# Vulnerabilities published in 2026


- [CVE-2026-16485](https://insights.sbomify.com/CVE-2026-16485/): SourceCodester Class and Exam Timetabling System class.php cross site scripting (medium 5.3)
- [CVE-2026-16484](https://insights.sbomify.com/CVE-2026-16484/): SourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection (medium 6.9)
- [CVE-2026-16482](https://insights.sbomify.com/CVE-2026-16482/): rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter (high 7.5)
- [CVE-2026-16481](https://insights.sbomify.com/CVE-2026-16481/): Server-side request forgery in MCP Toolbox for Databases (googleapis/mcp-toolbox) (medium 6.0)
- [CVE-2026-16480](https://insights.sbomify.com/CVE-2026-16480/): Missing authorization in Db2 (medium 4.3)
- [CVE-2026-1648](https://insights.sbomify.com/CVE-2026-1648/): Performance Monitor <= 1.0.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter (high 7.2)
- [CVE-2026-16477](https://insights.sbomify.com/CVE-2026-16477/): Insecure Deserialization of .cleanshot Files in CleanShot X (high 8.4)
- [CVE-2026-16473](https://insights.sbomify.com/CVE-2026-16473/): Sbc: sbc: heap out-of-bounds read via crafted sbc audio frame (medium 4.3)
- [CVE-2026-16471](https://insights.sbomify.com/CVE-2026-16471/): Broken Access Control in Dolusoft Software's Sonlogger (high 7.5)
- [CVE-2026-1647](https://insights.sbomify.com/CVE-2026-1647/): Comment Genius <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] (medium 6.1)
- [CVE-2026-16469](https://insights.sbomify.com/CVE-2026-16469/): DataStage on Cloud Pak for Data has several vulnerabilities (high 8.8)
- [CVE-2026-16468](https://insights.sbomify.com/CVE-2026-16468/): DataStage on Cloud Pak for Data has several vulnerabilities (high 8.8)
- [CVE-2026-16467](https://insights.sbomify.com/CVE-2026-16467/): Broken Access Control in Dolusoft Software's Fortilogger (high 7.5)
- [CVE-2026-16466](https://insights.sbomify.com/CVE-2026-16466/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.8)
- [CVE-2026-16465](https://insights.sbomify.com/CVE-2026-16465/): DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD (medium 6.1)
- [CVE-2026-16463](https://insights.sbomify.com/CVE-2026-16463/): DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD (high 7.8)
- [CVE-2026-16462](https://insights.sbomify.com/CVE-2026-16462/): SQL injection via unauthenticated GetGridData endpoint (critical 9.3)
- [CVE-2026-16461](https://insights.sbomify.com/CVE-2026-16461/): Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbdump() short-mode version-list formatting (medium 6.5)
- [CVE-2026-16460](https://insights.sbomify.com/CVE-2026-16460/): Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization (high 7.4)
- [CVE-2026-1646](https://insights.sbomify.com/CVE-2026-1646/): Advance Block Extend <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleColor Block Attribute (medium 6.4)
- [CVE-2026-16459](https://insights.sbomify.com/CVE-2026-16459/): Timing side-channel in RSA PKCS#1 v1.5 decryption in Oberon PSA Crypto (medium 5.9)
- [CVE-2026-16458](https://insights.sbomify.com/CVE-2026-16458/): Timing side-channel in RSA PKCS#1 v1.5 decryption in ocrypto (medium 5.9)
- [CVE-2026-16456](https://insights.sbomify.com/CVE-2026-16456/): Odh-model-controller: odh-model-controller: cross-namespace secret read via nim account crd confused deputy (medium 6.5)
- [CVE-2026-16455](https://insights.sbomify.com/CVE-2026-16455/): Local privilege escalation via improper input sanitization in execl() call (medium 6.9)
- [CVE-2026-16454](https://insights.sbomify.com/CVE-2026-16454/): Privilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration (medium 4.3)
- [CVE-2026-16453](https://insights.sbomify.com/CVE-2026-16453/): Mattermost SAML RelayState forgery allows unauthorized team membership (high 7.1)
- [CVE-2026-16451](https://insights.sbomify.com/CVE-2026-16451/): zsadmin2025 ZS-Admin com.zs.file.controller.SysFileController upload unrestricted upload (medium 5.3)
- [CVE-2026-16450](https://insights.sbomify.com/CVE-2026-16450/): zsadmin2025 ZS-Admin MyBatis-Plus Tenant Plugin page getTenantId authorization (medium 5.3)
- [CVE-2026-1645](https://insights.sbomify.com/CVE-2026-1645/): Cross-site scripting in Hostel (medium 4.4)
- [CVE-2026-16449](https://insights.sbomify.com/CVE-2026-16449/): zsadmin2025 ZS-Admin com.zs.sys.dept.controller.SysDeptController page OrderItem.desc sql injection (medium 5.3)
- [CVE-2026-16448](https://insights.sbomify.com/CVE-2026-16448/): D-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection (medium 5.3)
