# Vulnerabilities published in 2026


- [CVE-2026-16841](https://insights.sbomify.com/CVE-2026-16841/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.8)
- [CVE-2026-16840](https://insights.sbomify.com/CVE-2026-16840/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-1684](https://insights.sbomify.com/CVE-2026-1684/): Free5GC SMF PFCP UDP Endpoint pfcp_reports.go HandleReports denial of service (medium 6.9)
- [CVE-2026-16839](https://insights.sbomify.com/CVE-2026-16839/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.4)
- [CVE-2026-16838](https://insights.sbomify.com/CVE-2026-16838/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.0)
- [CVE-2026-16837](https://insights.sbomify.com/CVE-2026-16837/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-16836](https://insights.sbomify.com/CVE-2026-16836/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-16835](https://insights.sbomify.com/CVE-2026-16835/): Power System Improper Certificate Validation (critical 9.6)
- [CVE-2026-16834](https://insights.sbomify.com/CVE-2026-16834/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-16833](https://insights.sbomify.com/CVE-2026-16833/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 5.3)
- [CVE-2026-16832](https://insights.sbomify.com/CVE-2026-16832/): Power System Buffer Overflow (high 8.4)
- [CVE-2026-16831](https://insights.sbomify.com/CVE-2026-16831/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-16830](https://insights.sbomify.com/CVE-2026-16830/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (medium 5.4)
- [CVE-2026-1683](https://insights.sbomify.com/CVE-2026-1683/): Free5GC SMF PFCP handler.go HandlePfcpSessionReportRequest denial of service (medium 6.9)
- [CVE-2026-16829](https://insights.sbomify.com/CVE-2026-16829/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 5.3)
- [CVE-2026-16828](https://insights.sbomify.com/CVE-2026-16828/): Power System Out-of-bounds Read (high 7.6)
- [CVE-2026-16827](https://insights.sbomify.com/CVE-2026-16827/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 5.9)
- [CVE-2026-16826](https://insights.sbomify.com/CVE-2026-16826/): IBM i is Affected By Multiple Vulnerabilities in Debug Server (medium 5.3)
- [CVE-2026-16825](https://insights.sbomify.com/CVE-2026-16825/): Vulnerabilities in IBM AIX and PowerVM VIOS (medium 4.2)
- [CVE-2026-16824](https://insights.sbomify.com/CVE-2026-16824/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-16823](https://insights.sbomify.com/CVE-2026-16823/): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (critical 9.1)
- [CVE-2026-16822](https://insights.sbomify.com/CVE-2026-16822/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.3)
- [CVE-2026-16821](https://insights.sbomify.com/CVE-2026-16821/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.0)
- [CVE-2026-1682](https://insights.sbomify.com/CVE-2026-1682/): Free5GC SMF PFCP UDP Endpoint handler.go HandlePfcpAssociationReleaseRequest null pointer dereference (medium 6.9)
- [CVE-2026-16819](https://insights.sbomify.com/CVE-2026-16819/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.7)
- [CVE-2026-16818](https://insights.sbomify.com/CVE-2026-16818/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-16817](https://insights.sbomify.com/CVE-2026-16817/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-16816](https://insights.sbomify.com/CVE-2026-16816/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.9)
- [CVE-2026-16815](https://insights.sbomify.com/CVE-2026-16815/): IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol (high 8.6)
- [CVE-2026-16814](https://insights.sbomify.com/CVE-2026-16814/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.8)
- [CVE-2026-16812](https://insights.sbomify.com/CVE-2026-16812/): Arista VeloCloud Orchestrator On-Prem OS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2026-16811](https://insights.sbomify.com/CVE-2026-16811/): ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter (medium 4.9)
- [CVE-2026-16810](https://insights.sbomify.com/CVE-2026-16810/): Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter (medium 6.5)
- [CVE-2026-1681](https://insights.sbomify.com/CVE-2026-1681/): net: Stack Overflow with Ping (to own IP Address) via Shell (medium 6.1)
- [CVE-2026-16809](https://insights.sbomify.com/CVE-2026-16809/): LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering (high 7.2)
