# Vulnerabilities published in 2026


- [CVE-2026-16734](https://insights.sbomify.com/CVE-2026-16734/): Stripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation (high 7.5)
- [CVE-2026-16733](https://insights.sbomify.com/CVE-2026-16733/): bahmutov find-cypress-specs Branch index.js shell.exec os command injection (medium 4.8)
- [CVE-2026-16732](https://insights.sbomify.com/CVE-2026-16732/): fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count (medium 6.1)
- [CVE-2026-16731](https://insights.sbomify.com/CVE-2026-16731/): Authentication and authorization bypass via cryptographic timing side-channel attack in StationScout (high 8.3)
- [CVE-2026-16730](https://insights.sbomify.com/CVE-2026-16730/): Dbus-broker: dbus-broker: session bus denial of service via emfile during peer setup (medium 5.5)
- [CVE-2026-1673](https://insights.sbomify.com/CVE-2026-1673/): Cross-site request forgery in BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net (medium 4.3)
- [CVE-2026-16729](https://insights.sbomify.com/CVE-2026-16729/): undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields (medium 4.8)
- [CVE-2026-16728](https://insights.sbomify.com/CVE-2026-16728/): undici vulnerable to downstream response desynchronization via retry interceptor (medium 4.8)
- [CVE-2026-16727](https://insights.sbomify.com/CVE-2026-16727/): Race condition in Armoury Crate (high 7.3)
- [CVE-2026-16726](https://insights.sbomify.com/CVE-2026-16726/): Memory corruption in PANATERM for Multi (medium 6.8)
- [CVE-2026-16724](https://insights.sbomify.com/CVE-2026-16724/): Power System Integer Overflow (medium 4.5)
- [CVE-2026-16723](https://insights.sbomify.com/CVE-2026-16723/): Remote Code Execution in fastjson 1.2.68–1.2.83 (critical 9.0)
- [CVE-2026-16722](https://insights.sbomify.com/CVE-2026-16722/): IBM i is Affected By An Unauthorized Privileges Vulnerability in SQL [] (high 8.8)
- [CVE-2026-1672](https://insights.sbomify.com/CVE-2026-1672/): Cross-site request forgery in BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net (medium 6.5)
- [CVE-2026-16713](https://insights.sbomify.com/CVE-2026-16713/): IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution (medium 4.3)
- [CVE-2026-1671](https://insights.sbomify.com/CVE-2026-1671/): Activity Log for WordPress <= 1.2.8 - Missing Authorization to Sensitive Information Exposure via Log File (medium 6.5)
- [CVE-2026-16708](https://insights.sbomify.com/CVE-2026-16708/): IBM Db2 Mirror for i is affected by multiple vulnerabilities (high 8.3)
- [CVE-2026-16707](https://insights.sbomify.com/CVE-2026-16707/): Power System Out-of-bounds Read (high 8.2)
- [CVE-2026-16706](https://insights.sbomify.com/CVE-2026-16706/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-16703](https://insights.sbomify.com/CVE-2026-16703/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.8)
- [CVE-2026-16702](https://insights.sbomify.com/CVE-2026-16702/): Null dereference in Db2 (medium 6.5)
- [CVE-2026-1670](https://insights.sbomify.com/CVE-2026-1670/): Honeywell CCTV Products Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-16695](https://insights.sbomify.com/CVE-2026-16695/): IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities (high 7.8)
- [CVE-2026-16694](https://insights.sbomify.com/CVE-2026-16694/): IBM i is Affected By Stored Cross-site Scripting for i (medium 6.4)
- [CVE-2026-16693](https://insights.sbomify.com/CVE-2026-16693/): IBM i is Affected By Cryptographic Algorithm Weakness in DCM [] (medium 4.4)
