# Vulnerabilities published in 2026


- [CVE-2026-16378](https://insights.sbomify.com/CVE-2026-16378/): Other issue in the DOM: Copy & Paste and Drag & Drop component (high 7.5)
- [CVE-2026-16377](https://insights.sbomify.com/CVE-2026-16377/): Mitigation bypass in the PDF Viewer component (critical 9.8)
- [CVE-2026-16376](https://insights.sbomify.com/CVE-2026-16376/): Denial-of-service in the Graphics: WebGPU component (high 7.5)
- [CVE-2026-16375](https://insights.sbomify.com/CVE-2026-16375/): Site isolation issue in the Networking: HTTP component (critical 9.8)
- [CVE-2026-16374](https://insights.sbomify.com/CVE-2026-16374/): Information disclosure in the Framework component in DevTools (high 7.5)
- [CVE-2026-16373](https://insights.sbomify.com/CVE-2026-16373/): Information disclosure in the Privacy component in Firefox for Android (high 7.5)
- [CVE-2026-16372](https://insights.sbomify.com/CVE-2026-16372/): Privilege escalation in the DOM: Content Processes component (high 8.8)
- [CVE-2026-16371](https://insights.sbomify.com/CVE-2026-16371/): Privilege escalation in the DOM: Navigation component (high 8.8)
- [CVE-2026-16370](https://insights.sbomify.com/CVE-2026-16370/): Mitigation bypass in the DOM: Networking component (critical 9.1)
- [CVE-2026-1637](https://insights.sbomify.com/CVE-2026-1637/): Tenda AC21 AdvSetMacMtuWan fromAdvSetMacMtuWan stack-based overflow (high 8.7)
- [CVE-2026-16369](https://insights.sbomify.com/CVE-2026-16369/): Integer overflow in the JavaScript: WebAssembly component (critical 9.8)
- [CVE-2026-16368](https://insights.sbomify.com/CVE-2026-16368/): Incorrect boundary conditions in the JavaScript: WebAssembly component (critical 9.8)
- [CVE-2026-16367](https://insights.sbomify.com/CVE-2026-16367/): Sandbox escape due to invalid pointer in the Disability Access APIs component (critical 10.0)
- [CVE-2026-16366](https://insights.sbomify.com/CVE-2026-16366/): Privilege escalation in the DOM: Navigation component (high 8.8)
- [CVE-2026-16365](https://insights.sbomify.com/CVE-2026-16365/): Privilege escalation in the DOM: Workers component (high 8.8)
- [CVE-2026-16364](https://insights.sbomify.com/CVE-2026-16364/): Incorrect boundary conditions in the Audio/Video: Playback component (critical 9.1)
- [CVE-2026-16363](https://insights.sbomify.com/CVE-2026-16363/): JIT miscompilation in the JavaScript: WebAssembly component (critical 9.8)
- [CVE-2026-16362](https://insights.sbomify.com/CVE-2026-16362/): Use-after-free in the WebRTC: Audio/Video component (high 8.8)
- [CVE-2026-16361](https://insights.sbomify.com/CVE-2026-16361/): Memory safety bugs fixed in Thunderbird ESR 140.13 (critical 9.8)
- [CVE-2026-16360](https://insights.sbomify.com/CVE-2026-16360/): Memory safety bugs fixed in Thunderbird ESR 140.13 and Thunderbird 153 (critical 9.8)
- [CVE-2026-1636](https://insights.sbomify.com/CVE-2026-1636/): Privilege escalation in Service Bridge (medium 5.4)
- [CVE-2026-16359](https://insights.sbomify.com/CVE-2026-16359/): Incorrect boundary conditions in the Audio/Video: GMP component (critical 9.1)
- [CVE-2026-16358](https://insights.sbomify.com/CVE-2026-16358/): Site isolation issue in the Graphics: WebRender component (critical 9.8)
- [CVE-2026-16357](https://insights.sbomify.com/CVE-2026-16357/): Incorrect boundary conditions in the Graphics component (critical 9.8)
- [CVE-2026-16356](https://insights.sbomify.com/CVE-2026-16356/): Sandbox escape due to use-after-free in the Disability Access APIs component (critical 9.8)
