# Vulnerabilities published in 2026


- [CVE-2026-10242](https://insights.sbomify.com/CVE-2026-10242/): itsourcecode Content Management System instructions.php sql injection (medium 5.3)
- [CVE-2026-102414](https://insights.sbomify.com/CVE-2026-102414/): pbkdf2 rehashes long passwords on every iteration, enabling denial of service (medium 6.3)
- [CVE-2026-102413](https://insights.sbomify.com/CVE-2026-102413/): Uncaught Exception in Elastic Endpoint Leading to Denial of Service (medium 6.2)
- [CVE-2026-102412](https://insights.sbomify.com/CVE-2026-102412/): Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure (medium 6.5)
- [CVE-2026-102411](https://insights.sbomify.com/CVE-2026-102411/): Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-102410](https://insights.sbomify.com/CVE-2026-102410/): Missing Authorization in Kibana Leading to Information Disclosure (medium 4.3)
- [CVE-2026-10241](https://insights.sbomify.com/CVE-2026-10241/): Server-side request forgery in The server processes these URLs (medium 5.3)
- [CVE-2026-102409](https://insights.sbomify.com/CVE-2026-102409/): Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-102408](https://insights.sbomify.com/CVE-2026-102408/): Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service (medium 4.3)
- [CVE-2026-102407](https://insights.sbomify.com/CVE-2026-102407/): Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification (medium 5.4)
- [CVE-2026-102406](https://insights.sbomify.com/CVE-2026-102406/): Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception (high 8.8)
- [CVE-2026-102404](https://insights.sbomify.com/CVE-2026-102404/): Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service (medium 6.5)
- [CVE-2026-102402](https://insights.sbomify.com/CVE-2026-102402/): Cross-site scripting in Team – Team Members Showcase Plugin (medium 6.4)
- [CVE-2026-102401](https://insights.sbomify.com/CVE-2026-102401/): Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute (medium 6.4)
- [CVE-2026-10240](https://insights.sbomify.com/CVE-2026-10240/): JeecgBoot test server-side request forgery (medium 5.3)
- [CVE-2026-102399](https://insights.sbomify.com/CVE-2026-102399/): WordPress Photo Gallery by Supsystic plugin <= 1.21.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2026-102398](https://insights.sbomify.com/CVE-2026-102398/): WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-102397](https://insights.sbomify.com/CVE-2026-102397/): WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-102396](https://insights.sbomify.com/CVE-2026-102396/): WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-102395](https://insights.sbomify.com/CVE-2026-102395/): WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-102394](https://insights.sbomify.com/CVE-2026-102394/): WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-102393](https://insights.sbomify.com/CVE-2026-102393/): WordPress Starter Templates plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-102392](https://insights.sbomify.com/CVE-2026-102392/): Deserialization in Extra Product Options For WooCommerce | Custom Product Addons and Fields (high 7.2)
- [CVE-2026-102391](https://insights.sbomify.com/CVE-2026-102391/): WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-102390](https://insights.sbomify.com/CVE-2026-102390/): WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-10239](https://insights.sbomify.com/CVE-2026-10239/): JeecgBoot edit WordUtil.addImage server-side request forgery (medium 5.3)
- [CVE-2026-102389](https://insights.sbomify.com/CVE-2026-102389/): WordPress Broken Link Checker plugin <= 2.4.14.1 - Content Injection vulnerability (medium 6.5)
- [CVE-2026-102388](https://insights.sbomify.com/CVE-2026-102388/): WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-102387](https://insights.sbomify.com/CVE-2026-102387/): WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-102386](https://insights.sbomify.com/CVE-2026-102386/): WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-102385](https://insights.sbomify.com/CVE-2026-102385/): WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-102384](https://insights.sbomify.com/CVE-2026-102384/): WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2026-102383](https://insights.sbomify.com/CVE-2026-102383/): WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-102382](https://insights.sbomify.com/CVE-2026-102382/): WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2026-102381](https://insights.sbomify.com/CVE-2026-102381/): WordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-102379](https://insights.sbomify.com/CVE-2026-102379/): WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability (high 8.5)
