# Vulnerabilities published in 2026


- [CVE-2026-100813](https://insights.sbomify.com/CVE-2026-100813/): Invalid pointer in the JavaScript Engine: JIT component (high 8.8)
- [CVE-2026-100812](https://insights.sbomify.com/CVE-2026-100812/): Denial-of-service in the Graphics component (medium 6.5)
- [CVE-2026-100811](https://insights.sbomify.com/CVE-2026-100811/): Sandbox escape due to use-after-free in the DOM: Core & HTML component (critical 9.6)
- [CVE-2026-100810](https://insights.sbomify.com/CVE-2026-100810/): Other issue in the DevTools component (critical 9.8)
- [CVE-2026-10081](https://insights.sbomify.com/CVE-2026-10081/): Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget (high 8.8)
- [CVE-2026-100809](https://insights.sbomify.com/CVE-2026-100809/): Same-origin policy bypass in the DevTools component (high 8.1)
- [CVE-2026-100808](https://insights.sbomify.com/CVE-2026-100808/): Mitigation bypass in the DOM: Service Workers component (high 8.8)
- [CVE-2026-100807](https://insights.sbomify.com/CVE-2026-100807/): Privilege escalation in the DOM: Service Workers component (high 8.8)
- [CVE-2026-100806](https://insights.sbomify.com/CVE-2026-100806/): Uninitialized memory in the Graphics: WebGPU component (medium 4.3)
- [CVE-2026-100805](https://insights.sbomify.com/CVE-2026-100805/): Race condition, use-after-free in the Audio/Video component (high 7.5)
- [CVE-2026-100804](https://insights.sbomify.com/CVE-2026-100804/): Sandbox escape due to use-after-free in the Preferences: Backend component (critical 9.6)
- [CVE-2026-100803](https://insights.sbomify.com/CVE-2026-100803/): Same-origin policy bypass in the WebExtensions component (high 8.1)
- [CVE-2026-100802](https://insights.sbomify.com/CVE-2026-100802/): Uninitialized memory in the Graphics: WebGPU component (medium 4.3)
- [CVE-2026-100801](https://insights.sbomify.com/CVE-2026-100801/): Privilege escalation in the DLL Services component (high 8.8)
- [CVE-2026-100800](https://insights.sbomify.com/CVE-2026-100800/): Sandbox escape due to use-after-free in the Disability Access APIs component (critical 9.6)
- [CVE-2026-10080](https://insights.sbomify.com/CVE-2026-10080/): Boards plugin panics on WebSocket command with non-string field types (medium 6.5)
- [CVE-2026-1008](https://insights.sbomify.com/CVE-2026-1008/): Stored Cross-Site Scripting in Altium Live User Profile Fields (high 7.6)
- [CVE-2026-100799](https://insights.sbomify.com/CVE-2026-100799/): Uninitialized memory in the Graphics: WebGPU component (medium 4.3)
- [CVE-2026-100798](https://insights.sbomify.com/CVE-2026-100798/): Cryptography misuse in Storage: Quota Manager component (high 8.1)
- [CVE-2026-100797](https://insights.sbomify.com/CVE-2026-100797/): Privilege escalation due to use-after-free in the Graphics: WebRender component (high 8.8)
- [CVE-2026-100796](https://insights.sbomify.com/CVE-2026-100796/): Use-after-free in the JavaScript: WebAssembly component (high 8.8)
- [CVE-2026-100795](https://insights.sbomify.com/CVE-2026-100795/): Denial-of-service in the Networking component (medium 6.5)
- [CVE-2026-100794](https://insights.sbomify.com/CVE-2026-100794/): Sandbox escape due to incorrect boundary conditions in the Internationalization component (critical 9.6)
- [CVE-2026-100793](https://insights.sbomify.com/CVE-2026-100793/): JIT miscompilation in the JavaScript Engine component (medium 6.5)
