# Vulnerabilities published in 2026


- [CVE-2026-110032](https://insights.sbomify.com/CVE-2026-110032/): Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor (medium 5.5)
- [CVE-2026-110031](https://insights.sbomify.com/CVE-2026-110031/): Privilege escalation in Salon Booking System (high 7.2)
- [CVE-2026-110030](https://insights.sbomify.com/CVE-2026-110030/): Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration (medium 5.3)
- [CVE-2026-11003](https://insights.sbomify.com/CVE-2026-11003/): Use after free in Chrome (high 8.8)
- [CVE-2026-110029](https://insights.sbomify.com/CVE-2026-110029/): Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment (medium 5.4)
- [CVE-2026-110026](https://insights.sbomify.com/CVE-2026-110026/): Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion (medium 4.9)
- [CVE-2026-110025](https://insights.sbomify.com/CVE-2026-110025/): slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload (medium 6.9)
- [CVE-2026-110024](https://insights.sbomify.com/CVE-2026-110024/): @fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults (medium 6.8)
- [CVE-2026-110020](https://insights.sbomify.com/CVE-2026-110020/): Missing authorization in Rich Showcase for Google Reviews (medium 6.5)
- [CVE-2026-11002](https://insights.sbomify.com/CVE-2026-11002/): Use after free in Chrome (high 8.3)
- [CVE-2026-110019](https://insights.sbomify.com/CVE-2026-110019/): Missing authorization in Bulk Page Generator – LPagery (medium 4.3)
- [CVE-2026-110018](https://insights.sbomify.com/CVE-2026-110018/): aBlocks <= 2.17.0 - Authenticated (Contributor+) Privilege Escalation to 'roleSlug' Block Attribute (high 8.8)
- [CVE-2026-110017](https://insights.sbomify.com/CVE-2026-110017/): Cross-site scripting in Quick PayPal Payments: Payment Button & Form (medium 6.4)
- [CVE-2026-110015](https://insights.sbomify.com/CVE-2026-110015/): Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF (high 8.8)
- [CVE-2026-110014](https://insights.sbomify.com/CVE-2026-110014/): Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status (medium 5.3)
- [CVE-2026-110013](https://insights.sbomify.com/CVE-2026-110013/): Salon Booking System < 10.31.9 - Unauthenticated Salon REST API Access via Predictable Access-Token (medium 4.8)
- [CVE-2026-110012](https://insights.sbomify.com/CVE-2026-110012/): Salon Booking System < 10.31.3 - Subscriber+ Booking PII Disclosure via REST bookings/upcoming (medium 4.3)
- [CVE-2026-110011](https://insights.sbomify.com/CVE-2026-110011/): Missing authorization in MB Custom Post Types & Custom Taxonomies (low 2.7)
- [CVE-2026-110010](https://insights.sbomify.com/CVE-2026-110010/): MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter (medium 4.8)
- [CVE-2026-11001](https://insights.sbomify.com/CVE-2026-11001/): Other in Chrome (medium 4.2)
- [CVE-2026-110008](https://insights.sbomify.com/CVE-2026-110008/): @fastify/oauth2 vulnerable to Login CSRF via OAuth state cookie not cleared after callback (medium 4.2)
- [CVE-2026-110005](https://insights.sbomify.com/CVE-2026-110005/): Moghtech Komodo contains an OS command injection vulnerability (high 8.8)
- [CVE-2026-110002](https://insights.sbomify.com/CVE-2026-110002/): Snazzy Social Media Feed <= 2.5 - Unauthenticated Arbitrary File Upload via 'pluginURL' Parameter (critical 9.8)
- [CVE-2026-11000](https://insights.sbomify.com/CVE-2026-11000/): Use after free in Chrome (high 8.8)
- [CVE-2026-109999](https://insights.sbomify.com/CVE-2026-109999/): AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter (high 7.2)
- [CVE-2026-109998](https://insights.sbomify.com/CVE-2026-109998/): Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX (high 7.2)
- [CVE-2026-109995](https://insights.sbomify.com/CVE-2026-109995/): Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content (high 7.2)
- [CVE-2026-109990](https://insights.sbomify.com/CVE-2026-109990/): Cross-site scripting in Flying Scripts: Delay JavaScript to Improve Site Speed & Performance (high 7.2)
- [CVE-2026-10999](https://insights.sbomify.com/CVE-2026-10999/): Integer overflow in Chrome (medium 5.3)
- [CVE-2026-109989](https://insights.sbomify.com/CVE-2026-109989/): Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter (medium 6.4)
- [CVE-2026-109988](https://insights.sbomify.com/CVE-2026-109988/): Cross-site scripting in Product Addons for Woocommerce – Product Options with Custom Fields (medium 4.4)
- [CVE-2026-109987](https://insights.sbomify.com/CVE-2026-109987/): PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie (high 7.2)
- [CVE-2026-109985](https://insights.sbomify.com/CVE-2026-109985/): Cross-site scripting in xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN (medium 6.4)
