# Vulnerabilities published in 2026


- [CVE-2026-74987](https://insights.sbomify.com/CVE-2026-74987/): Internally found bugs fixed in Firefox ESR 140.14, Firefox ESR 153.1 and Firefox 154 (critical 9.8)
- [CVE-2026-74986](https://insights.sbomify.com/CVE-2026-74986/): Site isolation issue in the CSS Parsing and Computation component (critical 9.1)
- [CVE-2026-74985](https://insights.sbomify.com/CVE-2026-74985/): Privilege escalation in the Enterprise Policies component (critical 9.8)
- [CVE-2026-74984](https://insights.sbomify.com/CVE-2026-74984/): Race condition in the JavaScript Engine component (medium 6.8)
- [CVE-2026-74983](https://insights.sbomify.com/CVE-2026-74983/): Mitigation bypass in the Data Loss Prevention component (high 8.1)
- [CVE-2026-74982](https://insights.sbomify.com/CVE-2026-74982/): Denial-of-service in the Widget component (high 7.5)
- [CVE-2026-74981](https://insights.sbomify.com/CVE-2026-74981/): Site isolation issue in the Audio/Video: Web Codecs component (high 8.1)
- [CVE-2026-74980](https://insights.sbomify.com/CVE-2026-74980/): Clickjacking issue in the Downloads component in Firefox for Android (medium 6.5)
- [CVE-2026-7498](https://insights.sbomify.com/CVE-2026-7498/): Stored XSS in Basamak Informatics' DernekWeb (high 8.8)
- [CVE-2026-74979](https://insights.sbomify.com/CVE-2026-74979/): Mitigation bypass in the Add-ons Manager component (critical 9.8)
- [CVE-2026-74978](https://insights.sbomify.com/CVE-2026-74978/): Clickjacking issue in the Widget component (high 8.1)
- [CVE-2026-74977](https://insights.sbomify.com/CVE-2026-74977/): Integer overflow in the Graphics component (high 7.5)
- [CVE-2026-74976](https://insights.sbomify.com/CVE-2026-74976/): JIT miscompilation in the JavaScript Engine: JIT component (medium 6.5)
- [CVE-2026-74975](https://insights.sbomify.com/CVE-2026-74975/): Spoofing issue in the Downloads component in Firefox for Android (medium 5.4)
- [CVE-2026-74974](https://insights.sbomify.com/CVE-2026-74974/): Same-origin policy bypass in the Graphics: ImageLib component (medium 5.4)
- [CVE-2026-74973](https://insights.sbomify.com/CVE-2026-74973/): Race condition, use-after-free in the Graphics component (medium 4.2)
- [CVE-2026-74972](https://insights.sbomify.com/CVE-2026-74972/): Information disclosure in the DOM: Push Subscriptions component (medium 4.3)
- [CVE-2026-74971](https://insights.sbomify.com/CVE-2026-74971/): Information disclosure in the DOM: UI Events & Focus Handling component (medium 4.3)
- [CVE-2026-74970](https://insights.sbomify.com/CVE-2026-74970/): Site isolation issue in the Graphics component (medium 5.4)
- [CVE-2026-74969](https://insights.sbomify.com/CVE-2026-74969/): Race condition, use-after-free in the Layout: Text and Fonts component (high 8.8)
- [CVE-2026-74968](https://insights.sbomify.com/CVE-2026-74968/): Site isolation issue in the Graphics: WebRender component (medium 5.4)
- [CVE-2026-74967](https://insights.sbomify.com/CVE-2026-74967/): Same-origin policy bypass in the Audio/Video: Playback component (medium 5.4)
- [CVE-2026-74966](https://insights.sbomify.com/CVE-2026-74966/): Information disclosure in the Form Autofill component (high 7.5)
- [CVE-2026-74965](https://insights.sbomify.com/CVE-2026-74965/): Privilege escalation in the Shell Integration component (high 8.8)
- [CVE-2026-74964](https://insights.sbomify.com/CVE-2026-74964/): Integer overflow in the Graphics component (critical 9.8)
