# Vulnerabilities published in 2026


- [CVE-2026-16057](https://insights.sbomify.com/CVE-2026-16057/): Contest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library (medium 6.5)
- [CVE-2026-16056](https://insights.sbomify.com/CVE-2026-16056/): Contest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts (medium 4.3)
- [CVE-2026-16055](https://insights.sbomify.com/CVE-2026-16055/): Contest Gallery < 30.0.7 - Unauthenticated Login-Protection and 2FA Bypass via post_cg_login (high 7.5)
- [CVE-2026-16054](https://insights.sbomify.com/CVE-2026-16054/): Drag and Drop Multiple File Upload for WooCommerce < 1.1.8 - Unauthenticated File Deletion via Nonce Oracle (critical 9.1)
- [CVE-2026-16053](https://insights.sbomify.com/CVE-2026-16053/): Path Traversal (high 8.5)
- [CVE-2026-16051](https://insights.sbomify.com/CVE-2026-16051/): WPMU DEV Dashboard < 5.0.1 - Remote Code Execution via Hub Install Action (critical 9.8)
- [CVE-2026-1605](https://insights.sbomify.com/CVE-2026-1605/): The Eclipse Jetty Server Artifact has a Gzip request memory leak (high 7.5)
- [CVE-2026-16049](https://insights.sbomify.com/CVE-2026-16049/): Missing authorization in Mattermost (low 3.9)
- [CVE-2026-16048](https://insights.sbomify.com/CVE-2026-16048/): Channel member roles accept out-of-scope roles (medium 6.3)
- [CVE-2026-16047](https://insights.sbomify.com/CVE-2026-16047/): Board channel linking without read channel permission validation (medium 4.3)
- [CVE-2026-16046](https://insights.sbomify.com/CVE-2026-16046/): Missing run-state validation on finished playbook runs (low 3.5)
- [CVE-2026-16045](https://insights.sbomify.com/CVE-2026-16045/): Delegated OAuth tokens could revoke unrelated OAuth application authorizations (low 2.7)
- [CVE-2026-16044](https://insights.sbomify.com/CVE-2026-16044/): Insufficient validation of guest board admin privileges on archive import (low 3.9)
- [CVE-2026-16042](https://insights.sbomify.com/CVE-2026-16042/): LWS Optimize < 3.4 - Subscriber+ Cache Deletion (medium 4.3)
- [CVE-2026-16041](https://insights.sbomify.com/CVE-2026-16041/): MStore API < 4.21.0 - Unauthenticated Product Review Creation (high 7.5)
- [CVE-2026-16039](https://insights.sbomify.com/CVE-2026-16039/): MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR (medium 6.5)
- [CVE-2026-16038](https://insights.sbomify.com/CVE-2026-16038/): MStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways (critical 9.1)
- [CVE-2026-16037](https://insights.sbomify.com/CVE-2026-16037/): Callback Authentication Bypass via Timing Attack in PayTR's PayTR Virtual Pos iFrame API WHMCS Module (high 7.5)
- [CVE-2026-16036](https://insights.sbomify.com/CVE-2026-16036/): miniOrange 2FA < 6.2.7 - 2FA Bypass via Password-Only Second-Factor Rebinding (high 7.5)
- [CVE-2026-16035](https://insights.sbomify.com/CVE-2026-16035/): miniOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send (medium 4.3)
- [CVE-2026-16033](https://insights.sbomify.com/CVE-2026-16033/): Arbitrary file read+write on host via templates/ symlink in malicious image (high 8.5)
- [CVE-2026-16032](https://insights.sbomify.com/CVE-2026-16032/): LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring (medium 6.1)
- [CVE-2026-16030](https://insights.sbomify.com/CVE-2026-16030/): MStore API < 4.21.0 - Unauthenticated Account Takeover via Firebase Phone Authentication (high 8.1)
- [CVE-2026-1603](https://insights.sbomify.com/CVE-2026-1603/): Ivanti Endpoint Manager (EPM) Authentication Bypass (high 8.6, exploited in the wild)