- [CVE-2026-16807](https://insights.sbomify.com/CVE-2026-16807/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-16806](https://insights.sbomify.com/CVE-2026-16806/): Use after free in Chrome (high 8.8)
- [CVE-2026-16805](https://insights.sbomify.com/CVE-2026-16805/): Use after free in Chrome (high 8.8)
- [CVE-2026-16804](https://insights.sbomify.com/CVE-2026-16804/): Use after free in Chrome (high 8.3)
- [CVE-2026-16802](https://insights.sbomify.com/CVE-2026-16802/): Information disclosure in PowerShell Universal (medium 6.5)
- [CVE-2026-16801](https://insights.sbomify.com/CVE-2026-16801/): Code injection in PowerShell Universal (high 8.8)
- [CVE-2026-16800](https://insights.sbomify.com/CVE-2026-16800/): Code injection in PowerShell Universal (high 8.8)
- [CVE-2026-1680](https://insights.sbomify.com/CVE-2026-1680/): Local Privilege Escalation in Local Admin Service (high 7.1)
- [CVE-2026-16799](https://insights.sbomify.com/CVE-2026-16799/): Missing authorization in PowerShell Universal (medium 5.0)
- [CVE-2026-16798](https://insights.sbomify.com/CVE-2026-16798/): Information disclosure in PowerShell Universal (medium 6.5)
- [CVE-2026-16797](https://insights.sbomify.com/CVE-2026-16797/): Missing authorization in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (medium 4.3)
- [CVE-2026-16796](https://insights.sbomify.com/CVE-2026-16796/): Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages() (high 8.4)
- [CVE-2026-16794](https://insights.sbomify.com/CVE-2026-16794/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2026-16793](https://insights.sbomify.com/CVE-2026-16793/): Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator (high 8.7)
- [CVE-2026-16792](https://insights.sbomify.com/CVE-2026-16792/): Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator (high 7.0)
- [CVE-2026-16791](https://insights.sbomify.com/CVE-2026-16791/): Predictable Temporary File Symlink Vulnerability in Lenovo XClarity Essentials OneCLI (low 1.0)
- [CVE-2026-1679](https://insights.sbomify.com/CVE-2026-1679/): net: eswifi socket send payload length not bounded (high 7.3)
- [CVE-2026-16788](https://insights.sbomify.com/CVE-2026-16788/): Cross-site scripting in Live Composer – Free WordPress Website Builder (medium 6.4)
- [CVE-2026-16787](https://insights.sbomify.com/CVE-2026-16787/): Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode (medium 6.4)
- [CVE-2026-16786](https://insights.sbomify.com/CVE-2026-16786/): Cross-site scripting in Live Composer – Free WordPress Website Builder (medium 6.4)
- [CVE-2026-16783](https://insights.sbomify.com/CVE-2026-16783/): ABC File Parsing Out-of-Bounds Write Vulnerability in Autodesk 3ds Max (high 7.8)
- [CVE-2026-16782](https://insights.sbomify.com/CVE-2026-16782/): SVG File Parsing Out-of-Bounds Read Vulnerability in Autodesk 3ds Max (medium 5.3)
- [CVE-2026-16781](https://insights.sbomify.com/CVE-2026-16781/): SVG File Parsing Stack Exhaustion Vulnerability in Autodesk 3ds Max (medium 5.5)
- [CVE-2026-1678](https://insights.sbomify.com/CVE-2026-1678/): dns: memory‑safety issue in the DNS name parser (critical 9.4)
- [CVE-2026-16779](https://insights.sbomify.com/CVE-2026-16779/): Missing authorization in Kubio AI Page Builder (medium 4.3)
- [CVE-2026-16778](https://insights.sbomify.com/CVE-2026-16778/): Cross-site scripting in Live Composer – Free WordPress Website Builder (medium 6.4)
- [CVE-2026-16777](https://insights.sbomify.com/CVE-2026-16777/): Path traversal in Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers (medium 4.9)
- [CVE-2026-16776](https://insights.sbomify.com/CVE-2026-16776/): MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-16775](https://insights.sbomify.com/CVE-2026-16775/): Cross-site scripting in Smash Balloon Social Post Feed – Simple Social Feeds for WordPress (medium 6.4)
- [CVE-2026-16774](https://insights.sbomify.com/CVE-2026-16774/): WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action (medium 5.3)
- [CVE-2026-16773](https://insights.sbomify.com/CVE-2026-16773/): WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action (medium 5.3)
- [CVE-2026-16772](https://insights.sbomify.com/CVE-2026-16772/): CVE-2026-16772 (high 8.1)
- [CVE-2026-16771](https://insights.sbomify.com/CVE-2026-16771/): CVE-2026-16771 (high 8.8)
- [CVE-2026-16770](https://insights.sbomify.com/CVE-2026-16770/): Command injection in PDF::WebKit (critical 9.8)
- [CVE-2026-1677](https://insights.sbomify.com/CVE-2026-1677/): net: TLS 1.2 connections allowed on TLS 1.3 sockets (medium 5.3)