- [CVE-2026-16692](https://insights.sbomify.com/CVE-2026-16692/): IBM i is Affected By Multiple Vulnerabilities in Simple Mail Transfer Protocol (medium 6.5)
- [CVE-2026-16690](https://insights.sbomify.com/CVE-2026-16690/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 7.5)
- [CVE-2026-1669](https://insights.sbomify.com/CVE-2026-1669/): Arbitrary File Read in Keras via HDF5 External Datasets (high 7.1)
- [CVE-2026-16689](https://insights.sbomify.com/CVE-2026-16689/): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (medium 6.2)
- [CVE-2026-16687](https://insights.sbomify.com/CVE-2026-16687/): Power System Buffer Overflow (critical 9.6)
- [CVE-2026-16686](https://insights.sbomify.com/CVE-2026-16686/): Vulnerabilities in IBM AIX and PowerVM VIOS (high 8.2)
- [CVE-2026-16685](https://insights.sbomify.com/CVE-2026-16685/): Download Manager <= 3.3.66 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Shortcode Attribute (medium 6.4)
- [CVE-2026-16684](https://insights.sbomify.com/CVE-2026-16684/): Cross-site scripting in Easy Property Listings (medium 6.4)
- [CVE-2026-1668](https://insights.sbomify.com/CVE-2026-1668/): Input Validation Vulnerability on Multiple Omada Switches (high 7.7)
- [CVE-2026-16678](https://insights.sbomify.com/CVE-2026-16678/): IBM Power Systems Firmware Denial of Service (medium 4.5)
- [CVE-2026-16675](https://insights.sbomify.com/CVE-2026-16675/): Rockwell Automation FactoryTalk® Activation Manager - Privilege Escalation (high 8.5)
- [CVE-2026-16674](https://insights.sbomify.com/CVE-2026-16674/): IBM i is Affected By Multiple Vulnerabilities in WebSphere Application Server Liberty (high 8.8)
- [CVE-2026-16673](https://insights.sbomify.com/CVE-2026-16673/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.8)
- [CVE-2026-16672](https://insights.sbomify.com/CVE-2026-16672/): DataStage on Cloud Pak for Data has several vulnerabilities (high 8.8)
- [CVE-2026-1667](https://insights.sbomify.com/CVE-2026-1667/): Missing authorization in GEO Plugin by Squirrly SEO (high 7.2)
- [CVE-2026-16661](https://insights.sbomify.com/CVE-2026-16661/): Power System Integer Overflow (high 8.2)
- [CVE-2026-16660](https://insights.sbomify.com/CVE-2026-16660/): IBM Db2 Mirror for i is affected by multiple vulnerabilities [, , ] (medium 5.3)
- [CVE-2026-1666](https://insights.sbomify.com/CVE-2026-1666/): Download Manager <= 3.3.46 - Reflected Cross-Site Scripting via 'redirect_to' Parameter (medium 6.1)
- [CVE-2026-16656](https://insights.sbomify.com/CVE-2026-16656/): Vulnerabilities in IBM AIX and PowerVM VIOS (critical 9.8)
- [CVE-2026-16655](https://insights.sbomify.com/CVE-2026-16655/): Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member (high 7.2)
- [CVE-2026-16654](https://insights.sbomify.com/CVE-2026-16654/): Cross-site scripting in Avada (Fusion) Builder (medium 6.4)
- [CVE-2026-16653](https://insights.sbomify.com/CVE-2026-16653/): boazsegev facil.io Public Folder http.c http_sendfile2 path traversal (medium 6.9)
- [CVE-2026-16652](https://insights.sbomify.com/CVE-2026-16652/): Temporal Server Schedule exclusion search can cause excessive CPU consumption (high 7.1)
- [CVE-2026-16651](https://insights.sbomify.com/CVE-2026-16651/): temporalio/sqlparser malformed MySQL version comments can cause a panic (high 8.7)
- [CVE-2026-16650](https://insights.sbomify.com/CVE-2026-16650/): Charitable < 1.8.12 - Unauthenticated Donation Payment-Status Manipulation via Square Webhook Signature Bypass (medium 5.3)
- [CVE-2026-1665](https://insights.sbomify.com/CVE-2026-1665/): Command Injection in nvm via NVM_AUTH_HEADER in wget code path (medium 5.4)