- [CVE-2026-16028](https://insights.sbomify.com/CVE-2026-16028/): Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table. (high 7.5)
- [CVE-2026-16027](https://insights.sbomify.com/CVE-2026-16027/): Unauthenticated WebSocket-to-XAdES SSRF in Revenue Administration's E-Signature (medium 5.4)
- [CVE-2026-16025](https://insights.sbomify.com/CVE-2026-16025/): Improper Payment Validation in PayTR's PayTR Virtual Pos iFrame API WHMCS Module (high 7.5)
- [CVE-2026-16022](https://insights.sbomify.com/CVE-2026-16022/): Command Injection in @oblique/cli (high 7.8)
- [CVE-2026-16020](https://insights.sbomify.com/CVE-2026-16020/): Stored XSS Fazile BACAK's DefterAsist Financial Advisor Platform (medium 5.4)
- [CVE-2026-1602](https://insights.sbomify.com/CVE-2026-1602/): SQL injection in Endpoint Manager (medium 6.5)
- [CVE-2026-16019](https://insights.sbomify.com/CVE-2026-16019/): SQL Injection in Faydam Innovation's FAYDAM Datalogger (critical 9.8)
- [CVE-2026-16017](https://insights.sbomify.com/CVE-2026-16017/): mosaxiv clawlet cron Chat Tool tool_cron.go remove authorization (medium 5.3)
- [CVE-2026-16016](https://insights.sbomify.com/CVE-2026-16016/): poco-ai poco-claw task.py run_task server-side request forgery (medium 6.9)
- [CVE-2026-16015](https://insights.sbomify.com/CVE-2026-16015/): poco-ai poco-claw executor_manager API tasks.py create_task missing authentication (medium 5.3)
- [CVE-2026-16014](https://insights.sbomify.com/CVE-2026-16014/): code-projects Hospital Bed Management System Login Form sql injection (medium 6.9)
- [CVE-2026-16013](https://insights.sbomify.com/CVE-2026-16013/): liftoff-sr CIPster cipepath.cc deserialize_symbolic out-of-bounds (medium 6.9)
- [CVE-2026-1601](https://insights.sbomify.com/CVE-2026-1601/): Totolink A7000R cstecgi.cgi setUploadUserData command injection (medium 5.3)
- [CVE-2026-16009](https://insights.sbomify.com/CVE-2026-16009/): itsourcecode Hospital Management System prescriptionorderdetail.php sql injection (medium 5.3)
- [CVE-2026-16008](https://insights.sbomify.com/CVE-2026-16008/): sagold json-schema-library propertyDependencies.ts parsePropertyDependencies prototype pollution (medium 5.3)
- [CVE-2026-16007](https://insights.sbomify.com/CVE-2026-16007/): Authenticated SQL Injection in AppFlowy (high 7.1)
- [CVE-2026-16006](https://insights.sbomify.com/CVE-2026-16006/): Information disclosure in Armoury Crate (medium 5.7)
- [CVE-2026-16005](https://insights.sbomify.com/CVE-2026-16005/): Memory corruption in Armoury Crate (medium 5.8)
- [CVE-2026-16004](https://insights.sbomify.com/CVE-2026-16004/): Missing authorization in Armoury Crate (medium 5.9)
- [CVE-2026-16003](https://insights.sbomify.com/CVE-2026-16003/): Missing authorization in Armoury Crate (low 2.0)
- [CVE-2026-16002](https://insights.sbomify.com/CVE-2026-16002/): Out-of-bounds Read in MZ Automation lib60870 (high 8.8)
- [CVE-2026-16001](https://insights.sbomify.com/CVE-2026-16001/): IesEngine stream-mode MAC forgery via length-dependent KDF split (high 8.2)
- [CVE-2026-16000](https://insights.sbomify.com/CVE-2026-16000/): KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used (high 8.7)
- [CVE-2026-1600](https://insights.sbomify.com/CVE-2026-1600/): Bdtask Bhojon All-In-One Restaurant Management System Add-to-Cart Submission Endpoint addtocart logic error (medium 5.3)
- [CVE-2026-15999](https://insights.sbomify.com/CVE-2026-15999/): AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication (high 8.2)
- [CVE-2026-15997](https://insights.sbomify.com/CVE-2026-15997/): Native ARM SHA3 / SHAKE `restoreFullState` fails to detect size_t underflow in a crafted encoded state (low 1.7)