- [CVE-2026-16769](https://insights.sbomify.com/CVE-2026-16769/): RS9116W/SiWx917 plaintext pause encryption request causes DOS (high 7.1)
- [CVE-2026-16768](https://insights.sbomify.com/CVE-2026-16768/): Gdk-pixbuf: out-of-bounds read in ico parser (medium 5.3)
- [CVE-2026-16767](https://insights.sbomify.com/CVE-2026-16767/): Ne-Lexa php-zip ZIP ZipFile.php extractTo path traversal (medium 6.9)
- [CVE-2026-16766](https://insights.sbomify.com/CVE-2026-16766/): Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options (critical 9.8)
- [CVE-2026-16765](https://insights.sbomify.com/CVE-2026-16765/): CodeAstro Online Classroom loginlinkadmin.php sql injection (medium 6.9)
- [CVE-2026-16764](https://insights.sbomify.com/CVE-2026-16764/): OWASP DefectDojo API/Web serializers.py UserSerializer privileges management (medium 5.3)
- [CVE-2026-16763](https://insights.sbomify.com/CVE-2026-16763/): localstack serverless-localstack Configuration index.js os command injection (medium 4.8)
- [CVE-2026-16762](https://insights.sbomify.com/CVE-2026-16762/): Denial-of-service vulnerability in the Qt Core QXmlStream parser (QXmlStreamReader) impacts Qt (high 8.7)
- [CVE-2026-16759](https://insights.sbomify.com/CVE-2026-16759/): Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters (medium 6.5)
- [CVE-2026-16758](https://insights.sbomify.com/CVE-2026-16758/): Snippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (medium 6.4)
- [CVE-2026-16756](https://insights.sbomify.com/CVE-2026-16756/): Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service (high 8.7)
- [CVE-2026-16755](https://insights.sbomify.com/CVE-2026-16755/): Information disclosure in Smart Camera C33 (medium 6.0)
- [CVE-2026-16754](https://insights.sbomify.com/CVE-2026-16754/): Security feature bypass in Smart Camera C33 (medium 5.9)
- [CVE-2026-16753](https://insights.sbomify.com/CVE-2026-16753/): CVE-2026-16753 (high 8.8)
- [CVE-2026-16751](https://insights.sbomify.com/CVE-2026-16751/): Ente Museum Server Authorization Bypass Vulnerability (medium 6.5)
- [CVE-2026-16750](https://insights.sbomify.com/CVE-2026-16750/): Missing authorization in Motors – Car Dealership & Classified Listings Plugin (medium 5.3)
- [CVE-2026-1675](https://insights.sbomify.com/CVE-2026-1675/): Advanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key (medium 5.3)
- [CVE-2026-16747](https://insights.sbomify.com/CVE-2026-16747/): Kirki < 6.2.1 - Unauthenticated Arbitrary Shortcode Execution via Form Email Actions (medium 6.5)
- [CVE-2026-16746](https://insights.sbomify.com/CVE-2026-16746/): MultiVendorX < 5.0.11 - Store Owner+ Cross-Store Commission Data Disclosure via commissions REST Endpoint (low 2.7)
- [CVE-2026-16745](https://insights.sbomify.com/CVE-2026-16745/): Odh-dashboard: odh-dashboard: backend port 8080 trusts x-forwarded-access-token without origin validation (high 8.8)
- [CVE-2026-16743](https://insights.sbomify.com/CVE-2026-16743/): Accountsservice: accountsservice: arbitrary file read via seticonfile for systemd-homed users (medium 5.5)
- [CVE-2026-16742](https://insights.sbomify.com/CVE-2026-16742/): systemd-homed: local privilege escalation via missing home-record signature verification on the authenticate path (medium 6.7)
- [CVE-2026-16741](https://insights.sbomify.com/CVE-2026-16741/): OS Command in TR7 Cyber ​​Defense's TR7 ASP (critical 9.8)
- [CVE-2026-16740](https://insights.sbomify.com/CVE-2026-16740/): Missing Authentication for Critical Function in TR7 Cyber ​​Defense's TR7 ASP (critical 9.8)
- [CVE-2026-1674](https://insights.sbomify.com/CVE-2026-1674/): Missing authorization in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder (medium 6.5)
- [CVE-2026-16739](https://insights.sbomify.com/CVE-2026-16739/): Epeken All Kurir <= 2.1.4 - Unauthenticated Order Payment Confirmation Forgery (medium 5.9)
- [CVE-2026-16738](https://insights.sbomify.com/CVE-2026-16738/): Conekta Payment Gateway < 6.2.2 - Unauthenticated Order Payment Completion via Webhook Forgery (medium 5.3)
- [CVE-2026-16737](https://insights.sbomify.com/CVE-2026-16737/): WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart (medium 5.3)
- [CVE-2026-16736](https://insights.sbomify.com/CVE-2026-16736/): User Registration & Membership < 5.2.6 - Unauthenticated Account Creation While Registration Disabled (high 7.5)
- [CVE-2026-16735](https://insights.sbomify.com/CVE-2026-16735/): release-it conventional-changelog Changelog File index.js writeChangelog os command injection (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/846/