- [CVE-2026-16649](https://insights.sbomify.com/CVE-2026-16649/): Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value (high 7.2)
- [CVE-2026-16648](https://insights.sbomify.com/CVE-2026-16648/): Mailer Plus Log - Moderately critical - Access bypass - SA-CONTRIB-2026-128 (low 3.8)
- [CVE-2026-16647](https://insights.sbomify.com/CVE-2026-16647/): Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111 (medium 4.1)
- [CVE-2026-16646](https://insights.sbomify.com/CVE-2026-16646/): PanKM - Critical - Unsupported - SA-CONTRIB-2026-083 (medium 5.7)
- [CVE-2026-16645](https://insights.sbomify.com/CVE-2026-16645/): PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088 (critical 9.1)
- [CVE-2026-16644](https://insights.sbomify.com/CVE-2026-16644/): Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087 (critical 9.1)
- [CVE-2026-16643](https://insights.sbomify.com/CVE-2026-16643/): Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086 (medium 5.7)
- [CVE-2026-16642](https://insights.sbomify.com/CVE-2026-16642/): Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085 (medium 5.7)
- [CVE-2026-16641](https://insights.sbomify.com/CVE-2026-16641/): Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084 (critical 9.8)
- [CVE-2026-16640](https://insights.sbomify.com/CVE-2026-16640/): Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082 (medium 6.1)
- [CVE-2026-1664](https://insights.sbomify.com/CVE-2026-1664/): Insecure Direct Object Reference (IDOR) via Header-Based Email Routing (medium 6.9)
- [CVE-2026-16639](https://insights.sbomify.com/CVE-2026-16639/): Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081 (critical 9.8)
- [CVE-2026-16638](https://insights.sbomify.com/CVE-2026-16638/): Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080 (medium 6.1)
- [CVE-2026-16637](https://insights.sbomify.com/CVE-2026-16637/): OPeNDAP Hyrax SSRF and Credential Disclosure via Unvalidated Redirects (medium 6.5)
- [CVE-2026-16636](https://insights.sbomify.com/CVE-2026-16636/): FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs (high 7.2)
- [CVE-2026-16635](https://insights.sbomify.com/CVE-2026-16635/): Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field (high 8.8)
- [CVE-2026-16634](https://insights.sbomify.com/CVE-2026-16634/): TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99 (critical 9.8)
- [CVE-2026-16632](https://insights.sbomify.com/CVE-2026-16632/): boazsegev facil.io WebSocket Frame websocket_parser.h websocket_on_protocol_error input validation (medium 6.9)
- [CVE-2026-16631](https://insights.sbomify.com/CVE-2026-16631/): publint package-manager pack.js child_process.exec os command injection (medium 4.8)
- [CVE-2026-16630](https://insights.sbomify.com/CVE-2026-16630/): syncfusion ej2-javascript-ui-controls package.json child_process.exec os command injection (medium 4.8)
- [CVE-2026-1663](https://insights.sbomify.com/CVE-2026-1663/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2026-16629](https://insights.sbomify.com/CVE-2026-16629/): danger danger-js CLI localGetFileAtSHA.ts danger.git.diffForFile os command injection (medium 4.8)
- [CVE-2026-16628](https://insights.sbomify.com/CVE-2026-16628/): oclif JIT Plugin Entry child_process.exec os command injection (medium 4.8)
- [CVE-2026-16627](https://insights.sbomify.com/CVE-2026-16627/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 7.7)
- [CVE-2026-16626](https://insights.sbomify.com/CVE-2026-16626/): JasperReports Server: XXE Injection Vulnerability (Unauthenticated) (critical 9.3)