- [CVE-2026-74963](https://insights.sbomify.com/CVE-2026-74963/): Same-origin policy bypass in the Networking: Cookies component (medium 5.4)
- [CVE-2026-74962](https://insights.sbomify.com/CVE-2026-74962/): Site isolation issue in the Networking: Cookies component (high 8.1)
- [CVE-2026-74961](https://insights.sbomify.com/CVE-2026-74961/): Side-channel in the Web Audio component (critical 9.1)
- [CVE-2026-74960](https://insights.sbomify.com/CVE-2026-74960/): Site isolation issue in the WebExtensions component (high 8.1)
- [CVE-2026-74959](https://insights.sbomify.com/CVE-2026-74959/): Mitigation bypass in the Storage: Cache API component (critical 9.1)
- [CVE-2026-74958](https://insights.sbomify.com/CVE-2026-74958/): Information disclosure in the WebRTC component (high 7.5)
- [CVE-2026-74957](https://insights.sbomify.com/CVE-2026-74957/): Mitigation bypass in the Safe Browsing component (high 8.1)
- [CVE-2026-74956](https://insights.sbomify.com/CVE-2026-74956/): Same-origin policy bypass in the DOM: Service Workers component (critical 9.1)
- [CVE-2026-74955](https://insights.sbomify.com/CVE-2026-74955/): Privilege escalation in the Request Handling component (high 8.8)
- [CVE-2026-74954](https://insights.sbomify.com/CVE-2026-74954/): Information disclosure due to side-channel in the Storage: Cache API component (high 7.5)
- [CVE-2026-74953](https://insights.sbomify.com/CVE-2026-74953/): Privilege escalation in the Networking: Cookies component (high 8.8)
- [CVE-2026-74952](https://insights.sbomify.com/CVE-2026-74952/): Privilege escalation in the Application Update component (high 8.8)
- [CVE-2026-74951](https://insights.sbomify.com/CVE-2026-74951/): Clickjacking issue in Firefox for Android (medium 6.5)
- [CVE-2026-74950](https://insights.sbomify.com/CVE-2026-74950/): Privilege escalation in the Downloads API component (high 8.8)
- [CVE-2026-74949](https://insights.sbomify.com/CVE-2026-74949/): Use-after-free in the Graphics: Canvas2D component (high 8.8)
- [CVE-2026-74948](https://insights.sbomify.com/CVE-2026-74948/): Information disclosure in the Graphics component (medium 6.5)
- [CVE-2026-74947](https://insights.sbomify.com/CVE-2026-74947/): Privilege escalation due to invalid pointer in the Graphics component (high 8.8)
- [CVE-2026-74946](https://insights.sbomify.com/CVE-2026-74946/): Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component (high 8.8)
- [CVE-2026-74945](https://insights.sbomify.com/CVE-2026-74945/): Information disclosure in the Graphics: Text component (medium 6.5)
- [CVE-2026-74944](https://insights.sbomify.com/CVE-2026-74944/): Use-after-free in the DOM: Core & HTML component (critical 9.8)
- [CVE-2026-74943](https://insights.sbomify.com/CVE-2026-74943/): Use-after-free in the Graphics: ImageLib component (critical 9.8)
- [CVE-2026-74942](https://insights.sbomify.com/CVE-2026-74942/): Privilege escalation in the Remote Settings Client component (high 8.8)
- [CVE-2026-74941](https://insights.sbomify.com/CVE-2026-74941/): Privilege escalation in the Graphics: CanvasWebGL component (high 8.8)
- [CVE-2026-74940](https://insights.sbomify.com/CVE-2026-74940/): Use-after-free in the Graphics: Text component (critical 9.8)
- [CVE-2026-7494](https://insights.sbomify.com/CVE-2026-7494/): Nexus Repository - SSRF in SSL Certificate Retrieval (medium 5.3)
- [CVE-2026-74939](https://insights.sbomify.com/CVE-2026-74939/): Privilege escalation in the DOM: Navigation component (high 8.8)