- [CVE-2026-109983](https://insights.sbomify.com/CVE-2026-109983/): YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter (medium 6.4)
- [CVE-2026-109982](https://insights.sbomify.com/CVE-2026-109982/): MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration (medium 4.2)
- [CVE-2026-109980](https://insights.sbomify.com/CVE-2026-109980/): Missing authorization in Related Posts for WordPress (medium 4.3)
- [CVE-2026-10998](https://insights.sbomify.com/CVE-2026-10998/): Memory corruption in Chrome (medium 4.0)
- [CVE-2026-109979](https://insights.sbomify.com/CVE-2026-109979/): Missing authorization in Related Posts for WordPress (medium 4.3)
- [CVE-2026-109978](https://insights.sbomify.com/CVE-2026-109978/): Cross-site scripting in Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox (medium 6.4)
- [CVE-2026-109976](https://insights.sbomify.com/CVE-2026-109976/): Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection (medium 4.7)
- [CVE-2026-109975](https://insights.sbomify.com/CVE-2026-109975/): Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute (medium 6.4)
- [CVE-2026-109974](https://insights.sbomify.com/CVE-2026-109974/): Cross-site scripting in All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos (medium 6.4)
- [CVE-2026-109972](https://insights.sbomify.com/CVE-2026-109972/): s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute (medium 6.4)
- [CVE-2026-109971](https://insights.sbomify.com/CVE-2026-109971/): Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool (medium 4.7)
- [CVE-2026-109970](https://insights.sbomify.com/CVE-2026-109970/): Clevis: clevis: pkcs#11 token pin written to world-readable file (medium 4.7)
- [CVE-2026-10997](https://insights.sbomify.com/CVE-2026-10997/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-109969](https://insights.sbomify.com/CVE-2026-109969/): Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask (medium 4.7)
- [CVE-2026-109968](https://insights.sbomify.com/CVE-2026-109968/): Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file (medium 5.5)
- [CVE-2026-109967](https://insights.sbomify.com/CVE-2026-109967/): yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats (high 8.7)
- [CVE-2026-109966](https://insights.sbomify.com/CVE-2026-109966/): yt-dlp-web-ui through 4.0.0 Argument Injection via Service.Formats JSON-RPC Method (medium 6.9)
- [CVE-2026-109965](https://insights.sbomify.com/CVE-2026-109965/): Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root (high 8.4)
- [CVE-2026-109964](https://insights.sbomify.com/CVE-2026-109964/): ImageMagick before 7.1.2-33 and 6.9.13-58 Heap Buffer Underwrite in PICT Decoder (medium 6.3)
- [CVE-2026-109963](https://insights.sbomify.com/CVE-2026-109963/): Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php (medium 5.3)
- [CVE-2026-109962](https://insights.sbomify.com/CVE-2026-109962/): Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API (medium 5.3)
- [CVE-2026-109961](https://insights.sbomify.com/CVE-2026-109961/): Froxlor 0.10.0 before 2.3.14 Newline Injection via Ftps.add additional_members (high 8.4)
- [CVE-2026-109960](https://insights.sbomify.com/CVE-2026-109960/): Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value (high 8.7)
- [CVE-2026-10996](https://insights.sbomify.com/CVE-2026-10996/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-109959](https://insights.sbomify.com/CVE-2026-109959/): EspoCRM 4.0.0 before 10.0.7 Field-Level Security Bypass via Note Read Endpoint (medium 5.3)
- [CVE-2026-109958](https://insights.sbomify.com/CVE-2026-109958/): EspoCRM 4.0.0 before 10.0.7 Field-Level Access Bypass via Address-Book Search (medium 5.3)
- [CVE-2026-109957](https://insights.sbomify.com/CVE-2026-109957/): EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter (medium 5.3)
- [CVE-2026-109956](https://insights.sbomify.com/CVE-2026-109956/): NLTK through 3.10.3 Path Traversal via WekaClassifier Model Path (high 8.3)
- [CVE-2026-109955](https://insights.sbomify.com/CVE-2026-109955/): Hono 4.12.4 before 4.13.11 Middleware Bypass via serveStatic Double Decoding (medium 6.9)
- [CVE-2026-109954](https://insights.sbomify.com/CVE-2026-109954/): Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference (high 8.3)
- [CVE-2026-109953](https://insights.sbomify.com/CVE-2026-109953/): FreeRDP 3.0.0 before 3.32.0 Cleartext Credential Disclosure via /restricted-admin (medium 6.0)
- [CVE-2026-109952](https://insights.sbomify.com/CVE-2026-109952/): FreeRDP 3.0.0 before 3.32.0 Security Protocol Downgrade via Negotiation Response (medium 6.0)
- [CVE-2026-109951](https://insights.sbomify.com/CVE-2026-109951/): FreeRDP 3.17.1 before 3.32.0 Heap Buffer Over-Read via Proxy DRDYNVC Channel Name (medium 6.9)