- [CVE-2026-100792](https://insights.sbomify.com/CVE-2026-100792/): JIT miscompilation in the JavaScript: WebAssembly component (high 7.1)
- [CVE-2026-100791](https://insights.sbomify.com/CVE-2026-100791/): Use-after-free in the DOM: Core & HTML component (high 8.8)
- [CVE-2026-100790](https://insights.sbomify.com/CVE-2026-100790/): Use-after-free in the XSLT component (high 8.8)
- [CVE-2026-10079](https://insights.sbomify.com/CVE-2026-10079/): Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection (high 8.5)
- [CVE-2026-100789](https://insights.sbomify.com/CVE-2026-100789/): Use-after-free in the Graphics: Canvas2D component (high 8.8)
- [CVE-2026-100788](https://insights.sbomify.com/CVE-2026-100788/): Invalid pointer in the JavaScript: WebAssembly component (critical 9.8)
- [CVE-2026-100787](https://insights.sbomify.com/CVE-2026-100787/): Sandbox escape in the XUL component (critical 9.6)
- [CVE-2026-100786](https://insights.sbomify.com/CVE-2026-100786/): Sandbox escape due to use-after-free in the Graphics component (critical 9.6)
- [CVE-2026-100785](https://insights.sbomify.com/CVE-2026-100785/): Use-after-free in the DOM: Core & HTML component (high 8.8)
- [CVE-2026-100784](https://insights.sbomify.com/CVE-2026-100784/): Use-after-free in the Layout: Text and Fonts component (high 8.8)
- [CVE-2026-100783](https://insights.sbomify.com/CVE-2026-100783/): Uninitialized memory in the Audio/Video component (medium 4.3)
- [CVE-2026-100782](https://insights.sbomify.com/CVE-2026-100782/): Privilege escalation due to incorrect boundary conditions in the Graphics component (high 8.8)
- [CVE-2026-100781](https://insights.sbomify.com/CVE-2026-100781/): Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (critical 9.6)
- [CVE-2026-100780](https://insights.sbomify.com/CVE-2026-100780/): Use-after-free in the DOM: Core & HTML component (high 8.8)
- [CVE-2026-10078](https://insights.sbomify.com/CVE-2026-10078/): Quay/config-tool: quay/config-tool: gitlab oauth client_secret exposed in url querystring (low 2.7)
- [CVE-2026-100779](https://insights.sbomify.com/CVE-2026-100779/): Use-after-free in the XSLT component (high 8.8)
- [CVE-2026-100778](https://insights.sbomify.com/CVE-2026-100778/): Sandbox escape due to use-after-free in the DOM: Core & HTML component (critical 9.6)
- [CVE-2026-100777](https://insights.sbomify.com/CVE-2026-100777/): Use-after-free in the Graphics: Canvas2D component (high 8.8)
- [CVE-2026-100776](https://insights.sbomify.com/CVE-2026-100776/): Use-after-free in the JavaScript: WebAssembly component (high 8.8)
- [CVE-2026-100775](https://insights.sbomify.com/CVE-2026-100775/): Sandbox escape in the Graphics component (critical 9.6)
- [CVE-2026-100774](https://insights.sbomify.com/CVE-2026-100774/): Use-after-free in the DOM: Core & HTML component (high 8.8)
- [CVE-2026-100773](https://insights.sbomify.com/CVE-2026-100773/): Use-after-free in the Storage: IndexedDB component (high 8.8)
- [CVE-2026-100772](https://insights.sbomify.com/CVE-2026-100772/): Use-after-free in the DOM: Core & HTML component (high 8.8)
- [CVE-2026-100771](https://insights.sbomify.com/CVE-2026-100771/): Undefined behavior in the DOM: Streams component (high 8.1)
- [CVE-2026-100770](https://insights.sbomify.com/CVE-2026-100770/): Sandbox escape due to use-after-free in the DOM: Content Processes component (critical 9.6)
- [CVE-2026-10077](https://insights.sbomify.com/CVE-2026-10077/): YOOtheme Pro < 5.0.35 - Author+ Stored XSS via UIkit Data Attributes (medium 6.8)
