# Vulnerabilities published in 2026


- [CVE-2026-16161](https://insights.sbomify.com/CVE-2026-16161/): IBM DataPower Gateway Out-of-bounds Read (high 7.5)
- [CVE-2026-1616](https://insights.sbomify.com/CVE-2026-1616/): osim: Path Traversal via query parameters in Nginx configuration (high 7.5)
- [CVE-2026-16159](https://insights.sbomify.com/CVE-2026-16159/): IBM DataPower Gateway Out-of-bounds Write (high 8.6)
- [CVE-2026-16158](https://insights.sbomify.com/CVE-2026-16158/): @fastify/reply-from vulnerable to cross-upstream request routing via URL cache key collision (high 8.7)
- [CVE-2026-16157](https://insights.sbomify.com/CVE-2026-16157/): Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability (high 7.8)
- [CVE-2026-16156](https://insights.sbomify.com/CVE-2026-16156/): SourceCodester Class and Exam Timetabling System forexam.php cross site scripting (medium 5.1)
- [CVE-2026-16155](https://insights.sbomify.com/CVE-2026-16155/): SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting (medium 5.1)
- [CVE-2026-16154](https://insights.sbomify.com/CVE-2026-16154/): SourceCodester Class and Exam Timetabling System edit_room1.php sql injection (medium 6.9)
- [CVE-2026-16152](https://insights.sbomify.com/CVE-2026-16152/): SourceCodester Class and Exam Timetabling System edit_rooma.php sql injection (medium 6.9)
- [CVE-2026-16151](https://insights.sbomify.com/CVE-2026-16151/): CartoDB carto-api-client filters.ts addFilter prototype pollution (medium 5.3)
- [CVE-2026-16150](https://insights.sbomify.com/CVE-2026-16150/): RobinHerbots Inputmask Internal Deep Merge Helper extend.js extendAliases prototype pollution (medium 5.3)
- [CVE-2026-1615](https://insights.sbomify.com/CVE-2026-1615/): jsonpath has Arbitrary Code Injection via Unsafe Evaluation of JSON Path Expressions (critical 9.2)
- [CVE-2026-16149](https://insights.sbomify.com/CVE-2026-16149/): Missing authorization in Security Hardener (high 8.8)
- [CVE-2026-16148](https://insights.sbomify.com/CVE-2026-16148/): Kernel panic in the it82xx2 USB device controller driver via re-initialization of a busy delayable work item (medium 4.6)
- [CVE-2026-16147](https://insights.sbomify.com/CVE-2026-16147/): it82xx2 USB device controller submits incomplete OUT transfer buffers, causing use-after-free and event-list corruption (medium 6.8)
- [CVE-2026-16146](https://insights.sbomify.com/CVE-2026-16146/): Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via Pattern JSON Keys/Values (medium 4.9)
- [CVE-2026-16145](https://insights.sbomify.com/CVE-2026-16145/): Invisible Anti-Spam & CAPTCHA <= 5.1 - Unauthenticated Stored Cross-Site Scripting via 'action' Parameter (high 7.2)
- [CVE-2026-16144](https://insights.sbomify.com/CVE-2026-16144/): Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter (high 8.1)
- [CVE-2026-16143](https://insights.sbomify.com/CVE-2026-16143/): VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-16142](https://insights.sbomify.com/CVE-2026-16142/): Missing authorization in TrueBooker – Appointment Booking and Scheduler System (critical 9.8)
- [CVE-2026-16141](https://insights.sbomify.com/CVE-2026-16141/): OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value (high 8.1)
- [CVE-2026-16140](https://insights.sbomify.com/CVE-2026-16140/): OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1 (high 8.8)
- [CVE-2026-1614](https://insights.sbomify.com/CVE-2026-1614/): Cross-site scripting in Rise Blocks – A Complete Gutenberg Page Builder (medium 6.4)
- [CVE-2026-16139](https://insights.sbomify.com/CVE-2026-16139/): Path traversal in ShareFile Storage Zones Controller (high 7.2)
- [CVE-2026-16138](https://insights.sbomify.com/CVE-2026-16138/): Remote code execution via unsafe deserialization in Progress ShareFile Storage Zones Controller's CICO service (high 8.0)
