# Vulnerabilities published in 2026


- [CVE-2026-117933](https://insights.sbomify.com/CVE-2026-117933/): Frame poisoning in the CSS Parsing and Computation component (not scored)
- [CVE-2026-117932](https://insights.sbomify.com/CVE-2026-117932/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117931](https://insights.sbomify.com/CVE-2026-117931/): Use-after-free in the DOM: Events component (not scored)
- [CVE-2026-117930](https://insights.sbomify.com/CVE-2026-117930/): Use-after-free in the DOM: Bindings (WebIDL) component (not scored)
- [CVE-2026-11793](https://insights.sbomify.com/CVE-2026-11793/): 389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing (medium 4.9)
- [CVE-2026-117929](https://insights.sbomify.com/CVE-2026-117929/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117928](https://insights.sbomify.com/CVE-2026-117928/): Same-origin policy bypass in the CSS Parsing and Computation component (not scored)
- [CVE-2026-117927](https://insights.sbomify.com/CVE-2026-117927/): Use-after-free in the SVG component (not scored)
- [CVE-2026-117926](https://insights.sbomify.com/CVE-2026-117926/): Incorrect boundary conditions in the SVG component (not scored)
- [CVE-2026-117925](https://insights.sbomify.com/CVE-2026-117925/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117924](https://insights.sbomify.com/CVE-2026-117924/): Use-after-free in the XSLT component (not scored)
- [CVE-2026-117923](https://insights.sbomify.com/CVE-2026-117923/): Use-after-free in the Audio/Video component (not scored)
- [CVE-2026-117922](https://insights.sbomify.com/CVE-2026-117922/): Use-after-free in the Networking: WebSockets component (not scored)
- [CVE-2026-117921](https://insights.sbomify.com/CVE-2026-117921/): Use-after-free in the CSS Parsing and Computation component (not scored)
- [CVE-2026-117920](https://insights.sbomify.com/CVE-2026-117920/): Use-after-free in the DOM: HTML Parser component (not scored)
- [CVE-2026-11792](https://insights.sbomify.com/CVE-2026-11792/): 389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string) (low 3.3)
- [CVE-2026-117919](https://insights.sbomify.com/CVE-2026-117919/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117918](https://insights.sbomify.com/CVE-2026-117918/): Use-after-free in the Graphics: Canvas2D component (not scored)
- [CVE-2026-117917](https://insights.sbomify.com/CVE-2026-117917/): Invalid pointer in the Graphics: WebRender component (not scored)
- [CVE-2026-117916](https://insights.sbomify.com/CVE-2026-117916/): Use-after-free in the XSLT component (not scored)
- [CVE-2026-117915](https://insights.sbomify.com/CVE-2026-117915/): Incorrect boundary conditions in the Layout: Block and Inline component (not scored)
- [CVE-2026-117914](https://insights.sbomify.com/CVE-2026-117914/): Use-after-free in the SVG component (not scored)
- [CVE-2026-117913](https://insights.sbomify.com/CVE-2026-117913/): Use-after-free in the SVG component (not scored)
- [CVE-2026-117912](https://insights.sbomify.com/CVE-2026-117912/): Same-origin policy bypass in the CSS Parsing and Computation component (not scored)
- [CVE-2026-117911](https://insights.sbomify.com/CVE-2026-117911/): Use-after-free in the Audio/Video: Playback component (not scored)
- [CVE-2026-117910](https://insights.sbomify.com/CVE-2026-117910/): Invalid pointer in the JavaScript Engine component (not scored)
- [CVE-2026-11791](https://insights.sbomify.com/CVE-2026-11791/): 389-ds-base: 389-ds-base: use-after-free in schema reload via attr_syntax_swap_ht() (medium 5.0)
- [CVE-2026-117909](https://insights.sbomify.com/CVE-2026-117909/): Use-after-free in the JavaScript: GC component (not scored)
- [CVE-2026-117908](https://insights.sbomify.com/CVE-2026-117908/): Use-after-free in the Graphics: ImageLib component (not scored)
- [CVE-2026-117907](https://insights.sbomify.com/CVE-2026-117907/): Use-after-free in the Networking component (not scored)
- [CVE-2026-117906](https://insights.sbomify.com/CVE-2026-117906/): Use-after-free in the CSS Parsing and Computation component (not scored)
