web Management strcmp random values (medium 6.3)
- [CVE-2026-114575](https://insights.sbomify.com/CVE-2026-114575/): TOTOLINK A950RG product.so UploadCustomModule command injection (critical 10.0)
- [CVE-2026-114574](https://insights.sbomify.com/CVE-2026-114574/): massCodeIO massCode Local HTTP Service index.ts information disclosure (medium 5.3)
- [CVE-2026-114570](https://insights.sbomify.com/CVE-2026-114570/): WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit (medium 4.9)
- [CVE-2026-11457](https://insights.sbomify.com/CVE-2026-11457/): erzhongxmu JeeWMS JimuReport test-connection Endpoint testConnection injection (medium 6.9)
- [CVE-2026-11456](https://insights.sbomify.com/CVE-2026-11456/): Chanjet CRM HTTP GET Request jxf_dump_systable.php sql injection (medium 6.9)
- [CVE-2026-11455](https://insights.sbomify.com/CVE-2026-11455/): FoundationAgents MetaGPT common.py check_cmd_exists command injection (low 2.3)
- [CVE-2026-11454](https://insights.sbomify.com/CVE-2026-11454/): Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference (medium 6.5)
- [CVE-2026-11453](https://insights.sbomify.com/CVE-2026-11453/): Tiobon Employee Self-Service System Login Endpoint BlogSearch.aspx sql injection (medium 5.3)
- [CVE-2026-11452](https://insights.sbomify.com/CVE-2026-11452/): GL.iNet GL-MT3000 SET_USER_PWD glc FUN_0042e200 command injection (medium 6.9)
- [CVE-2026-114519](https://insights.sbomify.com/CVE-2026-114519/): Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts (high 8.6)
- [CVE-2026-114515](https://insights.sbomify.com/CVE-2026-114515/): OCO-Server: Self-Service Portal uninstall-job authorization bypass (medium 6.5)
- [CVE-2026-114510](https://insights.sbomify.com/CVE-2026-114510/): Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/908/