# Vulnerabilities published in 2026


- [CVE-2026-17191](https://insights.sbomify.com/CVE-2026-17191/): VeloCloud Orchestrator Flow Metrics API SQL Injection (high 8.5)
- [CVE-2026-1719](https://insights.sbomify.com/CVE-2026-1719/): Gravity Bookings <= 2.5.9 - Unauthenticated SQL Injection via 'category_id' Parameter (high 7.5)
- [CVE-2026-17189](https://insights.sbomify.com/CVE-2026-17189/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (high 8.2)
- [CVE-2026-17186](https://insights.sbomify.com/CVE-2026-17186/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (critical 9.9)
- [CVE-2026-17184](https://insights.sbomify.com/CVE-2026-17184/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (critical 9.8)
- [CVE-2026-17183](https://insights.sbomify.com/CVE-2026-17183/): CVE-2026-17183 CVE Record (high 7.1)
- [CVE-2026-17182](https://insights.sbomify.com/CVE-2026-17182/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (critical 9.8)
- [CVE-2026-17181](https://insights.sbomify.com/CVE-2026-17181/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (critical 9.3)
- [CVE-2026-1718](https://insights.sbomify.com/CVE-2026-1718/): IBM® Db2® is vulnerable to a denial of service with a specially crafted query when running an AUTONOMOUS procedure (high 7.1)
- [CVE-2026-17179](https://insights.sbomify.com/CVE-2026-17179/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (high 8.5)
- [CVE-2026-17177](https://insights.sbomify.com/CVE-2026-17177/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (high 7.5)
- [CVE-2026-17176](https://insights.sbomify.com/CVE-2026-17176/): OS Command Injection Vulnerability in Deco Devices (high 7.7)
- [CVE-2026-17175](https://insights.sbomify.com/CVE-2026-17175/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (high 7.5)
- [CVE-2026-17173](https://insights.sbomify.com/CVE-2026-17173/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (medium 6.5)
- [CVE-2026-17171](https://insights.sbomify.com/CVE-2026-17171/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.8)
- [CVE-2026-17170](https://insights.sbomify.com/CVE-2026-17170/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-1717](https://insights.sbomify.com/CVE-2026-1717/): Privilege escalation in Baiying (medium 6.8)
- [CVE-2026-17168](https://insights.sbomify.com/CVE-2026-17168/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.5)
- [CVE-2026-17166](https://insights.sbomify.com/CVE-2026-17166/): Missing authorization in Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar (medium 4.3)
- [CVE-2026-17165](https://insights.sbomify.com/CVE-2026-17165/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-17163](https://insights.sbomify.com/CVE-2026-17163/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-17162](https://insights.sbomify.com/CVE-2026-17162/): WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'currentPostId' Block Attribute (medium 6.4)
- [CVE-2026-17161](https://insights.sbomify.com/CVE-2026-17161/): WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute (medium 6.4)
- [CVE-2026-17160](https://insights.sbomify.com/CVE-2026-17160/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-1716](https://insights.sbomify.com/CVE-2026-1716/): Privilege escalation in Baiying (medium 6.9)
- [CVE-2026-17159](https://insights.sbomify.com/CVE-2026-17159/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-17157](https://insights.sbomify.com/CVE-2026-17157/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-17156](https://insights.sbomify.com/CVE-2026-17156/): IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs (high 7.8)
- [CVE-2026-17153](https://insights.sbomify.com/CVE-2026-17153/): Missing authorization in AI Agent by SiteGround (medium 5.3)
- [CVE-2026-17152](https://insights.sbomify.com/CVE-2026-17152/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-1715](https://insights.sbomify.com/CVE-2026-1715/): Privilege escalation in Baiying (medium 6.9)
- [CVE-2026-17149](https://insights.sbomify.com/CVE-2026-17149/): Cross-site scripting in Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred (medium 6.4)
- [CVE-2026-17145](https://insights.sbomify.com/CVE-2026-17145/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-17142](https://insights.sbomify.com/CVE-2026-17142/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-17141](https://insights.sbomify.com/CVE-2026-17141/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-1714](https://insights.sbomify.com/CVE-2026-1714/): ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action (high 8.6)
