# Vulnerabilities published in 2026


- [CVE-2026-11360](https://insights.sbomify.com/CVE-2026-11360/): SQL injection in Advanced Order Export For WooCommerce (medium 4.9)
- [CVE-2026-1136](https://insights.sbomify.com/CVE-2026-1136/): lcg0124 BootDo ContentController save cross site scripting (medium 5.1)
- [CVE-2026-113599](https://insights.sbomify.com/CVE-2026-113599/): Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation (medium 5.3)
- [CVE-2026-113598](https://insights.sbomify.com/CVE-2026-113598/): Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete (medium 5.3)
- [CVE-2026-113597](https://insights.sbomify.com/CVE-2026-113597/): Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures (medium 5.3)
- [CVE-2026-113596](https://insights.sbomify.com/CVE-2026-113596/): Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds (low 2.3)
- [CVE-2026-113595](https://insights.sbomify.com/CVE-2026-113595/): Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route (medium 5.3)
- [CVE-2026-113594](https://insights.sbomify.com/CVE-2026-113594/): Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route (medium 5.3)
- [CVE-2026-11359](https://insights.sbomify.com/CVE-2026-11359/): Missing authorization in Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration (medium 4.3)
- [CVE-2026-113583](https://insights.sbomify.com/CVE-2026-113583/): Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js (medium 5.3)
- [CVE-2026-113582](https://insights.sbomify.com/CVE-2026-113582/): Apache Abdera: XML external entity expansion in Atom document parsing (high 8.7)
- [CVE-2026-11358](https://insights.sbomify.com/CVE-2026-11358/): Cross-site scripting in Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More (medium 4.4)
- [CVE-2026-113576](https://insights.sbomify.com/CVE-2026-113576/): Adobe Digital Editions | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (medium 6.3)
- [CVE-2026-11357](https://insights.sbomify.com/CVE-2026-11357/): Information disclosure in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 4.3)
- [CVE-2026-11356](https://insights.sbomify.com/CVE-2026-11356/): Cross-site scripting in Ivory Search – WordPress Search Plugin (medium 4.4)
- [CVE-2026-11355](https://insights.sbomify.com/CVE-2026-11355/): Missing authorization in DT LMS – elearning, WordPress LMS Plugin (medium 5.3)
- [CVE-2026-11354](https://insights.sbomify.com/CVE-2026-11354/): Missing authorization in Participants Database (medium 5.3)
- [CVE-2026-11352](https://insights.sbomify.com/CVE-2026-11352/): QUIC zero-length UDP datagrams busy-loop (high 7.5)
- [CVE-2026-11351](https://insights.sbomify.com/CVE-2026-11351/): ShinyStat Analytics < 1.0.17 - Unauthenticated Non-Published Product Information Disclosure (medium 5.3)
- [CVE-2026-113507](https://insights.sbomify.com/CVE-2026-113507/): aaPanel common.py GetClientIp access control (medium 6.9)
- [CVE-2026-113506](https://insights.sbomify.com/CVE-2026-113506/): aaPanel File Manager common.py ExecShell os command injection (critical 9.4)
- [CVE-2026-113505](https://insights.sbomify.com/CVE-2026-113505/): aaPanel Download Endpoint v2.py send_file path traversal (medium 5.3)
- [CVE-2026-113501](https://insights.sbomify.com/CVE-2026-113501/): LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal (low 3.1)
- [CVE-2026-113500](https://insights.sbomify.com/CVE-2026-113500/): LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization (high 7.5)
- [CVE-2026-1135](https://insights.sbomify.com/CVE-2026-1135/): itsourcecode Society Management System activity.php cross site scripting (medium 5.3)
- [CVE-2026-113499](https://insights.sbomify.com/CVE-2026-113499/): LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting (high 7.5)
- [CVE-2026-113496](https://insights.sbomify.com/CVE-2026-113496/): Cockpit-machines: vnc console password disclosure through virt-xml command-line arguments (medium 5.0)
- [CVE-2026-113495](https://insights.sbomify.com/CVE-2026-113495/): Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments (medium 5.0)
- [CVE-2026-113494](https://insights.sbomify.com/CVE-2026-113494/): GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode (low 2.7)
- [CVE-2026-113493](https://insights.sbomify.com/CVE-2026-113493/): GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute (medium 6.8)
- [CVE-2026-113492](https://insights.sbomify.com/CVE-2026-113492/): GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action (medium 5.3)
- [CVE-2026-113491](https://insights.sbomify.com/CVE-2026-113491/): GeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal (medium 6.4)
- [CVE-2026-113490](https://insights.sbomify.com/CVE-2026-113490/): GeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint (medium 5.3)