- [CVE-2026-16447](https://insights.sbomify.com/CVE-2026-16447/): D-Link DNS-320 multi_uploadify.php unrestricted upload (medium 6.9)
- [CVE-2026-16445](https://insights.sbomify.com/CVE-2026-16445/): Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module (high 7.5)
- [CVE-2026-16444](https://insights.sbomify.com/CVE-2026-16444/): Improper Validation of File Paths in TeamViewer Desktop Clients (high 7.5)
- [CVE-2026-16443](https://insights.sbomify.com/CVE-2026-16443/): Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation (high 7.4)
- [CVE-2026-16442](https://insights.sbomify.com/CVE-2026-16442/): Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction (high 7.4)
- [CVE-2026-16441](https://insights.sbomify.com/CVE-2026-16441/): Eclipse OpenJ9 : Method resolution default method precedence failure (medium 6.9)
- [CVE-2026-16440](https://insights.sbomify.com/CVE-2026-16440/): Denial of service in Eclipse OpenJ9 (medium 5.7)
- [CVE-2026-1644](https://insights.sbomify.com/CVE-2026-1644/): WP Frontend Profile <= 1.3.8 - Cross-Site Request Forgery to Unauthorized User Account Approval or Rejection (medium 4.3)
- [CVE-2026-16439](https://insights.sbomify.com/CVE-2026-16439/): Eclipse OpenJ9 : Using -Xtrace to trace method arguments can lead to buffer underflow (medium 5.8)
- [CVE-2026-16438](https://insights.sbomify.com/CVE-2026-16438/): An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64 (critical 9.4)
- [CVE-2026-16437](https://insights.sbomify.com/CVE-2026-16437/): Auth bypass in AnalytiX (high 7.1)
- [CVE-2026-16436](https://insights.sbomify.com/CVE-2026-16436/): Auth bypass in AnalytiX (critical 9.2)
- [CVE-2026-16435](https://insights.sbomify.com/CVE-2026-16435/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 5.9)
- [CVE-2026-16434](https://insights.sbomify.com/CVE-2026-16434/): Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass (low 2.3)
- [CVE-2026-16432](https://insights.sbomify.com/CVE-2026-16432/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 7.7)
- [CVE-2026-1643](https://insights.sbomify.com/CVE-2026-1643/): MP-Ukagaka <= 1.5.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2026-16428](https://insights.sbomify.com/CVE-2026-16428/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.8)
- [CVE-2026-16426](https://insights.sbomify.com/CVE-2026-16426/): Multiple Vulnerabilities in IBM Concert Software (medium 6.5)
- [CVE-2026-16424](https://insights.sbomify.com/CVE-2026-16424/): Use after free in Chrome (critical 9.6)
- [CVE-2026-16423](https://insights.sbomify.com/CVE-2026-16423/): Use after free in Chrome (high 8.8)
- [CVE-2026-16422](https://insights.sbomify.com/CVE-2026-16422/): Security feature bypass in Chrome (high 7.5)
- [CVE-2026-16421](https://insights.sbomify.com/CVE-2026-16421/): Code injection in Chrome (high 8.8)
- [CVE-2026-16420](https://insights.sbomify.com/CVE-2026-16420/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-1642](https://insights.sbomify.com/CVE-2026-1642/): NGINX vulnerability (high 8.2)
- [CVE-2026-16419](https://insights.sbomify.com/CVE-2026-16419/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-16418](https://insights.sbomify.com/CVE-2026-16418/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-16417](https://insights.sbomify.com/CVE-2026-16417/): Information disclosure in Chrome (low 3.1)
- [CVE-2026-16416](https://insights.sbomify.com/CVE-2026-16416/): Integer overflow in Chrome (critical 9.3)
- [CVE-2026-16415](https://insights.sbomify.com/CVE-2026-16415/): Other in Chrome (medium 5.4)
- [CVE-2026-16414](https://insights.sbomify.com/CVE-2026-16414/): Security feature bypass in Chrome (critical 9.3)
- [CVE-2026-16413](https://insights.sbomify.com/CVE-2026-16413/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-16412](https://insights.sbomify.com/CVE-2026-16412/): Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 (critical 9.8)
- [CVE-2026-16411](https://insights.sbomify.com/CVE-2026-16411/): Memory safety bugs fixed in Thunderbird 153 (critical 9.8)
- [CVE-2026-16410](https://insights.sbomify.com/CVE-2026-16410/): JIT miscompilation in the JavaScript Engine: JIT component (critical 9.8)
- [CVE-2026-1641](https://insights.sbomify.com/CVE-2026-1641/): Server-side request forgery in Wow Elements Addons for Elementor (medium 6.5)
- [CVE-2026-16409](https://insights.sbomify.com/CVE-2026-16409/): Invalid pointer in the Security: PSM component (high 7.5)