- [CVE-2026-17138](https://insights.sbomify.com/CVE-2026-17138/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.1)
- [CVE-2026-17136](https://insights.sbomify.com/CVE-2026-17136/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-17133](https://insights.sbomify.com/CVE-2026-17133/): IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs (high 7.8)
- [CVE-2026-1713](https://insights.sbomify.com/CVE-2026-1713/): IBM MQ is affected by an authority vulnerablility (medium 5.5)
- [CVE-2026-17124](https://insights.sbomify.com/CVE-2026-17124/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.8)
- [CVE-2026-17123](https://insights.sbomify.com/CVE-2026-17123/): Server-side request forgery in Royal Addons for Elementor – Addons and Templates Kit for Elementor (high 8.8)
- [CVE-2026-17122](https://insights.sbomify.com/CVE-2026-17122/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-17121](https://insights.sbomify.com/CVE-2026-17121/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-17120](https://insights.sbomify.com/CVE-2026-17120/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 5.3)
- [CVE-2026-1712](https://insights.sbomify.com/CVE-2026-1712/): Privilege escalation in Server (medium 5.8)
- [CVE-2026-17118](https://insights.sbomify.com/CVE-2026-17118/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-17113](https://insights.sbomify.com/CVE-2026-17113/): Cri-o: cri-o: unvalidated image env var causes daemon crash (medium 6.0)
- [CVE-2026-17111](https://insights.sbomify.com/CVE-2026-17111/): IBM i is Affected By Multiple Vulnerabilities in SQL (high 7.6)
- [CVE-2026-17110](https://insights.sbomify.com/CVE-2026-17110/): IBM i is Affected By Multiple Vulnerabilities in SQL (high 8.8)
- [CVE-2026-1711](https://insights.sbomify.com/CVE-2026-1711/): Cross-site scripting in Pega Infinity (medium 4.8)
- [CVE-2026-17109](https://insights.sbomify.com/CVE-2026-17109/): IBM i is Affected By Multiple Vulnerabilities in SQL (medium 4.3)
- [CVE-2026-17107](https://insights.sbomify.com/CVE-2026-17107/): Cluster-proxy: impersonation-header injection grants cluster-admin on every managed cluster (high 8.5)
- [CVE-2026-17106](https://insights.sbomify.com/CVE-2026-17106/): Tar extraction in moby/go-archive can write outside the destination directory via link following (high 7.1)
- [CVE-2026-17102](https://insights.sbomify.com/CVE-2026-17102/): DataStage on Cloud Pak for Data has several vulnerabilities (high 8.8)
- [CVE-2026-17101](https://insights.sbomify.com/CVE-2026-17101/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (high 8.3)
- [CVE-2026-17100](https://insights.sbomify.com/CVE-2026-17100/): Power System Out-of-bounds Write (high 8.2)
- [CVE-2026-1710](https://insights.sbomify.com/CVE-2026-1710/): WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax (medium 6.5)
- [CVE-2026-17099](https://insights.sbomify.com/CVE-2026-17099/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (high 7.3)
- [CVE-2026-17097](https://insights.sbomify.com/CVE-2026-17097/): Power System Improper Validation (high 7.3)
- [CVE-2026-17095](https://insights.sbomify.com/CVE-2026-17095/): IBM i is Affected By Multiple Vulnerabilities in Navigator for i (high 8.3)
- [CVE-2026-17094](https://insights.sbomify.com/CVE-2026-17094/): IBM i is Affected By Path Traversal Vulnerability in Navigator for i (medium 4.3)
- [CVE-2026-17093](https://insights.sbomify.com/CVE-2026-17093/): Power System Buffer Overflow (high 8.2)
- [CVE-2026-17092](https://insights.sbomify.com/CVE-2026-17092/): Missing authorization in Directorist: AI-Powered Business Directory, Listings & Classified Ads (high 8.1)
- [CVE-2026-17091](https://insights.sbomify.com/CVE-2026-17091/): Power System Integer Overflow (high 8.4)
- [CVE-2026-17090](https://insights.sbomify.com/CVE-2026-17090/): Cross-site scripting in Beaver Builder Page Builder – Drag and Drop Website Builder (medium 6.4)
- [CVE-2026-1709](https://insights.sbomify.com/CVE-2026-1709/): Keylime Missing Authentication for Critical Function and Improper Authentication (critical 9.4)
- [CVE-2026-17089](https://insights.sbomify.com/CVE-2026-17089/): Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter (medium 6.1)
- [CVE-2026-17088](https://insights.sbomify.com/CVE-2026-17088/): IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager (medium 4.3)