- [CVE-2026-16355](https://insights.sbomify.com/CVE-2026-16355/): JIT miscompilation in the JavaScript Engine: JIT component (critical 9.8)
- [CVE-2026-16354](https://insights.sbomify.com/CVE-2026-16354/): Information disclosure in the Graphics: ImageLib component (high 7.5)
- [CVE-2026-16353](https://insights.sbomify.com/CVE-2026-16353/): Invalid pointer in the DOM: Bindings (WebIDL) component (critical 9.8)
- [CVE-2026-16352](https://insights.sbomify.com/CVE-2026-16352/): Sandbox escape due to use-after-free in the Disability Access APIs component (critical 9.8)
- [CVE-2026-16351](https://insights.sbomify.com/CVE-2026-16351/): Sandbox escape due to use-after-free in the DOM: Navigation component (critical 9.8)
- [CVE-2026-16350](https://insights.sbomify.com/CVE-2026-16350/): Incorrect boundary conditions in the Audio/Video: cubeb component (critical 9.8)
- [CVE-2026-16349](https://insights.sbomify.com/CVE-2026-16349/): Same-origin policy bypass in the DOM: Navigation component (critical 9.8)
- [CVE-2026-16348](https://insights.sbomify.com/CVE-2026-16348/): Command Injection Vulnerability in VPN connection of Archer BE800 (high 8.5)
- [CVE-2026-16347](https://insights.sbomify.com/CVE-2026-16347/): Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud Hosted Router (high 8.7)
- [CVE-2026-16346](https://insights.sbomify.com/CVE-2026-16346/): DataStage on Cloud Pak for Data has several vulnerabilities (critical 9.9)
- [CVE-2026-16340](https://insights.sbomify.com/CVE-2026-16340/): IBM DataPower Gateway Out-of-bounds Write (critical 9.8)
- [CVE-2026-1634](https://insights.sbomify.com/CVE-2026-1634/): Subitem AL Slider <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] (medium 6.1)
- [CVE-2026-16338](https://insights.sbomify.com/CVE-2026-16338/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (critical 9.9)
- [CVE-2026-16337](https://insights.sbomify.com/CVE-2026-16337/): Privilege escalation in dotCMS (critical 9.4)
- [CVE-2026-16336](https://insights.sbomify.com/CVE-2026-16336/): trinodb trino OAuth2/OIDC ExternalUriInfo.java redirect (medium 5.3)
- [CVE-2026-16335](https://insights.sbomify.com/CVE-2026-16335/): DataStage on Cloud Pak for Data has several vulnerabilities due to open source software (high 8.1)
- [CVE-2026-16334](https://insights.sbomify.com/CVE-2026-16334/): itsourcecode Hospital Management System prescriptionorder.php sql injection (medium 5.3)
- [CVE-2026-16332](https://insights.sbomify.com/CVE-2026-16332/): D-Link DNS-320 multi_uploadify.php unrestricted upload (medium 6.9)
- [CVE-2026-16331](https://insights.sbomify.com/CVE-2026-16331/): D-Link DNS-320 save_ajax.php unrestricted upload (medium 6.9)
- [CVE-2026-16330](https://insights.sbomify.com/CVE-2026-16330/): D-Link DNS-320 uploadify.php unrestricted upload (medium 6.9)
- [CVE-2026-1633](https://insights.sbomify.com/CVE-2026-1633/): Synectix LAN 232 TRIO Missing Authentication for Critical Function (critical 10.0)
- [CVE-2026-16329](https://insights.sbomify.com/CVE-2026-16329/): D-Link DNS-320 uploadify.php unrestricted upload (medium 6.9)
- [CVE-2026-16328](https://insights.sbomify.com/CVE-2026-16328/): consul-mcp-server vulnerable to server side request forgery leading to token exposure (high 8.6)
- [CVE-2026-16327](https://insights.sbomify.com/CVE-2026-16327/): D-Link DNS-320 upload.php unrestricted upload (medium 6.9)
- [CVE-2026-16326](https://insights.sbomify.com/CVE-2026-16326/): consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode (critical 10.0)
