# Vulnerabilities published in 2026


- [CVE-2026-16264](https://insights.sbomify.com/CVE-2026-16264/): Newsletters < 4.18.1 - Unauthenticated Subscriber Record Overwrite and PII Disclosure via IDOR (medium 6.5)
- [CVE-2026-16263](https://insights.sbomify.com/CVE-2026-16263/): WP Maps < 4.9.7 - Subscriber+ Local File Inclusion (high 8.8)
- [CVE-2026-16262](https://insights.sbomify.com/CVE-2026-16262/): Estatik < 4.3.3 - Login CSRF (high 7.5)
- [CVE-2026-16261](https://insights.sbomify.com/CVE-2026-16261/): Huge IT Login <= 1.0.4 - Unauthenticated Account Takeover (high 7.5)
- [CVE-2026-16260](https://insights.sbomify.com/CVE-2026-16260/): Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field (medium 6.8)
- [CVE-2026-1626](https://insights.sbomify.com/CVE-2026-1626/): Weak cryptography in SICK LMS1000 (medium 6.5)
- [CVE-2026-16259](https://insights.sbomify.com/CVE-2026-16259/): Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2026-16258](https://insights.sbomify.com/CVE-2026-16258/): Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint (critical 9.8)
- [CVE-2026-16257](https://insights.sbomify.com/CVE-2026-16257/): Arvow AI SEO Writer < 1.5.4 - Unauthenticated Arbitrary Post Creation via Webhook Secret Type-Juggling (high 8.2)
- [CVE-2026-16256](https://insights.sbomify.com/CVE-2026-16256/): Pouco Import Users <= 1.0.0 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2026-16255](https://insights.sbomify.com/CVE-2026-16255/): Incorrect Authorization in GitLab (medium 5.9)
- [CVE-2026-16254](https://insights.sbomify.com/CVE-2026-16254/): Claircore: claircore: denial of service via out-of-bounds slice in claircore's apk installed-database parser (medium 4.3)
- [CVE-2026-16253](https://insights.sbomify.com/CVE-2026-16253/): Total Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret (high 7.5)
- [CVE-2026-16252](https://insights.sbomify.com/CVE-2026-16252/): Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection (medium 6.9)
- [CVE-2026-16251](https://insights.sbomify.com/CVE-2026-16251/): Mattermost local image proxy allows server memory exhaustion via unbounded image response buffering (medium 6.5)
- [CVE-2026-16250](https://insights.sbomify.com/CVE-2026-16250/): Personal QR Message <= 1.0 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-1625](https://insights.sbomify.com/CVE-2026-1625/): D-Link DWR-M961 SMS Message formSmsManage sub_4250E0 command injection (medium 5.3)
- [CVE-2026-16248](https://insights.sbomify.com/CVE-2026-16248/): Tenda AC10 httpd/netctrl AdvSetLanip fromAdvSetLanip stack-based overflow (high 8.7)
- [CVE-2026-16247](https://insights.sbomify.com/CVE-2026-16247/): Insecure permission overwrite due to execution of LogPathConfig.exe while installing _connect.BRAIN (high 7.3)
- [CVE-2026-16246](https://insights.sbomify.com/CVE-2026-16246/): Insecure permission assignment due to execution of LogPathConfig.exe during setup (high 7.3)
- [CVE-2026-16244](https://insights.sbomify.com/CVE-2026-16244/): itsourcecode Hospital Management System prescriptionorderreport.php sql injection (medium 5.3)
- [CVE-2026-16243](https://insights.sbomify.com/CVE-2026-16243/): Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero (medium 5.7)
- [CVE-2026-16242](https://insights.sbomify.com/CVE-2026-16242/): Hypershift: konnectivity proxy-server accepts agent connections without validating client certificates (critical 9.4)
- [CVE-2026-16241](https://insights.sbomify.com/CVE-2026-16241/): PostgreSQL ECPG integer underflow can crash the client (low 3.8)
