# Vulnerabilities published in 2026


- [CVE-2026-118025](https://insights.sbomify.com/CVE-2026-118025/): Other issue in the SVG component (not scored)
- [CVE-2026-118024](https://insights.sbomify.com/CVE-2026-118024/): Use-after-free in the Graphics: Text component (not scored)
- [CVE-2026-118023](https://insights.sbomify.com/CVE-2026-118023/): Sandbox escape due to use-after-free in the Graphics: WebRender component (not scored)
- [CVE-2026-118022](https://insights.sbomify.com/CVE-2026-118022/): Sandbox escape due to use-after-free in the Disability Access APIs component (not scored)
- [CVE-2026-118021](https://insights.sbomify.com/CVE-2026-118021/): Sandbox escape due to use-after-free in the XPCOM component (not scored)
- [CVE-2026-118020](https://insights.sbomify.com/CVE-2026-118020/): Use-after-free in the Layout component (not scored)
- [CVE-2026-11802](https://insights.sbomify.com/CVE-2026-11802/): Missing authorization in FoodBook Lite – Online Food Ordering System (medium 5.3)
- [CVE-2026-118019](https://insights.sbomify.com/CVE-2026-118019/): Race condition, use-after-free in the DOM: File component (not scored)
- [CVE-2026-118018](https://insights.sbomify.com/CVE-2026-118018/): Spoofing issue in the Downloads component in Firefox for Android (not scored)
- [CVE-2026-118017](https://insights.sbomify.com/CVE-2026-118017/): Use-after-free in the SVG component (not scored)
- [CVE-2026-118016](https://insights.sbomify.com/CVE-2026-118016/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-118015](https://insights.sbomify.com/CVE-2026-118015/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-118014](https://insights.sbomify.com/CVE-2026-118014/): Use-after-free in the JavaScript Engine: JIT component (not scored)
- [CVE-2026-118013](https://insights.sbomify.com/CVE-2026-118013/): Use-after-free in the Layout: Images, Video, and HTML Frames component (not scored)
- [CVE-2026-118012](https://insights.sbomify.com/CVE-2026-118012/): Use-after-free in the DOM: Animation component (not scored)
- [CVE-2026-118011](https://insights.sbomify.com/CVE-2026-118011/): Frame poisoning in the CSS Parsing and Computation component (not scored)
- [CVE-2026-118010](https://insights.sbomify.com/CVE-2026-118010/): Use-after-free in the Disability Access APIs component (not scored)
- [CVE-2026-11801](https://insights.sbomify.com/CVE-2026-11801/): Missing authorization in WPAdverts – Classifieds Plugin (high 7.5)
- [CVE-2026-118009](https://insights.sbomify.com/CVE-2026-118009/): Integer overflow, use-after-free in the Graphics: Text component (not scored)
- [CVE-2026-118008](https://insights.sbomify.com/CVE-2026-118008/): Privilege escalation in the DOM: Navigation component (high 8.8)
- [CVE-2026-118007](https://insights.sbomify.com/CVE-2026-118007/): Use-after-free in the JavaScript: GC component (not scored)
- [CVE-2026-118006](https://insights.sbomify.com/CVE-2026-118006/): Privilege escalation due to use-after-free in the WebRTC: Signaling component (not scored)
- [CVE-2026-118005](https://insights.sbomify.com/CVE-2026-118005/): Use-after-free in the WebRTC: Signaling component (not scored)
- [CVE-2026-118004](https://insights.sbomify.com/CVE-2026-118004/): Incorrect boundary conditions in the CSS Transitions and Animations component (not scored)
- [CVE-2026-118003](https://insights.sbomify.com/CVE-2026-118003/): Information disclosure in the Networking: DNS component (not scored)
- [CVE-2026-118002](https://insights.sbomify.com/CVE-2026-118002/): Information disclosure due to race condition in the Networking component (not scored)
- [CVE-2026-118000](https://insights.sbomify.com/CVE-2026-118000/): Information disclosure in the Networking: HTTP component (not scored)
- [CVE-2026-11800](https://insights.sbomify.com/CVE-2026-11800/): Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion (high 8.1)
- [CVE-2026-1180](https://insights.sbomify.com/CVE-2026-1180/): Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF) (medium 5.8)
- [CVE-2026-117999](https://insights.sbomify.com/CVE-2026-117999/): Race condition in the IPC component (not scored)
- [CVE-2026-117998](https://insights.sbomify.com/CVE-2026-117998/): Mitigation bypass in the DOM: Push Subscriptions component (not scored)
- [CVE-2026-117997](https://insights.sbomify.com/CVE-2026-117997/): Sandbox escape due to use-after-free in the Widget component (not scored)
- [CVE-2026-117996](https://insights.sbomify.com/CVE-2026-117996/): Incorrect boundary conditions in the WebRTC component (not scored)