- [CVE-2026-11349](https://insights.sbomify.com/CVE-2026-11349/): Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more (high 8.6)
- [CVE-2026-113489](https://insights.sbomify.com/CVE-2026-113489/): GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR (medium 4.3)
- [CVE-2026-113488](https://insights.sbomify.com/CVE-2026-113488/): GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute (medium 6.8)
- [CVE-2026-113487](https://insights.sbomify.com/CVE-2026-113487/): GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute (medium 6.8)
- [CVE-2026-113486](https://insights.sbomify.com/CVE-2026-113486/): Media Library Assistant < 3.42 - Trashed Attachment Deletion via CSRF (medium 6.5)
- [CVE-2026-113485](https://insights.sbomify.com/CVE-2026-113485/): Media Library Assistant < 3.42 - Bulk Attachment Deletion via CSRF (medium 6.5)
- [CVE-2026-11348](https://insights.sbomify.com/CVE-2026-11348/): Authentication Bypass in HAVELSAN's Open Source Project Liman MYS (high 8.1)
- [CVE-2026-113472](https://insights.sbomify.com/CVE-2026-113472/): Depicter 4.0.5 - 4.8.1 - Editor+ Arbitrary File Upload via Media Upload (medium 5.4)
- [CVE-2026-113470](https://insights.sbomify.com/CVE-2026-113470/): Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (medium 5.4)
- [CVE-2026-11347](https://insights.sbomify.com/CVE-2026-11347/): Hardcoded Cryptographic Keys and Weak IV Generation in linqi (high 8.5)
- [CVE-2026-113469](https://insights.sbomify.com/CVE-2026-113469/): Improper Signature Verification of Active Update Files (high 7.5)
- [CVE-2026-113468](https://insights.sbomify.com/CVE-2026-113468/): Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop) (medium 6.9)
- [CVE-2026-113466](https://insights.sbomify.com/CVE-2026-113466/): MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key (medium 6.9)
- [CVE-2026-113465](https://insights.sbomify.com/CVE-2026-113465/): Possible DOM XSS in SNS Web Administration Portal (medium 6.6)
- [CVE-2026-113461](https://insights.sbomify.com/CVE-2026-113461/): mk-oracle: Local privilege escalation via insecure Oracle Home library loading (medium 5.2)
- [CVE-2026-11346](https://insights.sbomify.com/CVE-2026-11346/): Server-Side Request Forgery (SSRF) allowing Internal Network Probing in linqi (medium 5.3)
- [CVE-2026-113459](https://insights.sbomify.com/CVE-2026-113459/): Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai) (high 7.1)
- [CVE-2026-11345](https://insights.sbomify.com/CVE-2026-11345/): Improper Authentication Bypass in linqi CDN File Access (medium 6.9)
- [CVE-2026-113442](https://insights.sbomify.com/CVE-2026-113442/): Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) (medium 5.3)
- [CVE-2026-113440](https://insights.sbomify.com/CVE-2026-113440/): HTTP/1.1 and HTTP/2 redirects resend basic_auth and cookie to a different scheme or port in hackney (medium 6.0)
- [CVE-2026-11344](https://insights.sbomify.com/CVE-2026-11344/): code-projects Vehicle Management System New Driver Registration Form newdriver.php unrestricted upload (medium 6.9)
- [CVE-2026-113438](https://insights.sbomify.com/CVE-2026-113438/): Auth bypass in Pleasanter (medium 6.9)
- [CVE-2026-113436](https://insights.sbomify.com/CVE-2026-113436/): Quadratic bignum parsing of Content-Length and Host port values in Bandit (high 8.7)
- [CVE-2026-11342](https://insights.sbomify.com/CVE-2026-11342/): code-projects Hotel and Tourism Reservation System details.php sql injection (medium 6.9)
- [CVE-2026-113411](https://insights.sbomify.com/CVE-2026-113411/): Nerimity Desktop Window Open mainWindow.js shell.openExternal improper authorization in handler for custom url scheme (medium 5.3)
- [CVE-2026-11341](https://insights.sbomify.com/CVE-2026-11341/): D-Link DWR-M920 formIMEISetup sub_412DA0 os command injection (medium 5.3)
- [CVE-2026-113409](https://insights.sbomify.com/CVE-2026-113409/): Cross-site scripting in ortto (medium 4.8)
- [CVE-2026-113407](https://insights.sbomify.com/CVE-2026-113407/): YS-infoware｜BA-Workflow - SQL Injection (high 8.7)
- [CVE-2026-113406](https://insights.sbomify.com/CVE-2026-113406/): YS-infoware｜BA-Workflow - SQL Injection (high 8.7)
- [CVE-2026-113405](https://insights.sbomify.com/CVE-2026-113405/): YS-infoware｜BA-Workflow - SQL Injection (high 8.7)
- [CVE-2026-113404](https://insights.sbomify.com/CVE-2026-113404/): Uniong｜WebITR - Insecure Deserialization (high 8.7)
- [CVE-2026-113403](https://insights.sbomify.com/CVE-2026-113403/): ArmorX Global Technology｜ArmorX Spam - Command Injection (high 7.1)
- [CVE-2026-113402](https://insights.sbomify.com/CVE-2026-113402/): ArmorX Global Technology｜ArmorX Spam - Local File Inclusion (high 7.1)
