# Vulnerabilities published in 2026


- [CVE-2026-1705](https://insights.sbomify.com/CVE-2026-1705/): D-Link DSL-6641K Web ad_virtual_server_vdsl cross site scripting (medium 4.8)
- [CVE-2026-17048](https://insights.sbomify.com/CVE-2026-17048/): Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api (medium 5.5)
- [CVE-2026-17047](https://insights.sbomify.com/CVE-2026-17047/): IBM Db2 Mirror for i is vulnerable to Cross-Site Request Forgery [] (medium 5.4)
- [CVE-2026-17045](https://insights.sbomify.com/CVE-2026-17045/): IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager (high 8.1)
- [CVE-2026-17044](https://insights.sbomify.com/CVE-2026-17044/): WordPress File Upload < 5.1.8 - Unauthenticated SQL Injection via uniqueuploadid (high 8.6)
- [CVE-2026-17043](https://insights.sbomify.com/CVE-2026-17043/): IBM i is Affected By Multiple Vulnerabilities in Digital Certificate Manager (low 3.8)
- [CVE-2026-17042](https://insights.sbomify.com/CVE-2026-17042/): Power System Out-of-bounds Read (high 7.3)
- [CVE-2026-17040](https://insights.sbomify.com/CVE-2026-17040/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-1704](https://insights.sbomify.com/CVE-2026-1704/): Missing authorization in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin (medium 4.3)
- [CVE-2026-17039](https://insights.sbomify.com/CVE-2026-17039/): Missing authorization in Red Hat Certificate System 10 (low 3.1)
- [CVE-2026-17038](https://insights.sbomify.com/CVE-2026-17038/): Use of Hard-coded Credentials in drEryk Gabinet (medium 6.9)
- [CVE-2026-17037](https://insights.sbomify.com/CVE-2026-17037/): Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter (high 7.2)
- [CVE-2026-17033](https://insights.sbomify.com/CVE-2026-17033/): CVE-2026-17033 CVE Record (medium 6.8)
- [CVE-2026-17032](https://insights.sbomify.com/CVE-2026-17032/): Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server (critical 9.8)
- [CVE-2026-17031](https://insights.sbomify.com/CVE-2026-17031/): Missing authorization in Checkout Field Manager (Checkout Manager) for WooCommerce (high 8.1)
- [CVE-2026-1703](https://insights.sbomify.com/CVE-2026-1703/): Limited path traversal when installing wheel archives (low 2.0)
- [CVE-2026-17029](https://insights.sbomify.com/CVE-2026-17029/): IBM i is Affected By Multiple Vulnerabilities in Java Secure Sockets Extension (high 8.8)
- [CVE-2026-17028](https://insights.sbomify.com/CVE-2026-17028/): Power System Out-of-bounds Read (medium 6.5)
- [CVE-2026-17025](https://insights.sbomify.com/CVE-2026-17025/): Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields (medium 6.4)
- [CVE-2026-17024](https://insights.sbomify.com/CVE-2026-17024/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.7)
- [CVE-2026-17023](https://insights.sbomify.com/CVE-2026-17023/): Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback (medium 4.8)
- [CVE-2026-17022](https://insights.sbomify.com/CVE-2026-17022/): Salon Booking System – Free Version < 10.30.34 - Unauthenticated Booking Information Disclosure via Booking Wizard (high 7.5)
- [CVE-2026-17021](https://insights.sbomify.com/CVE-2026-17021/): Salon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering (medium 5.3)
- [CVE-2026-17020](https://insights.sbomify.com/CVE-2026-17020/): Salon Booking System – Free Version <= 10.31.0 - Subscriber+ Arbitrary Booking PII Disclosure (medium 4.3)
- [CVE-2026-1702](https://insights.sbomify.com/CVE-2026-1702/): SourceCodester Pet Grooming Management Software User Management user.php improper authorization (medium 5.3)