- [CVE-2026-1624](https://insights.sbomify.com/CVE-2026-1624/): D-Link DWR-M961 formLtefotaUpgradeFibocom command injection (medium 5.3)
- [CVE-2026-16239](https://insights.sbomify.com/CVE-2026-16239/): PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code (high 8.8)
- [CVE-2026-16238](https://insights.sbomify.com/CVE-2026-16238/): PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code (high 8.8)
- [CVE-2026-16236](https://insights.sbomify.com/CVE-2026-16236/): Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2026-16235](https://insights.sbomify.com/CVE-2026-16235/): Crypt::Password versions through 0.28 for Perl generate insecure random values for salts (critical 9.8)
- [CVE-2026-16234](https://insights.sbomify.com/CVE-2026-16234/): Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VI (high 8.5)
- [CVE-2026-16233](https://insights.sbomify.com/CVE-2026-16233/): Out-of-Bounds Write Vulnerability in NI LabVIEW when loading VI (high 8.5)
- [CVE-2026-16232](https://insights.sbomify.com/CVE-2026-16232/): Check Point SmartConsole Improper Authentication (critical 9.3, exploited in the wild)
- [CVE-2026-16231](https://insights.sbomify.com/CVE-2026-16231/): hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass (high 8.1)
- [CVE-2026-16230](https://insights.sbomify.com/CVE-2026-16230/): Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field (critical 9.8)
- [CVE-2026-1623](https://insights.sbomify.com/CVE-2026-1623/): Totolink A7000R cstecgi.cgi setUpgradeFW command injection (medium 5.3)
- [CVE-2026-16229](https://insights.sbomify.com/CVE-2026-16229/): itsourcecode Courier Management System index.php cross site scripting (medium 5.3)
- [CVE-2026-16228](https://insights.sbomify.com/CVE-2026-16228/): SourceCodester Class and Exam Timetabling System edit_schoolyr.php sql injection (medium 6.9)
- [CVE-2026-16227](https://insights.sbomify.com/CVE-2026-16227/): SourceCodester Class and Exam Timetabling System edit_subject.php sql injection (medium 6.9)
- [CVE-2026-16226](https://insights.sbomify.com/CVE-2026-16226/): SourceCodester Pizzafy Ecommerce System admin_class_novo.php save_settings unrestricted upload (medium 5.1)
- [CVE-2026-16225](https://insights.sbomify.com/CVE-2026-16225/): davenardella snap7 s7_peer.cpp NegotiatePDULength out-of-bounds write (medium 5.3)
- [CVE-2026-16224](https://insights.sbomify.com/CVE-2026-16224/): jxxghp MoviePilot Application API improper authorization (medium 5.3)
- [CVE-2026-16223](https://insights.sbomify.com/CVE-2026-16223/): 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery (medium 5.3)
- [CVE-2026-16222](https://insights.sbomify.com/CVE-2026-16222/): 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery (medium 5.3)
- [CVE-2026-16221](https://insights.sbomify.com/CVE-2026-16221/): fast-uri vulnerable to host confusion via literal backslash authority delimiter (high 7.5)
- [CVE-2026-16220](https://insights.sbomify.com/CVE-2026-16220/): code-projects Online Examination System account.php cross site scripting (medium 5.3)
- [CVE-2026-1622](https://insights.sbomify.com/CVE-2026-1622/): Unredacted data exposure in query.log (medium 4.8)
- [CVE-2026-16219](https://insights.sbomify.com/CVE-2026-16219/): Croogo CMS Admin File Manager FileManager.php isEditable path traversal (medium 5.3)
- [CVE-2026-16218](https://insights.sbomify.com/CVE-2026-16218/): hunvreus devpush Storage Reset Failure storage.py reset_storage improper check or handling of exceptional conditions (low 2.1)
- [CVE-2026-16217](https://insights.sbomify.com/CVE-2026-16217/): guohongze adminset Delivery Deployment Endpoint deli.py authorization (medium 5.3)