- [CVE-2026-113401](https://insights.sbomify.com/CVE-2026-113401/): Denial-of-service in the PDF Viewer component (medium 6.5)
- [CVE-2026-113400](https://insights.sbomify.com/CVE-2026-113400/): Uninitialized memory in the Audio/Video: cubeb component (medium 5.4)
- [CVE-2026-11340](https://insights.sbomify.com/CVE-2026-11340/): Authorization Bypass in HAVELSAN's Open Source Project Liman MYS (high 8.3)
- [CVE-2026-1134](https://insights.sbomify.com/CVE-2026-1134/): itsourcecode Society Management System expenses.php cross site scripting (medium 5.3)
- [CVE-2026-113399](https://insights.sbomify.com/CVE-2026-113399/): Incorrect boundary conditions in the SVG component (critical 9.8)
- [CVE-2026-113397](https://insights.sbomify.com/CVE-2026-113397/): DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection (medium 5.3)
- [CVE-2026-113396](https://insights.sbomify.com/CVE-2026-113396/): DrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection (medium 5.3)
- [CVE-2026-113395](https://insights.sbomify.com/CVE-2026-113395/): DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal (medium 5.3)
- [CVE-2026-113394](https://insights.sbomify.com/CVE-2026-113394/): DrayTek Vigor2960 mainfunction.cgi setSWMProfile path traversal (medium 5.3)
- [CVE-2026-113393](https://insights.sbomify.com/CVE-2026-113393/): DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload (medium 5.3)
- [CVE-2026-113392](https://insights.sbomify.com/CVE-2026-113392/): DrayTek Vigor2960 Apmupload mainfunction.cgi path traversal (medium 5.3)
- [CVE-2026-113391](https://insights.sbomify.com/CVE-2026-113391/): DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection (critical 9.4)
- [CVE-2026-113390](https://insights.sbomify.com/CVE-2026-113390/): DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection (critical 9.4)
- [CVE-2026-11339](https://insights.sbomify.com/CVE-2026-11339/): D-Link DWR-M920 formUSSDSetup sub_41CF20 command injection (medium 5.3)
- [CVE-2026-113389](https://insights.sbomify.com/CVE-2026-113389/): DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection (critical 9.4)
- [CVE-2026-113388](https://insights.sbomify.com/CVE-2026-113388/): opensource-socialnetwork Cache Settings dynamic.php input code injection (medium 4.8)
- [CVE-2026-113387](https://insights.sbomify.com/CVE-2026-113387/): Missing authorization in ortto (high 8.6)
- [CVE-2026-113386](https://insights.sbomify.com/CVE-2026-113386/): Command injection in Webmail (high 7.1)
- [CVE-2026-113385](https://insights.sbomify.com/CVE-2026-113385/): LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components (medium 4.8)
- [CVE-2026-113384](https://insights.sbomify.com/CVE-2026-113384/): Optimal IdM OptimalCloud social redirect (medium 5.3)
- [CVE-2026-113383](https://insights.sbomify.com/CVE-2026-113383/): Optimal IdM OptimalCloud Login cross site scripting (medium 5.3)
- [CVE-2026-113382](https://insights.sbomify.com/CVE-2026-113382/): arizu-id fast-tunnel Plugin Installer api_plugins.php extractTo unrestricted upload (medium 5.3)
- [CVE-2026-113381](https://insights.sbomify.com/CVE-2026-113381/): Osclass Item Model Item.php findUserItems sql injection (medium 6.9)
- [CVE-2026-113380](https://insights.sbomify.com/CVE-2026-113380/): Denial of service in RingRTC (critical 9.3)
- [CVE-2026-11338](https://insights.sbomify.com/CVE-2026-11338/): SourceCodester Ship Ferry Ticket Reservation System manage_user cross site scripting (medium 4.8)
- [CVE-2026-113378](https://insights.sbomify.com/CVE-2026-113378/): mcollina mcp-ripgrep Advanced Search Tool index.ts os command injection (medium 4.8)
- [CVE-2026-11337](https://insights.sbomify.com/CVE-2026-11337/): tittuvarghese CollegeManagementSystem fetch.php cross site scripting (medium 5.3)
- [CVE-2026-11336](https://insights.sbomify.com/CVE-2026-11336/): tittuvarghese CollegeManagementSystem Admin admin_page.php improper authorization (medium 5.3)
- [CVE-2026-113359](https://insights.sbomify.com/CVE-2026-113359/): Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint (medium 5.3)
- [CVE-2026-113358](https://insights.sbomify.com/CVE-2026-113358/): LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes (high 8.7)
- [CVE-2026-113357](https://insights.sbomify.com/CVE-2026-113357/): @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker (medium 5.1)
- [CVE-2026-113356](https://insights.sbomify.com/CVE-2026-113356/): DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition (high 7.7)
- [CVE-2026-113355](https://insights.sbomify.com/CVE-2026-113355/): Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links (medium 4.8)
- [CVE-2026-113354](https://insights.sbomify.com/CVE-2026-113354/): Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/914/