- [CVE-2026-102378](https://insights.sbomify.com/CVE-2026-102378/): WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-102377](https://insights.sbomify.com/CVE-2026-102377/): WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2026-102376](https://insights.sbomify.com/CVE-2026-102376/): WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-102375](https://insights.sbomify.com/CVE-2026-102375/): WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-102374](https://insights.sbomify.com/CVE-2026-102374/): GestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector (medium 5.3)
- [CVE-2026-102373](https://insights.sbomify.com/CVE-2026-102373/): GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter (high 7.1)
- [CVE-2026-102372](https://insights.sbomify.com/CVE-2026-102372/): GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector (medium 5.3)
- [CVE-2026-102371](https://insights.sbomify.com/CVE-2026-102371/): wsl-pro-service: Ubuntu Pro token exposed via process command-line arguments (medium 5.7)
- [CVE-2026-102370](https://insights.sbomify.com/CVE-2026-102370/): Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71 (medium 5.4)
- [CVE-2026-10237](https://insights.sbomify.com/CVE-2026-10237/): SourceCodester Water Billing Management System User Management manage_user sql injection (medium 5.1)
- [CVE-2026-102369](https://insights.sbomify.com/CVE-2026-102369/): Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200 (high 8.7)
- [CVE-2026-102368](https://insights.sbomify.com/CVE-2026-102368/): Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware (medium 5.4)
- [CVE-2026-102367](https://insights.sbomify.com/CVE-2026-102367/): mall4j through 4.0 Insufficient Session Expiration via Token Refresh (medium 5.3)
- [CVE-2026-102366](https://insights.sbomify.com/CVE-2026-102366/): mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints (low 2.1)
- [CVE-2026-102365](https://insights.sbomify.com/CVE-2026-102365/): mall4j through 4.0 Missing Authorization in Admin User Address Endpoints (high 7.1)
- [CVE-2026-102364](https://insights.sbomify.com/CVE-2026-102364/): mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API (medium 5.3)
- [CVE-2026-102363](https://insights.sbomify.com/CVE-2026-102363/): mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number (medium 6.3)
- [CVE-2026-102362](https://insights.sbomify.com/CVE-2026-102362/): mall4j through 4.0 Missing Authentication in Product Review Deletion (medium 6.9)
- [CVE-2026-102361](https://insights.sbomify.com/CVE-2026-102361/): mall4j through 4.0 Missing Authentication in Password Update Endpoint (critical 9.3)
- [CVE-2026-102360](https://insights.sbomify.com/CVE-2026-102360/): lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory (high 8.6)
- [CVE-2026-10236](https://insights.sbomify.com/CVE-2026-10236/): SourceCodester Water Billing Management System User Management Endpoint Users.php save improper authorization (medium 6.9)
- [CVE-2026-102354](https://insights.sbomify.com/CVE-2026-102354/): BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker (medium 6.8)
- [CVE-2026-10235](https://insights.sbomify.com/CVE-2026-10235/): CodeAstro Ingredients Stock Management System stock_manager.php sql injection (medium 5.3)
- [CVE-2026-102342](https://insights.sbomify.com/CVE-2026-102342/): ammonia allows stored XSS through unsanitized SVG animate and set attributes (medium 5.4)
- [CVE-2026-10234](https://insights.sbomify.com/CVE-2026-10234/): Mettle sendportal Campaign webview cross site scripting (medium 5.1)
- [CVE-2026-102335](https://insights.sbomify.com/CVE-2026-102335/): Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config (high 7.1)
- [CVE-2026-102334](https://insights.sbomify.com/CVE-2026-102334/): Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection (critical 9.1)