- [CVE-2026-16408](https://insights.sbomify.com/CVE-2026-16408/): Integer overflow in the Audio/Video: Playback component (critical 9.8)
- [CVE-2026-16407](https://insights.sbomify.com/CVE-2026-16407/): Mitigation bypass in the DOM: Service Workers component (critical 9.8)
- [CVE-2026-16406](https://insights.sbomify.com/CVE-2026-16406/): Mitigation bypass in the Networking component (critical 9.1)
- [CVE-2026-16405](https://insights.sbomify.com/CVE-2026-16405/): Information disclosure in the Networking: WebSockets component (high 7.5)
- [CVE-2026-16404](https://insights.sbomify.com/CVE-2026-16404/): Spoofing issue in Firefox for Android (high 7.4)
- [CVE-2026-16403](https://insights.sbomify.com/CVE-2026-16403/): Spoofing issue in the Address Bar component (medium 6.5)
- [CVE-2026-16402](https://insights.sbomify.com/CVE-2026-16402/): Integer overflow in the Graphics: ImageLib component (critical 9.8)
- [CVE-2026-16401](https://insights.sbomify.com/CVE-2026-16401/): Privilege escalation in the Data Loss Prevention component (high 8.8)
- [CVE-2026-16400](https://insights.sbomify.com/CVE-2026-16400/): Information disclosure in the DOM: Security component (high 7.5)
- [CVE-2026-1640](https://insights.sbomify.com/CVE-2026-1640/): Taskbuilder <= 5.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Project/Task Comment Creation (medium 4.3)
- [CVE-2026-16399](https://insights.sbomify.com/CVE-2026-16399/): Site isolation issue in the DOM: Navigation component (high 7.5)
- [CVE-2026-16398](https://insights.sbomify.com/CVE-2026-16398/): Site isolation issue in the Graphics component (high 7.5)
- [CVE-2026-16397](https://insights.sbomify.com/CVE-2026-16397/): Clickjacking issue in the WebExtensions component in Firefox for Android (medium 6.5)
- [CVE-2026-16396](https://insights.sbomify.com/CVE-2026-16396/): Privilege escalation in WebExtensions (high 8.8)
- [CVE-2026-16395](https://insights.sbomify.com/CVE-2026-16395/): Integer overflow in the Audio/Video component (critical 9.8)
- [CVE-2026-16394](https://insights.sbomify.com/CVE-2026-16394/): Mitigation bypass in the DOM: Security component (critical 9.1)
- [CVE-2026-16393](https://insights.sbomify.com/CVE-2026-16393/): Incorrect boundary conditions in the Graphics: WebGPU component (critical 9.1)
- [CVE-2026-16392](https://insights.sbomify.com/CVE-2026-16392/): JIT miscompilation in the JavaScript Engine: JIT component (critical 9.1)
- [CVE-2026-16391](https://insights.sbomify.com/CVE-2026-16391/): Information disclosure in the Storage: IndexedDB component (high 7.5)
- [CVE-2026-16390](https://insights.sbomify.com/CVE-2026-16390/): Mitigation bypass in the Enterprise Policies component (critical 9.1)
- [CVE-2026-1639](https://insights.sbomify.com/CVE-2026-1639/): Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters (medium 6.5)
- [CVE-2026-16389](https://insights.sbomify.com/CVE-2026-16389/): Incorrect boundary conditions, integer overflow in the Libraries component in NSS (critical 9.8)
- [CVE-2026-16388](https://insights.sbomify.com/CVE-2026-16388/): Sandbox escape in the DOM: Networking component (critical 9.8)
- [CVE-2026-16387](https://insights.sbomify.com/CVE-2026-16387/): Site isolation issue in the Networking component (critical 9.8)
- [CVE-2026-16386](https://insights.sbomify.com/CVE-2026-16386/): Information disclosure due to uninitialized memory in the Graphics: WebGPU component (high 7.5)
- [CVE-2026-16385](https://insights.sbomify.com/CVE-2026-16385/): Information disclosure due to uninitialized memory in the Graphics: WebGPU component (high 7.5)
- [CVE-2026-16384](https://insights.sbomify.com/CVE-2026-16384/): Information disclosure due to uninitialized memory in the Graphics: WebGPU component (high 7.5)
- [CVE-2026-16383](https://insights.sbomify.com/CVE-2026-16383/): Mitigation bypass in the DOM: Networking component (critical 9.8)
- [CVE-2026-16382](https://insights.sbomify.com/CVE-2026-16382/): Mitigation bypass in the DOM: Service Workers component (critical 9.8)
- [CVE-2026-16381](https://insights.sbomify.com/CVE-2026-16381/): Same-origin policy bypass in the Networking: DNS component (critical 9.1)
- [CVE-2026-16380](https://insights.sbomify.com/CVE-2026-16380/): Mitigation bypass in the Networking component (critical 9.1)
- [CVE-2026-1638](https://insights.sbomify.com/CVE-2026-1638/): Tenda AC21 mDMZSetCfg command injection (medium 5.3)
- [CVE-2026-16379](https://insights.sbomify.com/CVE-2026-16379/): Privilege escalation in the DOM: Content Processes component (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/849/