# Vulnerabilities published in 2026


- [CVE-2026-16600](https://insights.sbomify.com/CVE-2026-16600/): SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image (high 7.7)
- [CVE-2026-1660](https://insights.sbomify.com/CVE-2026-1660/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2026-16599](https://insights.sbomify.com/CVE-2026-16599/): Denial of Service in GNU wget (medium 5.1)
- [CVE-2026-16597](https://insights.sbomify.com/CVE-2026-16597/): GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields (high 7.2)
- [CVE-2026-16596](https://insights.sbomify.com/CVE-2026-16596/): WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter (medium 6.5)
- [CVE-2026-16595](https://insights.sbomify.com/CVE-2026-16595/): WP Directory Kit < 1.5.5 - Subscriber+ User and Unpublished Listing Disclosure (medium 6.5)
- [CVE-2026-16594](https://insights.sbomify.com/CVE-2026-16594/): WP Directory Kit < 1.5.5 - Subscriber+ Plugin Settings and API Key Disclosure (high 7.5)
- [CVE-2026-16593](https://insights.sbomify.com/CVE-2026-16593/): WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings (medium 6.8)
- [CVE-2026-16592](https://insights.sbomify.com/CVE-2026-16592/): WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes (low 2.7)
- [CVE-2026-16591](https://insights.sbomify.com/CVE-2026-16591/): WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields (high 7.2)
- [CVE-2026-16590](https://insights.sbomify.com/CVE-2026-16590/): WP Directory Kit < 1.5.5 - Subscriber+ Contact Message and User Data Disclosure (medium 6.5)
- [CVE-2026-1659](https://insights.sbomify.com/CVE-2026-1659/): Allocation of Resources Without Limits or Throttling in GitLab (high 7.5)
- [CVE-2026-16589](https://insights.sbomify.com/CVE-2026-16589/): WP Directory Kit < 1.5.5 - Subscriber+ SQL Injection via data_fields_list Parameter (high 7.7)
- [CVE-2026-16588](https://insights.sbomify.com/CVE-2026-16588/): WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'order_by' Parameter (medium 6.5)
- [CVE-2026-16587](https://insights.sbomify.com/CVE-2026-16587/): Missing authorization in Advanced Form Integration — Connect Forms to 200+ Apps (medium 4.3)
- [CVE-2026-16586](https://insights.sbomify.com/CVE-2026-16586/): SQL injection in Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe (medium 6.5)
- [CVE-2026-16585](https://insights.sbomify.com/CVE-2026-16585/): Path traversal in Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots (high 7.2)
- [CVE-2026-16584](https://insights.sbomify.com/CVE-2026-16584/): AWS API MCP Server Security Policy Bypass via Startup Failure (high 7.3)
- [CVE-2026-16583](https://insights.sbomify.com/CVE-2026-16583/): Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload (medium 6.1)
- [CVE-2026-16582](https://insights.sbomify.com/CVE-2026-16582/): Missing authorization in Booking for Appointments and Events Calendar – Amelia (medium 5.3)
- [CVE-2026-16581](https://insights.sbomify.com/CVE-2026-16581/): Inclusion of sensitive information in source code in igloohome Smart Lock Mobile Application (medium 6.9)
- [CVE-2026-1658](https://insights.sbomify.com/CVE-2026-1658/): Content spoofing vulnerability discovered in OpenText™ Directory Services (medium 5.3)
- [CVE-2026-16578](https://insights.sbomify.com/CVE-2026-16578/): Admin Safety Guard < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route (high 7.5)
- [CVE-2026-16577](https://insights.sbomify.com/CVE-2026-16577/): Dokan < 5.0.14 - Vendor+ Reverse Withdrawal Ledger Manipulation via Client-Supplied Amount (low 2.7)
- [CVE-2026-16576](https://insights.sbomify.com/CVE-2026-16576/): Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API (high 7.2)
