CVE-2026-16646

MediumCVSS 5.7/10Last modified Aug 28, 2026

Description

Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 25, 2026
Last modified
Aug 28, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-166474.1Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue CVE-2026-166483.8Insertion of Sensitive Information into Log File vulnerability in Drupal Mailer Plus Log allows Remote Services with Stolen Credentials. ThiCVE-2026-166497.2The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and incCVE-2026-16655.4A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() function uses eval to eCVE-2026-166505.3The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configCVE-2026-166518.7temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consisCVE-2026-166527.1Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace wCVE-2026-166535.3A security flaw has been discovered in boazsegev facil.io up to 0.7.58. This affects the function http_sendfile2 of the file lib/facil/http/CVE-2026-166546.4The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions CVE-2026-166557.2The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored CrosCVE-2026-166569.8IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to gain root privileges due to improper authentication.CVE-2026-16666.1The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirect_to' parameter in all versions up
CVE-2026-16646: Medium severity, CVSS 5.7 | Vulnix