- [CVE-2026-16137](https://insights.sbomify.com/CVE-2026-16137/): Path traversal in ShareFile Storage Zones Controller (high 7.2)
- [CVE-2026-16133](https://insights.sbomify.com/CVE-2026-16133/): LiuMengxuan04 MiniCode mcp.ts child_process.spawn command injection (low 2.3)
- [CVE-2026-16131](https://insights.sbomify.com/CVE-2026-16131/): itsourcecode Hospital Management System prescriptionrecord.php sql injection (medium 5.3)
- [CVE-2026-16130](https://insights.sbomify.com/CVE-2026-16130/): nearai ironclaw write_file path_utils.rs validate_path link following (medium 4.8)
- [CVE-2026-1613](https://insights.sbomify.com/CVE-2026-1613/): Wonka Slide <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-16129](https://insights.sbomify.com/CVE-2026-16129/): princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist (medium 4.8)
- [CVE-2026-16128](https://insights.sbomify.com/CVE-2026-16128/): zevorn rt-claw http_request swarm.c receiver_thread server-side request forgery (medium 6.9)
- [CVE-2026-16127](https://insights.sbomify.com/CVE-2026-16127/): zevorn rt-claw http_request tool_net.c claw_net_post server-side request forgery (medium 6.9)
- [CVE-2026-16126](https://insights.sbomify.com/CVE-2026-16126/): zevorn rt-claw Swarm RPC Receiver swarm.c handle_rpc_request authorization (medium 6.9)
- [CVE-2026-16125](https://insights.sbomify.com/CVE-2026-16125/): zevorn rt-claw http_request net.c claw_net_post server-side request forgery (medium 6.9)
- [CVE-2026-16124](https://insights.sbomify.com/CVE-2026-16124/): nextlevelbuilder GoClaw web_fetch web_shared.go isPrivateIP server-side request forgery (medium 5.3)
- [CVE-2026-16123](https://insights.sbomify.com/CVE-2026-16123/): nextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP authorization (medium 5.3)
- [CVE-2026-16122](https://insights.sbomify.com/CVE-2026-16122/): nextlevelbuilder GoClaw exec_approval.go matchesAllowlist authorization (medium 4.8)
- [CVE-2026-16121](https://insights.sbomify.com/CVE-2026-16121/): nextlevelbuilder GoClaw exec_approval.go isSafeBin improper authorization (medium 5.3)
- [CVE-2026-16120](https://insights.sbomify.com/CVE-2026-16120/): nextlevelbuilder GoClaw exec_approval.go extractBin name resolution (medium 5.3)
- [CVE-2026-1612](https://insights.sbomify.com/CVE-2026-1612/): Hard-coded AWS Key in AL-KO Robolinho Update Software (medium 6.9)
- [CVE-2026-16119](https://insights.sbomify.com/CVE-2026-16119/): nextlevelbuilder GoClaw WebSocket Approval Endpoint exec_approval.go RequestApproval authorization (medium 5.3)
- [CVE-2026-16118](https://insights.sbomify.com/CVE-2026-16118/): Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c (high 7.1)
- [CVE-2026-16117](https://insights.sbomify.com/CVE-2026-16117/): @fastify/http-proxy vulnerable to prefix escape via URL-encoded characters (critical 10.0)
- [CVE-2026-16111](https://insights.sbomify.com/CVE-2026-16111/): IBM DataPower Gateway Type Confusion (high 7.5)
- [CVE-2026-1611](https://insights.sbomify.com/CVE-2026-1611/): Wikiloops Track Player <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-16108](https://insights.sbomify.com/CVE-2026-16108/): Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2 (medium 4.3)
- [CVE-2026-16107](https://insights.sbomify.com/CVE-2026-16107/): TS4500 CLI tool addresses security vulnerability (medium 5.9)
- [CVE-2026-16106](https://insights.sbomify.com/CVE-2026-16106/): Missing authorization in Red Hat Data Grid 8 (medium 4.9)
- [CVE-2026-16105](https://insights.sbomify.com/CVE-2026-16105/): Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints (medium 4.9)