- [CVE-2026-17019](https://insights.sbomify.com/CVE-2026-17019/): JetEngine < 3.8.13.1 - Unauthenticated Stored XSS via Form File Upload (SVG) (medium 6.1)
- [CVE-2026-17018](https://insights.sbomify.com/CVE-2026-17018/): CubeWP Framework <= 1.1.30 - Contributor+ Arbitrary Post and User Meta Disclosure via IDOR (medium 4.9)
- [CVE-2026-17017](https://insights.sbomify.com/CVE-2026-17017/): CubeWP Framework < 1.1.31 - Subscriber+ SQL Injection via cubewp_remove_relation (high 8.1)
- [CVE-2026-17016](https://insights.sbomify.com/CVE-2026-17016/): Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via PDT Underpayment (low 3.7)
- [CVE-2026-17015](https://insights.sbomify.com/CVE-2026-17015/): IBM i Denial of Service (medium 5.4)
- [CVE-2026-17014](https://insights.sbomify.com/CVE-2026-17014/): WP Photo Album Plus < 9.2.07.002 - Unauthenticated Export ZIP File Deletion via delexportzips (medium 5.3)
- [CVE-2026-17013](https://insights.sbomify.com/CVE-2026-17013/): WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart (medium 6.1)
- [CVE-2026-17012](https://insights.sbomify.com/CVE-2026-17012/): Restore PayPal Standard for WooCommerce <= 3.1.0 - Payment Bypass via Unvalidated receiver_email (medium 5.3)
- [CVE-2026-17011](https://insights.sbomify.com/CVE-2026-17011/): Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection (low 3.8)
- [CVE-2026-17010](https://insights.sbomify.com/CVE-2026-17010/): Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta (medium 5.4)
- [CVE-2026-1701](https://insights.sbomify.com/CVE-2026-1701/): itsourcecode School Management System index.php sql injection (medium 6.9)
- [CVE-2026-17009](https://insights.sbomify.com/CVE-2026-17009/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 4.7)
- [CVE-2026-17008](https://insights.sbomify.com/CVE-2026-17008/): Quick PayPal Payments <= 5.7.50 - Unauthenticated Payment Bypass via PayPal IPN (medium 5.3)
- [CVE-2026-17007](https://insights.sbomify.com/CVE-2026-17007/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 6.7)
- [CVE-2026-17006](https://insights.sbomify.com/CVE-2026-17006/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.3)
- [CVE-2026-17005](https://insights.sbomify.com/CVE-2026-17005/): Horizontal Scrolling Announcements <= 2.6 - Contributor+ Stored XSS via Style Field (medium 6.8)
- [CVE-2026-17004](https://insights.sbomify.com/CVE-2026-17004/): IBM i is Affected By Multiple Vulnerabilities in Host Servers (high 7.5)
- [CVE-2026-17003](https://insights.sbomify.com/CVE-2026-17003/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.7)
- [CVE-2026-17001](https://insights.sbomify.com/CVE-2026-17001/): Cross-site scripting in Import and export users and customers (medium 6.4)
- [CVE-2026-17000](https://insights.sbomify.com/CVE-2026-17000/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.1)
- [CVE-2026-1700](https://insights.sbomify.com/CVE-2026-1700/): projectworlds House Rental and Property Listing sms.php cross site scripting (medium 5.1)
- [CVE-2026-16999](https://insights.sbomify.com/CVE-2026-16999/): XXE in Ministry of Justice's UYAP Document Editor (medium 6.3)
- [CVE-2026-16997](https://insights.sbomify.com/CVE-2026-16997/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.8)
- [CVE-2026-16996](https://insights.sbomify.com/CVE-2026-16996/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.8)
- [CVE-2026-16993](https://insights.sbomify.com/CVE-2026-16993/): DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Disclosure via Unprotected Uploads Directory (low 3.7)