- [CVE-2026-15996](https://insights.sbomify.com/CVE-2026-15996/): Denial of service in Enterprise Server (medium 6.6)
- [CVE-2026-15995](https://insights.sbomify.com/CVE-2026-15995/): Race condition in Cognos Analytics (medium 5.4)
- [CVE-2026-15994](https://insights.sbomify.com/CVE-2026-15994/): Privilege escalation in Commercial Vantage (high 7.3)
- [CVE-2026-15993](https://insights.sbomify.com/CVE-2026-15993/): SQL injection in Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder (medium 5.3)
- [CVE-2026-15992](https://insights.sbomify.com/CVE-2026-15992/): WP Password Policy <= 3.7.1 - Authenticated (Subscriber+) Privilege Escalation (high 8.8)
- [CVE-2026-15991](https://insights.sbomify.com/CVE-2026-15991/): Missing authorization in File Manager (high 8.8)
- [CVE-2026-15990](https://insights.sbomify.com/CVE-2026-15990/): Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter (high 7.5)
- [CVE-2026-1599](https://insights.sbomify.com/CVE-2026-1599/): Bdtask Bhojon All-In-One Restaurant Management System Checkout placeorder logic error (medium 5.3)
- [CVE-2026-15989](https://insights.sbomify.com/CVE-2026-15989/): Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter (critical 9.8)
- [CVE-2026-15988](https://insights.sbomify.com/CVE-2026-15988/): AI Engine <= 3.6.5 - Cross-Site Request Forgery to Privilege Escalation via REQUEST_URI Substring Match (high 8.8)
- [CVE-2026-15985](https://insights.sbomify.com/CVE-2026-15985/): Classified Listing - Mobile Number Verification <= 1.6.0 - Unauthenticated Authentication Bypass via Firebase OTP Login (high 8.1)
- [CVE-2026-15984](https://insights.sbomify.com/CVE-2026-15984/): QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters (high 7.2)
- [CVE-2026-15983](https://insights.sbomify.com/CVE-2026-15983/): Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter (high 8.1)
- [CVE-2026-15982](https://insights.sbomify.com/CVE-2026-15982/): Missing authorization in Aimogen Pro - All-in-One AI Content Writer, Editor, ChatBot & Automation Toolkit (critical 9.8)
- [CVE-2026-15981](https://insights.sbomify.com/CVE-2026-15981/): SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter (critical 9.8)
- [CVE-2026-15980](https://insights.sbomify.com/CVE-2026-15980/): MyHome Core <= 4.4.5 - Authentication Bypass to Account Takeover via Activation Token (critical 9.8)
- [CVE-2026-1598](https://insights.sbomify.com/CVE-2026-1598/): Bdtask Bhojon All-In-One Restaurant Management System User Information profile cross site scripting (medium 5.1)
- [CVE-2026-15979](https://insights.sbomify.com/CVE-2026-15979/): Content Egg <= 11.3.0 - Authenticated (Author+) Arbitrary File Deletion (high 8.1)
- [CVE-2026-15978](https://insights.sbomify.com/CVE-2026-15978/): CVE-2026-15978 (high 7.5)
- [CVE-2026-15977](https://insights.sbomify.com/CVE-2026-15977/): CVE-2026-15977 (high 7.5)
- [CVE-2026-15976](https://insights.sbomify.com/CVE-2026-15976/): CVE-2026-15976 (critical 9.8)
- [CVE-2026-15975](https://insights.sbomify.com/CVE-2026-15975/): Allocation of Resources Without Limits or Throttling in GitLab (high 7.5)
- [CVE-2026-15974](https://insights.sbomify.com/CVE-2026-15974/): CVE-2026-15974 (medium 6.5)
- [CVE-2026-15973](https://insights.sbomify.com/CVE-2026-15973/): LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries (high 8.4)
- [CVE-2026-15972](https://insights.sbomify.com/CVE-2026-15972/): Unauthenticated denial of service via unbounded external gRPC connection acceptance (high 7.5)