- [CVE-2026-16216](https://insights.sbomify.com/CVE-2026-16216/): geex-arts django-jet OAuth cross-site request forgery (medium 5.3)
- [CVE-2026-16215](https://insights.sbomify.com/CVE-2026-16215/): geex-arts django-jet OAuth Credential Revoke authorization (medium 6.9)
- [CVE-2026-16214](https://insights.sbomify.com/CVE-2026-16214/): geex-arts django-jet Dashboard views.py authorization (medium 5.3)
- [CVE-2026-16213](https://insights.sbomify.com/CVE-2026-16213/): Fantomas42 django-blog-zinnia Protected Entry Password entry_protection.py cleartext storage (medium 4.8)
- [CVE-2026-16212](https://insights.sbomify.com/CVE-2026-16212/): awesto django-shop Purchase Stock inventory.py race condition (low 2.3)
- [CVE-2026-16211](https://insights.sbomify.com/CVE-2026-16211/): allegro Hostname Allocation assets.py AssetLastHostname.increment_hostname race condition (low 2.1)
- [CVE-2026-16210](https://insights.sbomify.com/CVE-2026-16210/): newpanjing simpleui AjaxAdmin AJAX Endpoint admin.py self.get_action missing authentication (medium 6.9)
- [CVE-2026-1621](https://insights.sbomify.com/CVE-2026-1621/): Register Bypass in Universal Sotware's E-Municipality (medium 5.3)
- [CVE-2026-16209](https://insights.sbomify.com/CVE-2026-16209/): Gerapy Project Upload Endpoint views.py missing authentication (medium 6.9)
- [CVE-2026-16208](https://insights.sbomify.com/CVE-2026-16208/): django-tastypie throttle.py CacheDBThrottle race condition (low 2.3)
- [CVE-2026-16207](https://insights.sbomify.com/CVE-2026-16207/): django-tastypie authentication.py ApiKeyAuthentication get request method with sensitive query strings (medium 6.3)
- [CVE-2026-16206](https://insights.sbomify.com/CVE-2026-16206/): django-oauth django-oauth-toolkit oauth2_validators.py _load_id_token session expiration (medium 5.3)
- [CVE-2026-16205](https://insights.sbomify.com/CVE-2026-16205/): Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting (medium 4.8)
- [CVE-2026-16204](https://insights.sbomify.com/CVE-2026-16204/): zevorn rt-claw Telegram-to-AI Tool Execution Flow script.c tool_run_script_execute code injection (medium 5.3)
- [CVE-2026-16203](https://insights.sbomify.com/CVE-2026-16203/): SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting (medium 5.1)
- [CVE-2026-16202](https://insights.sbomify.com/CVE-2026-16202/): SourceCodester Class and Exam Timetabling System CYS.php cross site scripting (medium 5.1)
- [CVE-2026-16201](https://insights.sbomify.com/CVE-2026-16201/): zevorn rt-claw http_request net.c claw_net_post information disclosure (medium 6.9)
- [CVE-2026-16200](https://insights.sbomify.com/CVE-2026-16200/): zevorn rt-claw RPC swarm.c claw_tool_invoke authorization (medium 6.9)
- [CVE-2026-1620](https://insights.sbomify.com/CVE-2026-1620/): Livemesh Addons by Elementor <= 9.0 - Authenticated (Contributor+) Local File Inclusion via Widget Template Parameter (high 8.8)
- [CVE-2026-16199](https://insights.sbomify.com/CVE-2026-16199/): nextlevelbuilder GoClaw credentialed_exec.go ExecTool.Execute improper authorization (medium 5.3)
- [CVE-2026-16198](https://insights.sbomify.com/CVE-2026-16198/): Sipeed PicoClaw First Run Setup access_control.go authentication bypass (medium 6.3)
- [CVE-2026-16197](https://insights.sbomify.com/CVE-2026-16197/): Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization (medium 5.3)
- [CVE-2026-16196](https://insights.sbomify.com/CVE-2026-16196/): Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgery (medium 5.3)