- [CVE-2026-117995](https://insights.sbomify.com/CVE-2026-117995/): Privilege escalation in the DOM: UI Events & Focus Handling component (not scored)
- [CVE-2026-117994](https://insights.sbomify.com/CVE-2026-117994/): Use-after-free in the JavaScript: GC component (not scored)
- [CVE-2026-117993](https://insights.sbomify.com/CVE-2026-117993/): Integer overflow in the Graphics: Text component (not scored)
- [CVE-2026-117992](https://insights.sbomify.com/CVE-2026-117992/): Information disclosure in the CSS Parsing and Computation component (not scored)
- [CVE-2026-117991](https://insights.sbomify.com/CVE-2026-117991/): Incorrect boundary conditions in the Layout: Text and Fonts component (not scored)
- [CVE-2026-117990](https://insights.sbomify.com/CVE-2026-117990/): Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (not scored)
- [CVE-2026-11799](https://insights.sbomify.com/CVE-2026-11799/): UXSS in Focus for iOS / Klar Webkit navigation (high 7.5)
- [CVE-2026-117989](https://insights.sbomify.com/CVE-2026-117989/): Use-after-free in the Graphics component (not scored)
- [CVE-2026-117988](https://insights.sbomify.com/CVE-2026-117988/): Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (not scored)
- [CVE-2026-117987](https://insights.sbomify.com/CVE-2026-117987/): Use-after-free in the Graphics component (not scored)
- [CVE-2026-117986](https://insights.sbomify.com/CVE-2026-117986/): Use-after-free in the Graphics component (not scored)
- [CVE-2026-117985](https://insights.sbomify.com/CVE-2026-117985/): Sandbox escape due to use-after-free in the Graphics component (not scored)
- [CVE-2026-117984](https://insights.sbomify.com/CVE-2026-117984/): Incorrect boundary conditions in the Layout: Scrolling and Overflow component (not scored)
- [CVE-2026-117983](https://insights.sbomify.com/CVE-2026-117983/): Use-after-free in the Graphics component (not scored)
- [CVE-2026-117982](https://insights.sbomify.com/CVE-2026-117982/): Invalid pointer in the JavaScript Engine: JIT component (not scored)
- [CVE-2026-117981](https://insights.sbomify.com/CVE-2026-117981/): Privilege escalation in the Toolkit component (not scored)
- [CVE-2026-117980](https://insights.sbomify.com/CVE-2026-117980/): Use-after-free in the Graphics component (not scored)
- [CVE-2026-11798](https://insights.sbomify.com/CVE-2026-11798/): Cross-site scripting in Social Share, Social Login and Social Comments Plugin – Super Socializer (medium 6.1)
- [CVE-2026-117979](https://insights.sbomify.com/CVE-2026-117979/): Incorrect boundary conditions in the Graphics: WebRender component (not scored)
- [CVE-2026-117978](https://insights.sbomify.com/CVE-2026-117978/): Incorrect boundary conditions in the Graphics component (not scored)
- [CVE-2026-117977](https://insights.sbomify.com/CVE-2026-117977/): Other issue in the Console component (not scored)
- [CVE-2026-117976](https://insights.sbomify.com/CVE-2026-117976/): Site isolation issue in the DOM: Navigation component (not scored)
- [CVE-2026-117975](https://insights.sbomify.com/CVE-2026-117975/): Sandbox escape due to invalid pointer in the Graphics: WebRender component (not scored)
- [CVE-2026-117974](https://insights.sbomify.com/CVE-2026-117974/): Use-after-free in the XML component (not scored)
- [CVE-2026-117973](https://insights.sbomify.com/CVE-2026-117973/): Use-after-free in the Networking: DNS component (not scored)
- [CVE-2026-117972](https://insights.sbomify.com/CVE-2026-117972/): Use-after-free in the Graphics component (not scored)
- [CVE-2026-117971](https://insights.sbomify.com/CVE-2026-117971/): Sandbox escape due to use-after-free in the Print Preview component (not scored)
- [CVE-2026-117970](https://insights.sbomify.com/CVE-2026-117970/): Race condition in the Disability Access APIs component (not scored)
- [CVE-2026-117969](https://insights.sbomify.com/CVE-2026-117969/): Invalid pointer in the JavaScript Engine: JIT component (not scored)
- [CVE-2026-117968](https://insights.sbomify.com/CVE-2026-117968/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117967](https://insights.sbomify.com/CVE-2026-117967/): Mitigation bypass in the DOM: Security component (not scored)
- [CVE-2026-117966](https://insights.sbomify.com/CVE-2026-117966/): Site isolation issue in the Networking: HTTP component (not scored)
- [CVE-2026-117965](https://insights.sbomify.com/CVE-2026-117965/): Same-origin policy bypass in the Address Bar component (not scored)