- [CVE-2026-16575](https://insights.sbomify.com/CVE-2026-16575/): Dokan < 5.0.14 - Unauthenticated Commission Settings Disclosure via Store Categories REST Endpoint (medium 5.3)
- [CVE-2026-16574](https://insights.sbomify.com/CVE-2026-16574/): Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint (medium 5.4)
- [CVE-2026-16573](https://insights.sbomify.com/CVE-2026-16573/): Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload (high 7.5)
- [CVE-2026-16572](https://insights.sbomify.com/CVE-2026-16572/): LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie (high 8.6)
- [CVE-2026-16570](https://insights.sbomify.com/CVE-2026-16570/): NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback (high 7.1)
- [CVE-2026-1657](https://insights.sbomify.com/CVE-2026-1657/): EventPrime <= 4.2.8.4 - Missing Authorization to Unauthenticated Image Upload via 'ep_upload_file_media' AJAX Endpoint (medium 5.3)
- [CVE-2026-16569](https://insights.sbomify.com/CVE-2026-16569/): ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update (medium 4.3)
- [CVE-2026-16568](https://insights.sbomify.com/CVE-2026-16568/): ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR (medium 4.3)
- [CVE-2026-16567](https://insights.sbomify.com/CVE-2026-16567/): Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle (medium 5.3)
- [CVE-2026-16565](https://insights.sbomify.com/CVE-2026-16565/): Dokan < 5.0.9 - Vendor+ Cross-Vendor Product Attribute Modification via Product Attribute REST API (medium 4.3)
- [CVE-2026-16564](https://insights.sbomify.com/CVE-2026-16564/): Dokan < 5.0.9 - Vendor+ Arbitrary Order Status Modification via orders/bulk-actions REST Endpoint (medium 4.3)
- [CVE-2026-16563](https://insights.sbomify.com/CVE-2026-16563/): Academy LMS < 3.8.3 - Subscriber+ Arbitrary Lesson Content Disclosure via lessons REST Endpoint (medium 6.5)
- [CVE-2026-16562](https://insights.sbomify.com/CVE-2026-16562/): WP Statistics < 14.16.10 - Subscriber+ Sensitive Data Disclosure via Metabox AJAX Handlers (medium 6.5)
- [CVE-2026-16561](https://insights.sbomify.com/CVE-2026-16561/): Sunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure (high 7.5)
- [CVE-2026-16560](https://insights.sbomify.com/CVE-2026-16560/): 389-ds-base: 389-ds-base: heap-buffer-overflow in rdn_av_swap on quoted multivalued rdn (medium 5.3)
- [CVE-2026-1656](https://insights.sbomify.com/CVE-2026-1656/): Business Directory Plugin <= 6.4.20 - Missing Authorization to Unauthenticated Arbitrary Listing Modification (medium 5.3)
- [CVE-2026-16559](https://insights.sbomify.com/CVE-2026-16559/): YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload (medium 6.8)
- [CVE-2026-16558](https://insights.sbomify.com/CVE-2026-16558/): YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema (medium 5.4)
- [CVE-2026-16557](https://insights.sbomify.com/CVE-2026-16557/): Nimble Builder <= 3.3.8 - Subscriber+ Non-Public Content Disclosure via sek_get_nimble_content_for_seo_plugins (medium 4.3)
- [CVE-2026-16554](https://insights.sbomify.com/CVE-2026-16554/): Integer Overflow Leading to Heap Buffer Overflow in cJSON (medium 5.1)
- [CVE-2026-16553](https://insights.sbomify.com/CVE-2026-16553/): Insufficiently Protected Credentials in GitLab (medium 5.4)
- [CVE-2026-16551](https://insights.sbomify.com/CVE-2026-16551/): Denial-of-Service in OpenCanary's MongoDB module (medium 6.9)
- [CVE-2026-1655](https://insights.sbomify.com/CVE-2026-1655/): Missing authorization in EventPrime – Events Calendar, Bookings and Tickets (medium 4.3)
- [CVE-2026-16548](https://insights.sbomify.com/CVE-2026-16548/): Bit Assist < 1.8.2 - Unauthenticated Arbitrary File Upload via Response Endpoint (medium 6.5)