- [CVE-2026-16992](https://insights.sbomify.com/CVE-2026-16992/): Create by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication (medium 6.5)
- [CVE-2026-16991](https://insights.sbomify.com/CVE-2026-16991/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.8)
- [CVE-2026-16990](https://insights.sbomify.com/CVE-2026-16990/): Payment Button for PayPal <= 1.2.3.44 - Unauthenticated Payment Price Manipulation (medium 5.3)
- [CVE-2026-1699](https://insights.sbomify.com/CVE-2026-1699/): Supply chain in Eclipse Theia - Website (critical 10.0)
- [CVE-2026-16989](https://insights.sbomify.com/CVE-2026-16989/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.1)
- [CVE-2026-16988](https://insights.sbomify.com/CVE-2026-16988/): GeoDirectory < 2.8.169 - Unauthenticated Pending/Draft Listing Disclosure via markers REST Endpoint (high 7.5)
- [CVE-2026-16987](https://insights.sbomify.com/CVE-2026-16987/): IBM i is Affected By An Improper Validation Vulnerability in PASE [] (high 8.8)
- [CVE-2026-16986](https://insights.sbomify.com/CVE-2026-16986/): Booking Package < 1.7.25 - Unauthenticated Price Manipulation via Service and Option Cost Parameters (medium 5.3)
- [CVE-2026-16985](https://insights.sbomify.com/CVE-2026-16985/): Squeeze < 1.7.12 - Author+ Arbitrary File Upload (high 8.8)
- [CVE-2026-16984](https://insights.sbomify.com/CVE-2026-16984/): WP Legal Pages < 3.7.1 - Unauthenticated API Secret Disclosure (medium 6.5)
- [CVE-2026-16983](https://insights.sbomify.com/CVE-2026-16983/): Gutentor < 4.0.6 - Subscriber+ Password Protected Post Password Disclosure via REST API (medium 4.3)
- [CVE-2026-16982](https://insights.sbomify.com/CVE-2026-16982/): IBM i is Affected By Multiple Vulnerabilities in Host Servers (high 7.5)
- [CVE-2026-16981](https://insights.sbomify.com/CVE-2026-16981/): DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR (medium 5.3)
- [CVE-2026-16980](https://insights.sbomify.com/CVE-2026-16980/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 6.3)
- [CVE-2026-1698](https://insights.sbomify.com/CVE-2026-1698/): HTTP Host header vulnerability in WebClient and WebScheduler web apps (medium 5.3)
- [CVE-2026-16979](https://insights.sbomify.com/CVE-2026-16979/): SmartCrawl < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration (medium 4.3)
- [CVE-2026-16977](https://insights.sbomify.com/CVE-2026-16977/): Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name (high 8.1)
- [CVE-2026-16975](https://insights.sbomify.com/CVE-2026-16975/): IBM i is Affected By A Remote Code Execution Vulnerability [] (high 8.8)
- [CVE-2026-16974](https://insights.sbomify.com/CVE-2026-16974/): Cross-site scripting in Kirki – Freeform Page Builder, Website Builder & Customizer (medium 6.4)
- [CVE-2026-16973](https://insights.sbomify.com/CVE-2026-16973/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 5.5)
- [CVE-2026-16972](https://insights.sbomify.com/CVE-2026-16972/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 6.5)
- [CVE-2026-16971](https://insights.sbomify.com/CVE-2026-16971/): DFIR-IRIS Missing Brute Force Protection in OTP Validation (medium 5.9)
- [CVE-2026-16970](https://insights.sbomify.com/CVE-2026-16970/): DFIR-IRIS Insufficient Logout Implementation (medium 4.2)
- [CVE-2026-1697](https://insights.sbomify.com/CVE-2026-1697/): Use of unsecure cookies for GraphicalData web service and WebClient web app (medium 5.3)
- [CVE-2026-16969](https://insights.sbomify.com/CVE-2026-16969/): DFIR-IRIS Stored XSS in Assets (high 7.6)