- [CVE-2026-117964](https://insights.sbomify.com/CVE-2026-117964/): Use-after-free in the Panning and Zooming component (not scored)
- [CVE-2026-117963](https://insights.sbomify.com/CVE-2026-117963/): Incorrect boundary conditions in the DOM: Service Workers component (not scored)
- [CVE-2026-117962](https://insights.sbomify.com/CVE-2026-117962/): Sandbox escape due to incorrect boundary conditions in the Storage: Quota Manager component (not scored)
- [CVE-2026-117961](https://insights.sbomify.com/CVE-2026-117961/): Incorrect boundary conditions in the Layout: Text and Fonts component (not scored)
- [CVE-2026-117960](https://insights.sbomify.com/CVE-2026-117960/): Spoofing issue in the DOM: Core & HTML component (not scored)
- [CVE-2026-11796](https://insights.sbomify.com/CVE-2026-11796/): Missing authorization in Asset Suite (medium 5.1)
- [CVE-2026-117959](https://insights.sbomify.com/CVE-2026-117959/): Site isolation issue in the DOM: Service Workers component (not scored)
- [CVE-2026-117958](https://insights.sbomify.com/CVE-2026-117958/): Site isolation issue in the Networking: HTTP component (not scored)
- [CVE-2026-117957](https://insights.sbomify.com/CVE-2026-117957/): Cryptographic issue in the WebRTC: Networking component (not scored)
- [CVE-2026-117956](https://insights.sbomify.com/CVE-2026-117956/): Invalid pointer in the Nimbus Desktop Client component (not scored)
- [CVE-2026-117955](https://insights.sbomify.com/CVE-2026-117955/): JIT miscompilation in the JavaScript: WebAssembly component (not scored)
- [CVE-2026-117954](https://insights.sbomify.com/CVE-2026-117954/): Use-after-free in the Layout: Positioned component (not scored)
- [CVE-2026-117953](https://insights.sbomify.com/CVE-2026-117953/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117952](https://insights.sbomify.com/CVE-2026-117952/): Uninitialized memory in the Networking component (not scored)
- [CVE-2026-117951](https://insights.sbomify.com/CVE-2026-117951/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117950](https://insights.sbomify.com/CVE-2026-117950/): Incorrect boundary conditions in the DOM: Core & HTML component (not scored)
- [CVE-2026-11795](https://insights.sbomify.com/CVE-2026-11795/): User Enumeration in Softtr's E-Commerce Pack (medium 5.3)
- [CVE-2026-117949](https://insights.sbomify.com/CVE-2026-117949/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117948](https://insights.sbomify.com/CVE-2026-117948/): Use-after-free in the SVG component (not scored)
- [CVE-2026-117947](https://insights.sbomify.com/CVE-2026-117947/): Use-after-free in the XML component (not scored)
- [CVE-2026-117946](https://insights.sbomify.com/CVE-2026-117946/): Incorrect boundary conditions in the JavaScript Engine component (not scored)
- [CVE-2026-117945](https://insights.sbomify.com/CVE-2026-117945/): Incorrect boundary conditions in the XML component (not scored)
- [CVE-2026-117944](https://insights.sbomify.com/CVE-2026-117944/): Use-after-free in the Layout component (not scored)
- [CVE-2026-117943](https://insights.sbomify.com/CVE-2026-117943/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117942](https://insights.sbomify.com/CVE-2026-117942/): Incorrect boundary conditions in the JavaScript Engine: JIT component (not scored)
- [CVE-2026-117941](https://insights.sbomify.com/CVE-2026-117941/): Use-after-free in the DOM: CSS Object Model component (not scored)
- [CVE-2026-117940](https://insights.sbomify.com/CVE-2026-117940/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-11794](https://insights.sbomify.com/CVE-2026-11794/): Advanced Form Integration < 2.1.1 - Unauthenticated Privilege Escalation via Breakdance Form Role Mapping (high 8.1)
- [CVE-2026-117939](https://insights.sbomify.com/CVE-2026-117939/): Use-after-free in the XML component (not scored)
- [CVE-2026-117938](https://insights.sbomify.com/CVE-2026-117938/): Use-after-free in the Layout component (not scored)
- [CVE-2026-117937](https://insights.sbomify.com/CVE-2026-117937/): Invalid pointer in the JavaScript Engine component (not scored)
- [CVE-2026-117936](https://insights.sbomify.com/CVE-2026-117936/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117935](https://insights.sbomify.com/CVE-2026-117935/): Use-after-free in the DOM: Bindings (WebIDL) component (not scored)
- [CVE-2026-117934](https://insights.sbomify.com/CVE-2026-117934/): Use-after-free in the Layout component (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/894/