- [CVE-2026-74938](https://insights.sbomify.com/CVE-2026-74938/): Mitigation bypass in the JavaScript: GC component (critical 9.1)
- [CVE-2026-74937](https://insights.sbomify.com/CVE-2026-74937/): Use-after-free in the JavaScript: GC component (high 8.8)
- [CVE-2026-74936](https://insights.sbomify.com/CVE-2026-74936/): Use-after-free in the JavaScript: WebAssembly component (critical 9.8)
- [CVE-2026-74935](https://insights.sbomify.com/CVE-2026-74935/): Privilege escalation in the DOM: Networking component (high 8.8)
- [CVE-2026-74934](https://insights.sbomify.com/CVE-2026-74934/): Site isolation issue in the Graphics: CanvasWebGL component (high 7.5)
- [CVE-2026-74933](https://insights.sbomify.com/CVE-2026-74933/): GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite (high 8.8)
- [CVE-2026-74932](https://insights.sbomify.com/CVE-2026-74932/): WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning (high 7.5)
- [CVE-2026-74930](https://insights.sbomify.com/CVE-2026-74930/): WP Project Manager 2.2.0 - 4.0.6 - Subscriber+ User Activity Feed Disclosure via IDOR (medium 4.3)
- [CVE-2026-7493](https://insights.sbomify.com/CVE-2026-7493/): Denial of service in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin (medium 5.3)
- [CVE-2026-74929](https://insights.sbomify.com/CVE-2026-74929/): WP Project Manager < 4.0.7 - Subscriber+ Cross-Project Task Disclosure and Task Board Modification via IDOR (medium 5.4)
- [CVE-2026-74928](https://insights.sbomify.com/CVE-2026-74928/): WP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes (high 7.5)
- [CVE-2026-74927](https://insights.sbomify.com/CVE-2026-74927/): MultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint (medium 5.3)
- [CVE-2026-74926](https://insights.sbomify.com/CVE-2026-74926/): MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint (high 7.1)
- [CVE-2026-74925](https://insights.sbomify.com/CVE-2026-74925/): MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator (high 7.2)
- [CVE-2026-74923](https://insights.sbomify.com/CVE-2026-74923/): Missing authorization in Document Gallery (medium 5.3)
- [CVE-2026-74922](https://insights.sbomify.com/CVE-2026-74922/): Document Gallery 4.1 - 5.1.1 - Unauthenticated Document Thumbnail Replacement via Thumber Webhook Signature Bypass (medium 5.3)
- [CVE-2026-74921](https://insights.sbomify.com/CVE-2026-74921/): Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes (medium 6.8)
- [CVE-2026-74920](https://insights.sbomify.com/CVE-2026-74920/): Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute (high 7.1)
- [CVE-2026-7492](https://insights.sbomify.com/CVE-2026-7492/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2026-74916](https://insights.sbomify.com/CVE-2026-74916/): WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Parameters (medium 6.5)
- [CVE-2026-7491](https://insights.sbomify.com/CVE-2026-7491/): Zyosoft｜School App - Insecure Direct Object Reference (high 8.6)
- [CVE-2026-74909](https://insights.sbomify.com/CVE-2026-74909/): Security feature bypass in Red Hat Single Sign-On 7 (high 8.1)
- [CVE-2026-74908](https://insights.sbomify.com/CVE-2026-74908/): Grav plugin-api before 1.0.15 Script Injection via SVG (medium 5.1)
- [CVE-2026-74907](https://insights.sbomify.com/CVE-2026-74907/): Grav before 2.0.15 Path Traversal via plugin-asset-map.php (high 8.2)