- [CVE-2026-16968](https://insights.sbomify.com/CVE-2026-16968/): GeoDirectory < 2.8.168 - Contributor+ User Email Disclosure via geodir_json_search_users (medium 6.5)
- [CVE-2026-16967](https://insights.sbomify.com/CVE-2026-16967/): IBM i is Affected By Multiple SQL Vulnerabilities [, ] (high 8.5)
- [CVE-2026-16966](https://insights.sbomify.com/CVE-2026-16966/): Solace Extra < 1.7.0 - Unauthenticated Draft/Private Site Builder Content Disclosure via get_elementor_content (medium 5.3)
- [CVE-2026-16965](https://insights.sbomify.com/CVE-2026-16965/): Solace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status (medium 4.3)
- [CVE-2026-16964](https://insights.sbomify.com/CVE-2026-16964/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 6.5)
- [CVE-2026-16962](https://insights.sbomify.com/CVE-2026-16962/): Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation (medium 5.3)
- [CVE-2026-16961](https://insights.sbomify.com/CVE-2026-16961/): IBM i is Affected By SQL Injection Vulnerability in Db2 Mirror [] (high 7.6)
- [CVE-2026-16960](https://insights.sbomify.com/CVE-2026-16960/): Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure (high 7.5)
- [CVE-2026-1696](https://insights.sbomify.com/CVE-2026-1696/): Missing security HTTP headers (low 2.3)
- [CVE-2026-16959](https://insights.sbomify.com/CVE-2026-16959/): Media Library Assistant < 3.40 - Author+ SQL Injection via mla_search_connector (medium 6.8)
- [CVE-2026-16958](https://insights.sbomify.com/CVE-2026-16958/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 6.5)
- [CVE-2026-16957](https://insights.sbomify.com/CVE-2026-16957/): Slim SEO < 4.9.11 - Contributor+ Arbitrary Post Meta Disclosure (low 2.7)
- [CVE-2026-16956](https://insights.sbomify.com/CVE-2026-16956/): IBM Db2 Mirror for i is vulnerable to OS command injection [] (critical 9.8)
- [CVE-2026-16955](https://insights.sbomify.com/CVE-2026-16955/): AI Engine < 3.6.6 - Subscriber+ Arbitrary File Read via Audio Transcription (medium 5.0)
- [CVE-2026-16954](https://insights.sbomify.com/CVE-2026-16954/): AI Engine < 3.6.4 - Editor+ Sensitive Information Disclosure of API Key and Bearer Tokens (medium 6.5)
- [CVE-2026-16953](https://insights.sbomify.com/CVE-2026-16953/): AI Engine < 3.6.4 - Unauthenticated Cross-Session Chatbot File Deletion via Forgeable Session Cookie (medium 4.8)
- [CVE-2026-16952](https://insights.sbomify.com/CVE-2026-16952/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 5.5)
- [CVE-2026-16951](https://insights.sbomify.com/CVE-2026-16951/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 6.7)
- [CVE-2026-16950](https://insights.sbomify.com/CVE-2026-16950/): Product Shortlist <= 1.0.4 - Unauthenticated SQL Injection via get_shortlisted_products (high 8.6)
- [CVE-2026-1695](https://insights.sbomify.com/CVE-2026-1695/): XSS vulnerability upon unsuccessful authentication (medium 5.3)
- [CVE-2026-16949](https://insights.sbomify.com/CVE-2026-16949/): Term Pages < 2.0.0 - Unauthenticated SQL Injection via tp_lookup (medium 5.8)
- [CVE-2026-16948](https://insights.sbomify.com/CVE-2026-16948/): Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure (high 8.1)
- [CVE-2026-16947](https://insights.sbomify.com/CVE-2026-16947/): Server-side request forgery in Total processing card payments for WooCommerce (critical 9.1)
- [CVE-2026-16946](https://insights.sbomify.com/CVE-2026-16946/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.8)
- [CVE-2026-16945](https://insights.sbomify.com/CVE-2026-16945/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/844/