- [CVE-2026-100769](https://insights.sbomify.com/CVE-2026-100769/): Use-after-free in the JavaScript: WebAssembly component (high 8.8)
- [CVE-2026-100768](https://insights.sbomify.com/CVE-2026-100768/): Use-after-free in the Graphics: WebGPU component (high 8.8)
- [CVE-2026-100767](https://insights.sbomify.com/CVE-2026-100767/): Use-after-free in the Networking: Cache component (high 8.8)
- [CVE-2026-100766](https://insights.sbomify.com/CVE-2026-100766/): Information disclosure in the Networking: JAR component (medium 4.3)
- [CVE-2026-100765](https://insights.sbomify.com/CVE-2026-100765/): Use-after-free in the JavaScript: WebAssembly component (high 8.8)
- [CVE-2026-100764](https://insights.sbomify.com/CVE-2026-100764/): Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component (high 8.8)
- [CVE-2026-100763](https://insights.sbomify.com/CVE-2026-100763/): Incorrect boundary conditions in the Graphics: WebGPU component (critical 9.1)
- [CVE-2026-100762](https://insights.sbomify.com/CVE-2026-100762/): Sandbox escape due to use-after-free in the DOM: Content Processes component (critical 9.6)
- [CVE-2026-100761](https://insights.sbomify.com/CVE-2026-100761/): Privilege escalation due to use-after-free in the Graphics: WebGPU component (high 8.8)
- [CVE-2026-100760](https://insights.sbomify.com/CVE-2026-100760/): Sandbox escape in the Security: Process Sandboxing component (critical 9.6)
- [CVE-2026-100759](https://insights.sbomify.com/CVE-2026-100759/): Uninitialized memory in the Storage: Quota Manager component (high 8.1)
- [CVE-2026-100758](https://insights.sbomify.com/CVE-2026-100758/): Sandbox escape in the DOM: Navigation component (critical 9.6)
- [CVE-2026-100757](https://insights.sbomify.com/CVE-2026-100757/): Use-after-free in the Widget component (high 8.8)
- [CVE-2026-100756](https://insights.sbomify.com/CVE-2026-100756/): Incorrect boundary conditions in the Audio/Video: Playback component (high 8.1)
- [CVE-2026-100755](https://insights.sbomify.com/CVE-2026-100755/): Acceptance of Extraneous Untrusted Data With Trusted Data in GitLab (medium 4.6)
- [CVE-2026-100753](https://insights.sbomify.com/CVE-2026-100753/): Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 (medium 5.3)
- [CVE-2026-100752](https://insights.sbomify.com/CVE-2026-100752/): Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 (critical 9.3)
- [CVE-2026-100751](https://insights.sbomify.com/CVE-2026-100751/): Cross-site scripting in Tabs & Accordions (Free, Pro) extension for Joomla (high 7.5)
- [CVE-2026-100750](https://insights.sbomify.com/CVE-2026-100750/): Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla (high 8.5)
- [CVE-2026-10075](https://insights.sbomify.com/CVE-2026-10075/): Interinfo｜DreamMaker - Path Traversal (medium 6.9)
- [CVE-2026-100749](https://insights.sbomify.com/CVE-2026-100749/): Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 (medium 5.1)
- [CVE-2026-100748](https://insights.sbomify.com/CVE-2026-100748/): Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 (medium 6.9)
- [CVE-2026-100747](https://insights.sbomify.com/CVE-2026-100747/): Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 (medium 5.1)
- [CVE-2026-100746](https://insights.sbomify.com/CVE-2026-100746/): coollabsio Coolify GitHub App Setup redirect missing authentication (medium 6.9)
- [CVE-2026-100745](https://insights.sbomify.com/CVE-2026-100745/): Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow (medium 5.3)