- [CVE-2026-17087](https://insights.sbomify.com/CVE-2026-17087/): Missing authorization in WP Travel Engine – Tour Booking Plugin – Tour Operator Software (high 7.5)
- [CVE-2026-17086](https://insights.sbomify.com/CVE-2026-17086/): ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content (high 8.8)
- [CVE-2026-17084](https://insights.sbomify.com/CVE-2026-17084/): stringprep.map_table_b2() deviates from RFC 3454 Table B.2 (medium 6.0)
- [CVE-2026-17083](https://insights.sbomify.com/CVE-2026-17083/): IBM i is Affected By Multiple Vulnerabilities in the Debug Server (critical 9.8)
- [CVE-2026-17082](https://insights.sbomify.com/CVE-2026-17082/): IBM i is Affected By Multiple Vulnerabilities in the Debug Server (high 8.8)
- [CVE-2026-17081](https://insights.sbomify.com/CVE-2026-17081/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (high 8.2)
- [CVE-2026-1708](https://insights.sbomify.com/CVE-2026-1708/): Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter (high 7.5)
- [CVE-2026-17079](https://insights.sbomify.com/CVE-2026-17079/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (medium 6.3)
- [CVE-2026-17078](https://insights.sbomify.com/CVE-2026-17078/): IBM i is Affected By A Denial of Service Vulnerability in DRDA / DDM [] (medium 5.3)
- [CVE-2026-17077](https://insights.sbomify.com/CVE-2026-17077/): IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM (medium 5.3)
- [CVE-2026-17076](https://insights.sbomify.com/CVE-2026-17076/): IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM (medium 5.3)
- [CVE-2026-17075](https://insights.sbomify.com/CVE-2026-17075/): IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager (medium 6.5)
- [CVE-2026-17074](https://insights.sbomify.com/CVE-2026-17074/): IBM i is Affected By Multiple Vulnerabilities in DRDA / DDM (low 3.1)
- [CVE-2026-17073](https://insights.sbomify.com/CVE-2026-17073/): IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System (medium 5.4)
- [CVE-2026-17072](https://insights.sbomify.com/CVE-2026-17072/): Memory corruption in Red Hat Enterprise Linux 10 (low 3.3)
- [CVE-2026-17071](https://insights.sbomify.com/CVE-2026-17071/): IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager (low 2.7)
- [CVE-2026-17070](https://insights.sbomify.com/CVE-2026-17070/): Vault Credential Confusion via Authorization Bypass in HAVELSAN's Liman MYS (high 8.8)
- [CVE-2026-1707](https://insights.sbomify.com/CVE-2026-1707/): Restore restriction bypass via key disclosure vulnerability (pgAdmin 4) (high 7.4)
- [CVE-2026-17069](https://insights.sbomify.com/CVE-2026-17069/): IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager (high 8.1)
- [CVE-2026-17068](https://insights.sbomify.com/CVE-2026-17068/): IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System (medium 5.4)
- [CVE-2026-17063](https://insights.sbomify.com/CVE-2026-17063/): Power System Incorrect Authorization (high 7.9)
- [CVE-2026-17061](https://insights.sbomify.com/CVE-2026-17061/): Deserialization of Untrusted Data Vulnerability in SIMULIA Execution Engine from Release 2023 through Release 2026 (critical 10.0)
- [CVE-2026-17060](https://insights.sbomify.com/CVE-2026-17060/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.1)
- [CVE-2026-1706](https://insights.sbomify.com/CVE-2026-1706/): All-in-One Video Gallery <= 4.7.1 - Reflected Cross-Site Scripting via 'vi' Parameter (medium 6.1)
- [CVE-2026-17059](https://insights.sbomify.com/CVE-2026-17059/): Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter (medium 6.5)
- [CVE-2026-17057](https://insights.sbomify.com/CVE-2026-17057/): IBM i is Affected By Denial of Service Vulnerabilities in NFS [, ] (medium 6.5)
- [CVE-2026-17054](https://insights.sbomify.com/CVE-2026-17054/): Out-of-bounds read and permanent loss of Wi-Fi reception in the ESP-hosted SPI driver's frame reassembly (medium 5.3)
- [CVE-2026-17053](https://insights.sbomify.com/CVE-2026-17053/): Missing authorization in zephyr (medium 4.4)
- [CVE-2026-17052](https://insights.sbomify.com/CVE-2026-17052/): Memory corruption in zephyr (high 7.8)
- [CVE-2026-17051](https://insights.sbomify.com/CVE-2026-17051/): Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell length (medium 6.0)
- [CVE-2026-17050](https://insights.sbomify.com/CVE-2026-17050/): Double free of the USB host configuration descriptor when device enumeration fails (medium 5.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/843/