- [CVE-2026-74906](https://insights.sbomify.com/CVE-2026-74906/): SiYuan before v3.7.4 Incorrect Authorization via Publish Access (high 8.7)
- [CVE-2026-74905](https://insights.sbomify.com/CVE-2026-74905/): SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass (medium 6.9)
- [CVE-2026-74904](https://insights.sbomify.com/CVE-2026-74904/): SiYuan before v3.7.4 Missing Authorization via block API (high 8.7)
- [CVE-2026-74903](https://insights.sbomify.com/CVE-2026-74903/): SiYuan before v3.7.4 Insufficient Access Control via spinBlockDOM (medium 5.3)
- [CVE-2026-74902](https://insights.sbomify.com/CVE-2026-74902/): SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload (critical 9.3)
- [CVE-2026-74901](https://insights.sbomify.com/CVE-2026-74901/): openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback (critical 9.3)
- [CVE-2026-74900](https://insights.sbomify.com/CVE-2026-74900/): openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode (critical 9.3)
- [CVE-2026-7490](https://insights.sbomify.com/CVE-2026-7490/): Sunnet｜CTMS and CPAS - Arbitrary File Upload (high 8.6)
- [CVE-2026-74899](https://insights.sbomify.com/CVE-2026-74899/): openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy (critical 9.3)
- [CVE-2026-74896](https://insights.sbomify.com/CVE-2026-74896/): openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal (critical 9.3)
- [CVE-2026-74895](https://insights.sbomify.com/CVE-2026-74895/): openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation (critical 9.3)
- [CVE-2026-74894](https://insights.sbomify.com/CVE-2026-74894/): openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token (critical 9.3)
- [CVE-2026-74893](https://insights.sbomify.com/CVE-2026-74893/): openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets (high 8.7)
- [CVE-2026-74892](https://insights.sbomify.com/CVE-2026-74892/): openssl_encrypt before 1.4.0 Hardcoded Secret Key (high 8.7)
- [CVE-2026-74891](https://insights.sbomify.com/CVE-2026-74891/): openssl_encrypt before 1.4.0 Hardcoded Database Credentials (high 8.7)
- [CVE-2026-74890](https://insights.sbomify.com/CVE-2026-74890/): openssl_encrypt before 1.4.0 HMAC Authentication Bypass via Environment Variable (critical 9.3)
- [CVE-2026-7489](https://insights.sbomify.com/CVE-2026-7489/): Sunnet｜CTMS - SQL Injection (high 8.7)
- [CVE-2026-74889](https://insights.sbomify.com/CVE-2026-74889/): openssl_encrypt before 1.4.0 Weak Key Derivation via HKDF (critical 9.3)
- [CVE-2026-74888](https://insights.sbomify.com/CVE-2026-74888/): openssl_encrypt before 1.4.0 Non-Standard PBKDF2 Key Derivation (high 8.7)
- [CVE-2026-74887](https://insights.sbomify.com/CVE-2026-74887/): openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module (medium 6.3)
- [CVE-2026-74886](https://insights.sbomify.com/CVE-2026-74886/): openssl_encrypt before 1.4.0 Plugin Import Guard Bypass (critical 9.3)
- [CVE-2026-74885](https://insights.sbomify.com/CVE-2026-74885/): openssl_encrypt before 1.4.0 Logging Bug and Race Condition (critical 9.3)
- [CVE-2026-74884](https://insights.sbomify.com/CVE-2026-74884/): openssl_encrypt before 1.4.0 Path Traversal via plugin_id (high 8.7)
- [CVE-2026-74883](https://insights.sbomify.com/CVE-2026-74883/): openssl_encrypt before 1.4.0 Sandbox Bypass via pathlib and io (high 8.7)
- [CVE-2026-74882](https://insights.sbomify.com/CVE-2026-74882/): openssl_encrypt before 1.4.0 Insecure Default Configuration (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/388/