- [CVE-2026-100744](https://insights.sbomify.com/CVE-2026-100744/): coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization (medium 6.9)
- [CVE-2026-100741](https://insights.sbomify.com/CVE-2026-100741/): Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer (critical 9.8)
- [CVE-2026-100740](https://insights.sbomify.com/CVE-2026-100740/): D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write (critical 9.4)
- [CVE-2026-10074](https://insights.sbomify.com/CVE-2026-10074/): Interinfo｜DreamMaker - Arbitrary File Read (medium 6.9)
- [CVE-2026-100739](https://insights.sbomify.com/CVE-2026-100739/): mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection (medium 6.9)
- [CVE-2026-100737](https://insights.sbomify.com/CVE-2026-100737/): Security feature bypass in ADX1004 (medium 6.9)
- [CVE-2026-100730](https://insights.sbomify.com/CVE-2026-100730/): Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data (critical 9.3)
- [CVE-2026-10073](https://insights.sbomify.com/CVE-2026-10073/): Interinfo｜DreamMaker - Arbitrary File Read (high 8.7)
- [CVE-2026-100727](https://insights.sbomify.com/CVE-2026-100727/): Missing authorization in GROWI (medium 6.9)
- [CVE-2026-100725](https://insights.sbomify.com/CVE-2026-100725/): http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage (high 8.3)
- [CVE-2026-100724](https://insights.sbomify.com/CVE-2026-100724/): http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy (medium 6.3)
- [CVE-2026-100723](https://insights.sbomify.com/CVE-2026-100723/): vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool (medium 6.9)
- [CVE-2026-100722](https://insights.sbomify.com/CVE-2026-100722/): vm2 before 3.12.2 Host Process Termination via Construct Trap (high 8.9)
- [CVE-2026-100721](https://insights.sbomify.com/CVE-2026-100721/): vm2 before 3.12.2 Authorization Bypass via Custom Resolver (critical 9.5)
- [CVE-2026-100720](https://insights.sbomify.com/CVE-2026-100720/): Froxlor before 2.3.12 Stored XSS via SSL certificate issuer (critical 9.3)
- [CVE-2026-10072](https://insights.sbomify.com/CVE-2026-10072/): Interinfo｜DreamMaker - Arbitrary File Upload (high 8.6)
- [CVE-2026-100719](https://insights.sbomify.com/CVE-2026-100719/): Froxlor before 2.3.12 Credential Disclosure via DirProtections API (high 7.1)
- [CVE-2026-100718](https://insights.sbomify.com/CVE-2026-100718/): Froxlor before 2.3.12 Authentication Bypass via EmailSender.add (high 7.1)
- [CVE-2026-100717](https://insights.sbomify.com/CVE-2026-100717/): froxlor before 2.3.12 CRLF Injection via validateUrl userinfo (high 8.5)
- [CVE-2026-100716](https://insights.sbomify.com/CVE-2026-100716/): Froxlor before 2.3.12 Privilege Escalation via Symlink (critical 9.4)
- [CVE-2026-100715](https://insights.sbomify.com/CVE-2026-100715/): Froxlor before 2.3.12 Arbitrary File Deletion via Symlink (high 8.5)
- [CVE-2026-100714](https://insights.sbomify.com/CVE-2026-100714/): Froxlor before 2.3.12 Command Injection via letsencryptchallengepath (critical 9.4)
- [CVE-2026-100713](https://insights.sbomify.com/CVE-2026-100713/): Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync (high 7.1)
- [CVE-2026-100712](https://insights.sbomify.com/CVE-2026-100712/): froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF (high 7.1)
- [CVE-2026-100711](https://insights.sbomify.com/CVE-2026-100711/): froxlor before 2.3.12 Authentication Bypass via Session Persistence (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/1000/