- [CVE-2026-16324](https://insights.sbomify.com/CVE-2026-16324/): Metasoft 美特软件 MetaCRM upload.jsp unrestricted upload (medium 6.9)
- [CVE-2026-16323](https://insights.sbomify.com/CVE-2026-16323/): Authentication Bypass via Execution After Redirect in FuyaSoft's Architect Panel Web Management Panel (high 7.5)
- [CVE-2026-1632](https://insights.sbomify.com/CVE-2026-1632/): RISS SRL MOMA Seismic Station Missing Authentication for Critical Function (critical 9.3)
- [CVE-2026-16318](https://insights.sbomify.com/CVE-2026-16318/): QUIC Transport Parameters Memory Leak During HelloRetryRequest in s2n-tls (medium 6.9)
- [CVE-2026-16317](https://insights.sbomify.com/CVE-2026-16317/): Silent Drop of TLS 1.3 Encrypted Records in s2n-tls (high 8.3)
- [CVE-2026-16316](https://insights.sbomify.com/CVE-2026-16316/): Malformed IEC 61850 Sampled Values frames cause partial denial of service in StationGuard (low 1.3)
- [CVE-2026-16315](https://insights.sbomify.com/CVE-2026-16315/): Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard (high 8.1)
- [CVE-2026-16313](https://insights.sbomify.com/CVE-2026-16313/): Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (high 7.6)
- [CVE-2026-16310](https://insights.sbomify.com/CVE-2026-16310/): MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter (critical 9.8)
- [CVE-2026-1631](https://insights.sbomify.com/CVE-2026-1631/): Feeds for YouTube < 2.6.4 - Subscriber+ License Data Deletion (medium 5.4)
- [CVE-2026-16309](https://insights.sbomify.com/CVE-2026-16309/): IDOR in Netiket Information Technologies' EdoWEB (medium 5.3)
- [CVE-2026-16308](https://insights.sbomify.com/CVE-2026-16308/): IBM Enterprise Build of Quarkus is affected by a DoS vulnerability (high 7.5)
- [CVE-2026-16307](https://insights.sbomify.com/CVE-2026-16307/): IDOR in Netiket Information Technologies' EdoWEB (medium 4.3)
- [CVE-2026-16302](https://insights.sbomify.com/CVE-2026-16302/): Spectra Legacy – Gutenberg Blocks <= 2.20.0 - Authenticated (Contributor+) Sensitive Information Exposure (medium 4.3)
- [CVE-2026-16301](https://insights.sbomify.com/CVE-2026-16301/): Incorrect Authorization in GitLab (high 8.5)
- [CVE-2026-16300](https://insights.sbomify.com/CVE-2026-16300/): Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset (critical 9.8)
- [CVE-2026-1630](https://insights.sbomify.com/CVE-2026-1630/): Reflected XSS in WEBCON BPS (medium 5.1)
- [CVE-2026-16299](https://insights.sbomify.com/CVE-2026-16299/): Single Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password Reset (critical 9.8)
- [CVE-2026-16298](https://insights.sbomify.com/CVE-2026-16298/): FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset (critical 9.8)
- [CVE-2026-16297](https://insights.sbomify.com/CVE-2026-16297/): Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import (medium 4.1)
- [CVE-2026-16296](https://insights.sbomify.com/CVE-2026-16296/): Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler (medium 4.7)
- [CVE-2026-16295](https://insights.sbomify.com/CVE-2026-16295/): Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher (medium 4.3)
- [CVE-2026-16294](https://insights.sbomify.com/CVE-2026-16294/): Blubrry PowerPress < 11.17.1 - Contributor+ Server-Side Request Forgery via Podcast Episode Chapters URL (high 7.1)
- [CVE-2026-16293](https://insights.sbomify.com/CVE-2026-16293/): Blubrry PowerPress < 11.16.11 - Contributor+ Stored XSS via Podcast Episode Chapters URL (medium 6.8)
- [CVE-2026-16292](https://insights.sbomify.com/CVE-2026-16292/): Frontend File Manager Plugin <= 23.6 - File Metadata Update via CSRF (medium 5.4)