- [CVE-2026-16104](https://insights.sbomify.com/CVE-2026-16104/): Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins (medium 4.3)
- [CVE-2026-16103](https://insights.sbomify.com/CVE-2026-16103/): Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption (medium 4.3)
- [CVE-2026-16102](https://insights.sbomify.com/CVE-2026-16102/): Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers (high 8.1)
- [CVE-2026-16101](https://insights.sbomify.com/CVE-2026-16101/): forced re-pairing with already bonded device (high 8.8)
- [CVE-2026-16100](https://insights.sbomify.com/CVE-2026-16100/): Denial of service in Red Hat Data Grid 8 (medium 6.5)
- [CVE-2026-1610](https://insights.sbomify.com/CVE-2026-1610/): Tenda AX12 Pro V2 Telnet Service hard-coded credentials (critical 9.2)
- [CVE-2026-16099](https://insights.sbomify.com/CVE-2026-16099/): Deserialization in Podlove Podcast Publisher (high 8.8)
- [CVE-2026-16098](https://insights.sbomify.com/CVE-2026-16098/): File upload in ProSolution WP Client (critical 9.8)
- [CVE-2026-16097](https://insights.sbomify.com/CVE-2026-16097/): Shibby Tomato Scheduler Name sub_42537C stack-based overflow (high 8.7)
- [CVE-2026-16096](https://insights.sbomify.com/CVE-2026-16096/): Shibby Tomato webmon_recent_domains sub_40BB50 stack-based overflow (high 8.7)
- [CVE-2026-16095](https://insights.sbomify.com/CVE-2026-16095/): Shibby Tomato rc setup_conntrack out-of-bounds write (high 8.7)
- [CVE-2026-16094](https://insights.sbomify.com/CVE-2026-16094/): Invisible Anti-Spam & CAPTCHA <= 5.1 - Authenticated (Editor+) SQL Injection via 'key' Parameter (medium 4.9)
- [CVE-2026-16093](https://insights.sbomify.com/CVE-2026-16093/): Security feature bypass in Red Hat Data Grid 8 (medium 5.4)
- [CVE-2026-16092](https://insights.sbomify.com/CVE-2026-16092/): Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameter (medium 6.5)
- [CVE-2026-16091](https://insights.sbomify.com/CVE-2026-16091/): GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'gamipress_rank' Shortcode (medium 6.4)
- [CVE-2026-16090](https://insights.sbomify.com/CVE-2026-16090/): GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gamipress_achievement Shortcode (medium 6.4)
- [CVE-2026-1609](https://insights.sbomify.com/CVE-2026-1609/): Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users (high 8.1)
- [CVE-2026-16089](https://insights.sbomify.com/CVE-2026-16089/): Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session (medium 5.4)
- [CVE-2026-16088](https://insights.sbomify.com/CVE-2026-16088/): halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal (medium 5.1)
- [CVE-2026-16087](https://insights.sbomify.com/CVE-2026-16087/): Icegram Engage <= 3.1.42 - Authenticated (Contributor+) Second-Order SQL Injection via 'messages[][id]' Parameter (medium 6.5)
- [CVE-2026-16085](https://insights.sbomify.com/CVE-2026-16085/): Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere (medium 4.8)
- [CVE-2026-16084](https://insights.sbomify.com/CVE-2026-16084/): Sipeed PicoClaw web.go web_fetch server-side request forgery (medium 6.9)
- [CVE-2026-16083](https://insights.sbomify.com/CVE-2026-16083/): Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay (medium 6.9)
- [CVE-2026-16082](https://insights.sbomify.com/CVE-2026-16082/): Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou (medium 4.8)
- [CVE-2026-16081](https://insights.sbomify.com/CVE-2026-16081/): Sipeed PicoClaw auth.go cross-site request forgery (medium 5.3)
- [CVE-2026-16080](https://insights.sbomify.com/CVE-2026-16080/): Image Uploader for Welcart <= 1.4.6 - Authenticated (Author+) SQL Injection via Attachment 'post_title' Parameter (medium 6.5)