- [CVE-2026-16547](https://insights.sbomify.com/CVE-2026-16547/): REST API Log < 1.7.1 - Unauthenticated Sensitive Log Data Disclosure via Download Endpoint (medium 5.9)
- [CVE-2026-16546](https://insights.sbomify.com/CVE-2026-16546/): Wired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp (medium 4.3)
- [CVE-2026-16544](https://insights.sbomify.com/CVE-2026-16544/): Missing authorization in Red Hat Ansible Automation Platform 2 (medium 6.5)
- [CVE-2026-16543](https://insights.sbomify.com/CVE-2026-16543/): Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision (high 7.1)
- [CVE-2026-16542](https://insights.sbomify.com/CVE-2026-16542/): Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar (medium 4.1)
- [CVE-2026-16541](https://insights.sbomify.com/CVE-2026-16541/): Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints (medium 6.5)
- [CVE-2026-16540](https://insights.sbomify.com/CVE-2026-16540/): Missing authorization in Simply Schedule Appointments (high 7.5)
- [CVE-2026-1654](https://insights.sbomify.com/CVE-2026-1654/): Peter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] (medium 6.1)
- [CVE-2026-16539](https://insights.sbomify.com/CVE-2026-16539/): SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication (high 8.1)
- [CVE-2026-16538](https://insights.sbomify.com/CVE-2026-16538/): TeraWallet - Wallet for WooCommerce < 1.6.10 - Subscriber+ Wallet Balance Inflation via Discounted Top-Up (critical 9.1)
- [CVE-2026-16537](https://insights.sbomify.com/CVE-2026-16537/): Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode (medium 5.4)
- [CVE-2026-16536](https://insights.sbomify.com/CVE-2026-16536/): Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id (medium 5.3)
- [CVE-2026-16535](https://insights.sbomify.com/CVE-2026-16535/): Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel (medium 6.1)
- [CVE-2026-16534](https://insights.sbomify.com/CVE-2026-16534/): Import and export users and customers < 2.4.2 - Custom Role Privilege Escalation to Administrator via CSV Import (critical 9.1)
- [CVE-2026-16532](https://insights.sbomify.com/CVE-2026-16532/): Link Library < 7.9.3 - Unauthenticated SQL Injection via the Front-End Link Submission Form (critical 9.1)
- [CVE-2026-16531](https://insights.sbomify.com/CVE-2026-16531/): Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet (medium 5.3)
- [CVE-2026-16530](https://insights.sbomify.com/CVE-2026-16530/): Pcp: pcp: remote denial of service and information leakage (medium 6.5)
- [CVE-2026-1653](https://insights.sbomify.com/CVE-2026-1653/): Denial of service in Smart Connect (medium 6.8)
- [CVE-2026-16529](https://insights.sbomify.com/CVE-2026-16529/): Pcp: pcp: denial of service due to signed integer overflow (high 7.5)
- [CVE-2026-16528](https://insights.sbomify.com/CVE-2026-16528/): Information disclosure in Router (high 8.4)
- [CVE-2026-16527](https://insights.sbomify.com/CVE-2026-16527/): Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules (high 7.3)
- [CVE-2026-16526](https://insights.sbomify.com/CVE-2026-16526/): Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerability (high 8.8)
- [CVE-2026-16524](https://insights.sbomify.com/CVE-2026-16524/): Pcp: pcp linux_sockets pmda: arbitrary command execution via command injection (high 7.8)
- [CVE-2026-16521](https://insights.sbomify.com/CVE-2026-16521/): Supermicro BMC's syslog feature contains a command injection vulnerability (high 7.2)
- [CVE-2026-16520](https://insights.sbomify.com/CVE-2026-16520/): SQL injection in Genian NAC V4.0 (high 8.7)
- [CVE-2026-1652](https://insights.sbomify.com/CVE-2026-1652/): Memory corruption in Smart Connect (medium 6.9)