- [CVE-2026-16624](https://insights.sbomify.com/CVE-2026-16624/): CVE-2026-16624 (critical 9.6)
- [CVE-2026-16623](https://insights.sbomify.com/CVE-2026-16623/): Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite) (high 8.0)
- [CVE-2026-16621](https://insights.sbomify.com/CVE-2026-16621/): Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via PayPal Advanced Return Handler (medium 5.3)
- [CVE-2026-16620](https://insights.sbomify.com/CVE-2026-16620/): WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Select Mode (high 7.5)
- [CVE-2026-1662](https://insights.sbomify.com/CVE-2026-1662/): Allocation of Resources Without Limits or Throttling in GitLab (high 7.5)
- [CVE-2026-16619](https://insights.sbomify.com/CVE-2026-16619/): miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts (high 7.5)
- [CVE-2026-16618](https://insights.sbomify.com/CVE-2026-16618/): ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution (critical 9.8)
- [CVE-2026-16617](https://insights.sbomify.com/CVE-2026-16617/): Simple File List <= 6.3.11 - Unauthenticated Stored XSS via File Description (high 8.8)
- [CVE-2026-16616](https://insights.sbomify.com/CVE-2026-16616/): Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal (high 8.6)
- [CVE-2026-16615](https://insights.sbomify.com/CVE-2026-16615/): Librest: weak random number generation in pkce implementation (medium 6.8)
- [CVE-2026-16614](https://insights.sbomify.com/CVE-2026-16614/): GSheetConnector <= 5.2.1 - Authenticated (Administrator+) SQL Injection via 's' Parameter (medium 4.9)
- [CVE-2026-16613](https://insights.sbomify.com/CVE-2026-16613/): GDPR Cookie Compliance < 5.1.0 - Cookie Deletion and Forced Logout via CSRF (medium 4.3)
- [CVE-2026-16612](https://insights.sbomify.com/CVE-2026-16612/): FiboSearch < 1.34.1 - Unauthenticated Password-Protected Product Information Disclosure (medium 5.3)
- [CVE-2026-16611](https://insights.sbomify.com/CVE-2026-16611/): Product Feed PRO for WooCommerce < 13.5.7 - Unauthenticated Feed Configuration Disclosure (high 7.5)
- [CVE-2026-16610](https://insights.sbomify.com/CVE-2026-16610/): Code injection in Admin and Site Enhancements (ASE) Pro (critical 9.8)
- [CVE-2026-1661](https://insights.sbomify.com/CVE-2026-1661/): WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection (medium 4.3)
- [CVE-2026-16608](https://insights.sbomify.com/CVE-2026-16608/): Download Monitor < 5.2.6 - Unauthenticated Download Log Injection (medium 5.3)
- [CVE-2026-16607](https://insights.sbomify.com/CVE-2026-16607/): Authenticated local root privilege escalation vulnerability in openFT for Linux and Oracle Solaris (high 8.5)
- [CVE-2026-16606](https://insights.sbomify.com/CVE-2026-16606/): Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris (critical 9.3)
- [CVE-2026-16605](https://insights.sbomify.com/CVE-2026-16605/): MultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization (high 7.2)
- [CVE-2026-16604](https://insights.sbomify.com/CVE-2026-16604/): Information disclosure in Passster (high 7.5)
- [CVE-2026-16603](https://insights.sbomify.com/CVE-2026-16603/): Content Protector (Passster) < 4.3.6 - Unauthenticated Category-Locked Content Disclosure via Core REST API (high 7.5)
- [CVE-2026-16602](https://insights.sbomify.com/CVE-2026-16602/): Content Protector (Passster) < 4.3.6 - Unauthenticated Non-Public Post Content Disclosure via Captcha REST Endpoint (high 7.5)
- [CVE-2026-16601](https://insights.sbomify.com/CVE-2026-16601/): CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/847/