- [CVE-2026-1608](https://insights.sbomify.com/CVE-2026-1608/): Video Onclick <= 0.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-16079](https://insights.sbomify.com/CVE-2026-16079/): Fullscreen Galleria <= 1.6.12 - Authenticated (Contributor+) SQL Injection via 'href' Attribute in Post Content (medium 6.5)
- [CVE-2026-16078](https://insights.sbomify.com/CVE-2026-16078/): WCPOS <= 1.9.8 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read via 'type' Parameter (medium 6.5)
- [CVE-2026-16077](https://insights.sbomify.com/CVE-2026-16077/): AstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following (medium 4.8)
- [CVE-2026-16076](https://insights.sbomify.com/CVE-2026-16076/): AstrBotDevs AstrBot API open_api.py OpenApiRoute.chat_send authentication spoofing (medium 5.3)
- [CVE-2026-16075](https://insights.sbomify.com/CVE-2026-16075/): AstrBotDevs AstrBot session-listing Endpoint open_api.py OpenApiRoute.get_chat_sessions authorization (medium 5.3)
- [CVE-2026-16074](https://insights.sbomify.com/CVE-2026-16074/): AstrBotDevs AstrBot Plugin Update plugin.py update_all_plugins server-side request forgery (medium 5.3)
- [CVE-2026-16073](https://insights.sbomify.com/CVE-2026-16073/): AstrBotDevs AstrBot T2I Feature base.py NetworkRenderStrategy.render cross site scripting (medium 5.1)
- [CVE-2026-16072](https://insights.sbomify.com/CVE-2026-16072/): Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation (medium 4.9)
- [CVE-2026-16071](https://insights.sbomify.com/CVE-2026-16071/): Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary (medium 5.4)
- [CVE-2026-16070](https://insights.sbomify.com/CVE-2026-16070/): Brizy - Page Builder < 2.8.19 - Contributor+ Template Type Update via IDOR (low 2.7)
- [CVE-2026-1607](https://insights.sbomify.com/CVE-2026-1607/): Surbma | Booking.com <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2026-16069](https://insights.sbomify.com/CVE-2026-16069/): Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point (medium 6.8)
- [CVE-2026-16068](https://insights.sbomify.com/CVE-2026-16068/): Brizy - Page Builder < 2.8.19 - Author+ Stored XSS via brizy_set_project Global Project Code Asset (low 3.5)
- [CVE-2026-16067](https://insights.sbomify.com/CVE-2026-16067/): Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via Client-Controlled Ticket Price (medium 5.3)
- [CVE-2026-16066](https://insights.sbomify.com/CVE-2026-16066/): Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name (medium 5.4)
- [CVE-2026-16065](https://insights.sbomify.com/CVE-2026-16065/): Welcart e-Commerce < 2.11.32 - Editor+ SQL Injection via CSV Import (medium 6.5)
- [CVE-2026-16064](https://insights.sbomify.com/CVE-2026-16064/): Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ Arbitrary Post Modification via mpwem_quick_edit_event (medium 5.4)
- [CVE-2026-16063](https://insights.sbomify.com/CVE-2026-16063/): Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content (medium 5.4)
- [CVE-2026-16062](https://insights.sbomify.com/CVE-2026-16062/): Event Booking Manager for WooCommerce < 5.3.7 - Contributor+ PHP Object Injection via Event Timeline and FAQ Content (medium 6.6)
- [CVE-2026-16061](https://insights.sbomify.com/CVE-2026-16061/): Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name} (high 8.6)
- [CVE-2026-16060](https://insights.sbomify.com/CVE-2026-16060/): Insert or Embed Articulate Content into WordPress <= 4.3000000027 - Editor+ Arbitrary File Upload (critical 9.8)
- [CVE-2026-1606](https://insights.sbomify.com/CVE-2026-1606/): Improper Control of Generation of Code ('Code Injection') in GitLab (medium 4.3)
- [CVE-2026-16058](https://insights.sbomify.com/CVE-2026-16058/): YayCurrency < 3.3.5 - Unauthenticated Order and Vendor Financial Data Disclosure via Dokan Integration (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/852/