- [CVE-2026-15971](https://insights.sbomify.com/CVE-2026-15971/): CVE-2026-15971 (critical 9.8)
- [CVE-2026-15970](https://insights.sbomify.com/CVE-2026-15970/): L7 intention authorization bypass via custom public listener (medium 4.2)
- [CVE-2026-1597](https://insights.sbomify.com/CVE-2026-1597/): Bdtask SalesERP Administrative Endpoint improper authorization (medium 5.3)
- [CVE-2026-15969](https://insights.sbomify.com/CVE-2026-15969/): CVE-2026-15969 (critical 9.8)
- [CVE-2026-15968](https://insights.sbomify.com/CVE-2026-15968/): Stored XSS vulnerability in MOVEit Transfer (high 7.1)
- [CVE-2026-15967](https://insights.sbomify.com/CVE-2026-15967/): MOVEit Transfer refresh-token processing does not enforce updated account restrictions (high 7.5)
- [CVE-2026-15966](https://insights.sbomify.com/CVE-2026-15966/): Improper CORS handling in MOVEit Transfer (high 7.5)
- [CVE-2026-15965](https://insights.sbomify.com/CVE-2026-15965/): MaxUpload <= 1.4.0 - Unauthenticated Arbitrary File Upload via 'resumableFilename' Parameter (high 8.8)
- [CVE-2026-15964](https://insights.sbomify.com/CVE-2026-15964/): Single Sign On For TNG <= 2.0.0 - Unauthenticated Privilege Escalation via Unverified Password Change (critical 9.8)
- [CVE-2026-15963](https://insights.sbomify.com/CVE-2026-15963/): Quiz and Survey Master (QSM) <= 11.2.1 - Authenticated (Contributor+) SQL Injection via 'randon_category' Quiz Option (medium 6.5)
- [CVE-2026-15962](https://insights.sbomify.com/CVE-2026-15962/): Deserialization in Fluent Forms Pro Add On Pack (high 8.8)
- [CVE-2026-15961](https://insights.sbomify.com/CVE-2026-15961/): Power System Information Disclosure (medium 5.2)
- [CVE-2026-1596](https://insights.sbomify.com/CVE-2026-1596/): D-Link DWR-M961 formLtefotaUpgradeQuectel sub_419920 command injection (medium 5.3)
- [CVE-2026-15958](https://insights.sbomify.com/CVE-2026-15958/): Easy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX (critical 9.3)
- [CVE-2026-15957](https://insights.sbomify.com/CVE-2026-15957/): Denial of service in aws-sdk-rust (high 8.7)
- [CVE-2026-15955](https://insights.sbomify.com/CVE-2026-15955/): Path traversal in Db2 (high 7.5)
- [CVE-2026-15953](https://insights.sbomify.com/CVE-2026-15953/): Path Traversal During Project Archive Import (medium 5.6)
- [CVE-2026-15952](https://insights.sbomify.com/CVE-2026-15952/): Improper Permission Assignment in Scheduler Service (high 7.1)
- [CVE-2026-15951](https://insights.sbomify.com/CVE-2026-15951/): Icegram Mailer <= 1.0.12 - Authenticated (Administrator+) SQL Injection via 'fields' Parameter (medium 4.9)
- [CVE-2026-15950](https://insights.sbomify.com/CVE-2026-15950/): Cross-site scripting in Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates (medium 6.4)
- [CVE-2026-1595](https://insights.sbomify.com/CVE-2026-1595/): itsourcecode Society Management System edit_student_query.php sql injection (medium 6.9)
- [CVE-2026-15948](https://insights.sbomify.com/CVE-2026-15948/): Hydra Booking <= 1.2.2 - Authenticated (Host+) Stored Cross-Site Scripting via 'first_name' Parameter (medium 6.4)
- [CVE-2026-15947](https://insights.sbomify.com/CVE-2026-15947/): Missing authorization in Search Atlas SEO – OTTO AI SEO Automation for WordPress (medium 4.3)
- [CVE-2026-15946](https://insights.sbomify.com/CVE-2026-15946/): Missing authorization in Search Atlas SEO – OTTO AI SEO Automation for WordPress (medium 4.3)
- [CVE-2026-15945](https://insights.sbomify.com/CVE-2026-15945/): Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/853/