- [CVE-2026-16291](https://insights.sbomify.com/CVE-2026-16291/): ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR (medium 4.3)
- [CVE-2026-16290](https://insights.sbomify.com/CVE-2026-16290/): ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group (medium 5.3)
- [CVE-2026-1629](https://insights.sbomify.com/CVE-2026-1629/): Permalink Preview Information Disclosure After Permission Revocation (medium 4.3)
- [CVE-2026-16289](https://insights.sbomify.com/CVE-2026-16289/): ProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group (medium 4.3)
- [CVE-2026-16287](https://insights.sbomify.com/CVE-2026-16287/): Root Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update (high 7.8)
- [CVE-2026-16286](https://insights.sbomify.com/CVE-2026-16286/): File Upload in TRTEK Software's Software Repository Management (critical 9.8)
- [CVE-2026-16285](https://insights.sbomify.com/CVE-2026-16285/): WooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download (high 7.5)
- [CVE-2026-16282](https://insights.sbomify.com/CVE-2026-16282/): Appointment Hour Booking < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter (medium 5.3)
- [CVE-2026-16281](https://insights.sbomify.com/CVE-2026-16281/): Classified Listing < 6.1.1 - Subscriber+ Arbitrary Attachment Deletion and Listing Image Tampering via IDOR (high 7.1)
- [CVE-2026-16280](https://insights.sbomify.com/CVE-2026-16280/): GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset (critical 9.8)
- [CVE-2026-1628](https://insights.sbomify.com/CVE-2026-1628/): Mattermost allows external websites to open within the app, exposing preload functionality to non-trusted sites. (medium 4.6)
- [CVE-2026-16279](https://insights.sbomify.com/CVE-2026-16279/): Missing authorization in 3DSwymer (critical 9.3)
- [CVE-2026-16277](https://insights.sbomify.com/CVE-2026-16277/): Rpcbind: rpcbind: stack buffer overflow in rpcinfo rpcbaddrlist() (medium 6.5)
- [CVE-2026-16276](https://insights.sbomify.com/CVE-2026-16276/): Classified Listing < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search (low 2.7)
- [CVE-2026-16275](https://insights.sbomify.com/CVE-2026-16275/): Incorrect Authorization in GitLab (medium 5.3)
- [CVE-2026-16274](https://insights.sbomify.com/CVE-2026-16274/): Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts (low 2.7)
- [CVE-2026-16273](https://insights.sbomify.com/CVE-2026-16273/): Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta (medium 4.6)
- [CVE-2026-16272](https://insights.sbomify.com/CVE-2026-16272/): Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module (critical 9.1)
- [CVE-2026-16270](https://insights.sbomify.com/CVE-2026-16270/): ReDoS in Open Mercato (medium 6.9)
- [CVE-2026-1627](https://insights.sbomify.com/CVE-2026-1627/): Weak cryptography in SICK LMS1000 (medium 6.5)
- [CVE-2026-16269](https://insights.sbomify.com/CVE-2026-16269/): Newsletters < 4.16 - Unauthenticated API Authentication Bypass via Type Juggling (medium 4.8)
- [CVE-2026-16268](https://insights.sbomify.com/CVE-2026-16268/): Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler (high 8.2)
- [CVE-2026-16267](https://insights.sbomify.com/CVE-2026-16267/): Newsletters < 4.16 - Unauthenticated PHP Object Injection via Date Form Field (high 8.1)
- [CVE-2026-16266](https://insights.sbomify.com/CVE-2026-16266/): Code injection in mongo-object (medium 6.3)
- [CVE-2026-16265](https://insights.sbomify.com/CVE-2026-16265/): WP Maps < 4.9.7 - Subscriber+ Denial of Service (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/850/