- [CVE-2026-16195](https://insights.sbomify.com/CVE-2026-16195/): Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization (medium 5.3)
- [CVE-2026-16194](https://insights.sbomify.com/CVE-2026-16194/): zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery (medium 5.3)
- [CVE-2026-16192](https://insights.sbomify.com/CVE-2026-16192/): IBM WebSphere Application Server Liberty is affected by a denial of service (high 7.1)
- [CVE-2026-16190](https://insights.sbomify.com/CVE-2026-16190/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (low 3.1)
- [CVE-2026-1619](https://insights.sbomify.com/CVE-2026-1619/): IDOR in Universal Sotware's FlexCity/Kiosk (high 8.3)
- [CVE-2026-16189](https://insights.sbomify.com/CVE-2026-16189/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 4.8)
- [CVE-2026-16188](https://insights.sbomify.com/CVE-2026-16188/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 5.3)
- [CVE-2026-16187](https://insights.sbomify.com/CVE-2026-16187/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 6.5)
- [CVE-2026-16186](https://insights.sbomify.com/CVE-2026-16186/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 5.4)
- [CVE-2026-16185](https://insights.sbomify.com/CVE-2026-16185/): IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities (medium 6.4)
- [CVE-2026-16184](https://insights.sbomify.com/CVE-2026-16184/): IBM WebSphere Application Server is affected by an authentication bypass (high 7.0)
- [CVE-2026-16182](https://insights.sbomify.com/CVE-2026-16182/): IBM DataPower Gateway NULL Pointer Dereference (medium 5.9)
- [CVE-2026-16181](https://insights.sbomify.com/CVE-2026-16181/): IBM DataPower Gateway Improper Authorization (high 7.4)
- [CVE-2026-16180](https://insights.sbomify.com/CVE-2026-16180/): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (medium 5.7)
- [CVE-2026-1618](https://insights.sbomify.com/CVE-2026-1618/): Admin Account Takeover in Universal Sotware's FlexCity/Kiosk (high 8.8)
- [CVE-2026-16179](https://insights.sbomify.com/CVE-2026-16179/): IBM DataPower Gateway Buffer Underwrite (high 7.5)
- [CVE-2026-16178](https://insights.sbomify.com/CVE-2026-16178/): IBM DataPower Gateway Out-of-bounds Write (high 7.5)
- [CVE-2026-16177](https://insights.sbomify.com/CVE-2026-16177/): IBM DataPower Gateway Out-of-bounds Read (medium 5.3)
- [CVE-2026-16176](https://insights.sbomify.com/CVE-2026-16176/): IBM DataPower Gateway Denial of Service (high 7.5)
- [CVE-2026-16174](https://insights.sbomify.com/CVE-2026-16174/): Netskope Endpoint DLP Driver Integer Overflow Leading to Kernel Pool Overflow (high 8.7)
- [CVE-2026-16172](https://insights.sbomify.com/CVE-2026-16172/): Netskope Endpoint DLP Service Out-of-Bounds Read Leading to Process Crash (medium 6.0)
- [CVE-2026-16170](https://insights.sbomify.com/CVE-2026-16170/): IBM DataPower Gateway Out-of-bounds Write (high 7.5)
- [CVE-2026-1617](https://insights.sbomify.com/CVE-2026-1617/): SQLi in Turkmesh's Turkhotspot 5651 Loglama (critical 9.8)
- [CVE-2026-16169](https://insights.sbomify.com/CVE-2026-16169/): IBM DataPower Gateway Denial of Service (high 7.5)
- [CVE-2026-16167](https://insights.sbomify.com/CVE-2026-16167/): IBM DataPower Gateway Out-of-bounds Write (high 7.5)
- [CVE-2026-16165](https://insights.sbomify.com/CVE-2026-16165/): IBM DataPower Gateway NULL Pointer Dereference (high 7.5)
- [CVE-2026-16164](https://insights.sbomify.com/CVE-2026-16164/): IBM DataPower Gateway Out-of-bounds Write (high 7.5)
- [CVE-2026-16163](https://insights.sbomify.com/CVE-2026-16163/): IBM DataPower Gateway Out-of-bounds Write (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/851/