- [CVE-2026-102333](https://insights.sbomify.com/CVE-2026-102333/): httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL (medium 5.3)
- [CVE-2026-102332](https://insights.sbomify.com/CVE-2026-102332/): Dozzle before 11.1.2 Path Traversal via Log ZIP Download (medium 4.6)
- [CVE-2026-102331](https://insights.sbomify.com/CVE-2026-102331/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-102330](https://insights.sbomify.com/CVE-2026-102330/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-10233](https://insights.sbomify.com/CVE-2026-10233/): Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp read_sequence_infos out-of-bounds (medium 4.8)
- [CVE-2026-102329](https://insights.sbomify.com/CVE-2026-102329/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2026-102328](https://insights.sbomify.com/CVE-2026-102328/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-102327](https://insights.sbomify.com/CVE-2026-102327/): Missing authorization in Chrome (high 7.5)
- [CVE-2026-102326](https://insights.sbomify.com/CVE-2026-102326/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-102325](https://insights.sbomify.com/CVE-2026-102325/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-102324](https://insights.sbomify.com/CVE-2026-102324/): Use after free in Chrome (high 8.3)
- [CVE-2026-102323](https://insights.sbomify.com/CVE-2026-102323/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-102322](https://insights.sbomify.com/CVE-2026-102322/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-102321](https://insights.sbomify.com/CVE-2026-102321/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-102320](https://insights.sbomify.com/CVE-2026-102320/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-10232](https://insights.sbomify.com/CVE-2026-10232/): Assimp ASE File scene.cpp ~aiNode use after free (medium 4.8)
- [CVE-2026-102319](https://insights.sbomify.com/CVE-2026-102319/): Information disclosure in Chrome (low 3.4)
- [CVE-2026-102318](https://insights.sbomify.com/CVE-2026-102318/): Memory corruption in Chrome (medium 4.7)
- [CVE-2026-102317](https://insights.sbomify.com/CVE-2026-102317/): Privilege escalation in Chrome (high 8.6)
- [CVE-2026-102316](https://insights.sbomify.com/CVE-2026-102316/): Use after free in Chrome (critical 9.6)
- [CVE-2026-102315](https://insights.sbomify.com/CVE-2026-102315/): Information disclosure in Chrome (low 3.4)
- [CVE-2026-102314](https://insights.sbomify.com/CVE-2026-102314/): Other in Chrome (medium 5.4)
- [CVE-2026-102313](https://insights.sbomify.com/CVE-2026-102313/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-102312](https://insights.sbomify.com/CVE-2026-102312/): Other in Chrome (medium 4.3)
- [CVE-2026-102311](https://insights.sbomify.com/CVE-2026-102311/): Information disclosure in Chrome (low 3.4)
- [CVE-2026-102310](https://insights.sbomify.com/CVE-2026-102310/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-10231](https://insights.sbomify.com/CVE-2026-10231/): Assimp Half-Life 1 MDL Loader HL1MDLLoader.cpp extract_anim_value heap-based overflow (medium 4.8)
- [CVE-2026-102309](https://insights.sbomify.com/CVE-2026-102309/): Use after free in Chrome (critical 9.6)
- [CVE-2026-102308](https://insights.sbomify.com/CVE-2026-102308/): Use after free in Chrome (critical 9.6)
- [CVE-2026-102307](https://insights.sbomify.com/CVE-2026-102307/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-102306](https://insights.sbomify.com/CVE-2026-102306/): Use after free in Chrome (critical 9.6)
- [CVE-2026-102305](https://insights.sbomify.com/CVE-2026-102305/): Other in Chrome (medium 5.4)
- [CVE-2026-102304](https://insights.sbomify.com/CVE-2026-102304/): Use after free in Chrome (critical 9.6)
- [CVE-2026-102303](https://insights.sbomify.com/CVE-2026-102303/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-102302](https://insights.sbomify.com/CVE-2026-102302/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-102301](https://insights.sbomify.com/CVE-2026-102301/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-102300](https://insights.sbomify.com/CVE-2026-102300/): Information disclosure in Chrome (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/986/