- [CVE-2026-109950](https://insights.sbomify.com/CVE-2026-109950/): FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via RD Gateway Messages (medium 5.3)
- [CVE-2026-10995](https://insights.sbomify.com/CVE-2026-10995/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-109949](https://insights.sbomify.com/CVE-2026-109949/): FreeRDP 3.0.0 before 3.32.0 PIN Brute-Force via Virtual Smartcard (high 7.1)
- [CVE-2026-109948](https://insights.sbomify.com/CVE-2026-109948/): FreeRDP 3.0.0 before 3.32.0 Memory Disclosure via SCardTransmit Smartcard Redirection (medium 5.3)
- [CVE-2026-109947](https://insights.sbomify.com/CVE-2026-109947/): FreeRDP 3.20.1 before 3.32.0 Unbounded Allocation via drive_process_irp_read (high 7.1)
- [CVE-2026-109946](https://insights.sbomify.com/CVE-2026-109946/): FreeRDP 3.11.0 before 3.32.0 Reachable Assertion via AVC444 Odd Region Width (high 7.1)
- [CVE-2026-109945](https://insights.sbomify.com/CVE-2026-109945/): FreeRDP 3.0.0 before 3.32.0 Smartcard Use-After-Free via Concurrent Disconnect and Transmit (medium 6.0)
- [CVE-2026-109944](https://insights.sbomify.com/CVE-2026-109944/): FreeRDP 3.0.0 before 3.32.0 Reachable Assertion via Stale Smartcard Handle (high 7.1)
- [CVE-2026-109943](https://insights.sbomify.com/CVE-2026-109943/): FreeRDP 3.29.0 before 3.32.0 Double Free via Async-Update Polygon Order (high 7.1)
- [CVE-2026-109942](https://insights.sbomify.com/CVE-2026-109942/): FreeRDP 2.3.0 before 3.32.0 NULL Pointer Dereference via RD Gateway Close Channel Packet (high 7.1)
- [CVE-2026-109941](https://insights.sbomify.com/CVE-2026-109941/): FreeRDP 2.3.0 before 3.32.0 Infinite Loop via RD Gateway Chunked Response (high 7.1)
- [CVE-2026-109940](https://insights.sbomify.com/CVE-2026-109940/): FreeRDP 3.0.0-beta1 before 3.32.0 Stack Buffer Overflow via PKCS#11 Key Name (medium 5.1)
- [CVE-2026-10994](https://insights.sbomify.com/CVE-2026-10994/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-109939](https://insights.sbomify.com/CVE-2026-109939/): FreeRDP 3.27.1 before 3.32.0 NULL Pointer Dereference via Cache Bitmap V3 Order (high 7.1)
- [CVE-2026-109938](https://insights.sbomify.com/CVE-2026-109938/): FreeRDP 3.11.0 before 3.32.0 Integer Overflow via Mapped Video Geometry Update (high 7.1)
- [CVE-2026-109937](https://insights.sbomify.com/CVE-2026-109937/): Otter Blocks < 3.2.3 - Unauthenticated Open Redirect via Stripe Checkout Block (medium 5.4)
- [CVE-2026-109936](https://insights.sbomify.com/CVE-2026-109936/): Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter (high 7.5)
- [CVE-2026-109935](https://insights.sbomify.com/CVE-2026-109935/): Otter Blocks < 3.2.8 - Unauthenticated Restricted Block Content Disclosure via REST API (medium 5.3)
- [CVE-2026-109934](https://insights.sbomify.com/CVE-2026-109934/): Otter Blocks 3.1.1 - 3.2.7 - Unauthenticated Non-Public Content Disclosure via REST API (medium 5.3)
- [CVE-2026-109933](https://insights.sbomify.com/CVE-2026-109933/): Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes (medium 6.8)
- [CVE-2026-109932](https://insights.sbomify.com/CVE-2026-109932/): undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering (medium 5.9)
- [CVE-2026-109931](https://insights.sbomify.com/CVE-2026-109931/): Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update (low 3.7)
- [CVE-2026-109930](https://insights.sbomify.com/CVE-2026-109930/): MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key (medium 5.3)
- [CVE-2026-10993](https://insights.sbomify.com/CVE-2026-10993/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-109927](https://insights.sbomify.com/CVE-2026-109927/): CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role (high 7.2)
- [CVE-2026-109926](https://insights.sbomify.com/CVE-2026-109926/): Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation (medium 4.3)
- [CVE-2026-109924](https://insights.sbomify.com/CVE-2026-109924/): undici vulnerable to Denial of Service via unbounded memory in the EventSource parser (medium 5.9)
- [CVE-2026-10992](https://insights.sbomify.com/CVE-2026-10992/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-10991](https://insights.sbomify.com/CVE-2026-10991/): Use after free in Chrome (high 8.8)
- [CVE-2026-109901](https://insights.sbomify.com/CVE-2026-109901/): WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-10990](https://insights.sbomify.com/CVE-2026-10990/): Use after free in Chrome (high 8.3)
- [CVE-2026-1099](https://insights.sbomify.com/CVE-2026-1099/): Cross-site scripting in Administrative Shortcodes (medium 6.4)
- [CVE-2026-109898](https://insights.sbomify.com/CVE-2026-109898/): WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-109897](https://insights.sbomify.com/CVE-2026-109897/): WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/939/