- [CVE-2026-16519](https://insights.sbomify.com/CVE-2026-16519/): GeoVision GV-IP Device Utility DLL Search Order Hijacking Vulnerability (high 7.3)
- [CVE-2026-16517](https://insights.sbomify.com/CVE-2026-16517/): Libarchive: libarchive: signed integer overflow in archive_write_zip_header (low 2.9)
- [CVE-2026-16516](https://insights.sbomify.com/CVE-2026-16516/): wolfSSH ECDSA host key curve not validated against negotiated algorithm (critical 9.0)
- [CVE-2026-16515](https://insights.sbomify.com/CVE-2026-16515/): Denial of service in zephyr (medium 4.7)
- [CVE-2026-16514](https://insights.sbomify.com/CVE-2026-16514/): Out-of-bounds read in gPTP Announce path-trace validation via unvalidated stepsRemoved (medium 4.3)
- [CVE-2026-16513](https://insights.sbomify.com/CVE-2026-16513/): Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write (high 7.8)
- [CVE-2026-16512](https://insights.sbomify.com/CVE-2026-16512/): Out-of-bounds read in the Zephyr gPTP receive path when handling short Ethernet frames (low 3.1)
- [CVE-2026-1651](https://insights.sbomify.com/CVE-2026-1651/): Email Subscribers & Newsletters <= 5.9.16 - Authenticated (Administrator+) SQL Injection via 'workflow_ids' Parameter (medium 6.5)
- [CVE-2026-16504](https://insights.sbomify.com/CVE-2026-16504/): VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities (critical 9.8)
- [CVE-2026-16503](https://insights.sbomify.com/CVE-2026-16503/): VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities (critical 9.1)
- [CVE-2026-16502](https://insights.sbomify.com/CVE-2026-16502/): Live Composer <= 2.1.18 - Authenticated (Contributor+) PHP Object Injection via Shortcode (high 8.8)
- [CVE-2026-1650](https://insights.sbomify.com/CVE-2026-1650/): MDJM Event Management <= 1.7.8.1 - Missing Authorization to Unauthenticated Arbitrary Custom Event Field Deletion (medium 5.3)
- [CVE-2026-16498](https://insights.sbomify.com/CVE-2026-16498/): terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode (critical 10.0)
- [CVE-2026-16497](https://insights.sbomify.com/CVE-2026-16497/): Denial of service in Triton Inference Server (high 7.5)
- [CVE-2026-16496](https://insights.sbomify.com/CVE-2026-16496/): terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user (high 8.9)
- [CVE-2026-16495](https://insights.sbomify.com/CVE-2026-16495/): Cross-site scripting in Countdown Timer – Widget Countdown (medium 6.4)
- [CVE-2026-16494](https://insights.sbomify.com/CVE-2026-16494/): Missing Authorization in GitLab (high 7.1)
- [CVE-2026-16493](https://insights.sbomify.com/CVE-2026-16493/): Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332) (high 7.8)
- [CVE-2026-16492](https://insights.sbomify.com/CVE-2026-16492/): umijs umi GIT File Helper getFileGitIno.ts git.getFileCreateInfo os command injection (medium 5.1)
- [CVE-2026-16491](https://insights.sbomify.com/CVE-2026-16491/): CVE-2026-16491 CVE Record (medium 6.5)
- [CVE-2026-16490](https://insights.sbomify.com/CVE-2026-16490/): itsourcecode Hospital Management System prescription.php sql injection (medium 5.3)
- [CVE-2026-1649](https://insights.sbomify.com/CVE-2026-1649/): Community Events <= 1.5.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ce_venue_name' Parameter (medium 4.4)
- [CVE-2026-16489](https://insights.sbomify.com/CVE-2026-16489/): jsforce SFDX Connection Registry sfdx.js _execCommand os command injection (medium 4.8)
- [CVE-2026-16488](https://insights.sbomify.com/CVE-2026-16488/): QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection (low 2.3)
- [CVE-2026-16486](https://insights.sbomify.com/CVE-2026-16486/): SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/848/