- [CVE-2026-117905](https://insights.sbomify.com/CVE-2026-117905/): Use-after-free in the Audio/Video: Playback component (not scored)
- [CVE-2026-117904](https://insights.sbomify.com/CVE-2026-117904/): Use-after-free in the JavaScript: GC component (not scored)
- [CVE-2026-117903](https://insights.sbomify.com/CVE-2026-117903/): Use-after-free in the Audio/Video component (not scored)
- [CVE-2026-117902](https://insights.sbomify.com/CVE-2026-117902/): Use-after-free in the Layout: Text and Fonts component (not scored)
- [CVE-2026-117901](https://insights.sbomify.com/CVE-2026-117901/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117900](https://insights.sbomify.com/CVE-2026-117900/): Use-after-free in the DOM: Editor component (not scored)
- [CVE-2026-11790](https://insights.sbomify.com/CVE-2026-11790/): 389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service (medium 4.9)
- [CVE-2026-1179](https://insights.sbomify.com/CVE-2026-1179/): Yonyou KSOA HTTP GET Parameter user_popedom.jsp sql injection (medium 6.9)
- [CVE-2026-117899](https://insights.sbomify.com/CVE-2026-117899/): Use-after-free in the Networking: HTTP component (not scored)
- [CVE-2026-117898](https://insights.sbomify.com/CVE-2026-117898/): Use-after-free in the JavaScript Engine: JIT component (not scored)
- [CVE-2026-117897](https://insights.sbomify.com/CVE-2026-117897/): Incorrect boundary conditions in the Layout: Tables component (not scored)
- [CVE-2026-117896](https://insights.sbomify.com/CVE-2026-117896/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117895](https://insights.sbomify.com/CVE-2026-117895/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117894](https://insights.sbomify.com/CVE-2026-117894/): Incorrect boundary conditions in the WebRTC: Signaling component (not scored)
- [CVE-2026-117893](https://insights.sbomify.com/CVE-2026-117893/): Incorrect boundary conditions in the Security: PSM component (not scored)
- [CVE-2026-117892](https://insights.sbomify.com/CVE-2026-117892/): Privilege escalation due to use-after-free in the WebRTC: Networking component (not scored)
- [CVE-2026-117891](https://insights.sbomify.com/CVE-2026-117891/): Use-after-free in the JavaScript Engine: JIT component (not scored)
- [CVE-2026-117890](https://insights.sbomify.com/CVE-2026-117890/): JIT miscompilation in the JavaScript Engine: JIT component (not scored)
- [CVE-2026-11789](https://insights.sbomify.com/CVE-2026-11789/): 389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash (medium 4.9)
- [CVE-2026-117889](https://insights.sbomify.com/CVE-2026-117889/): Incorrect boundary conditions in the JavaScript Engine component (not scored)
- [CVE-2026-117888](https://insights.sbomify.com/CVE-2026-117888/): Uninitialized memory in the Graphics: Canvas2D component (not scored)
- [CVE-2026-117887](https://insights.sbomify.com/CVE-2026-117887/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117886](https://insights.sbomify.com/CVE-2026-117886/): Incorrect boundary conditions in the Graphics: Text component (not scored)
- [CVE-2026-117885](https://insights.sbomify.com/CVE-2026-117885/): Use-after-free in the Layout: Grid component (not scored)
- [CVE-2026-117884](https://insights.sbomify.com/CVE-2026-117884/): Use-after-free in the Networking component (not scored)
- [CVE-2026-117883](https://insights.sbomify.com/CVE-2026-117883/): Use-after-free in the DOM: HTML Parser component (not scored)
- [CVE-2026-117882](https://insights.sbomify.com/CVE-2026-117882/): Use-after-free in the Layout component (not scored)
- [CVE-2026-117881](https://insights.sbomify.com/CVE-2026-117881/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117880](https://insights.sbomify.com/CVE-2026-117880/): Use-after-free in the XML component (not scored)
- [CVE-2026-11788](https://insights.sbomify.com/CVE-2026-11788/): 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser (medium 5.9)
- [CVE-2026-117879](https://insights.sbomify.com/CVE-2026-117879/): Incorrect boundary conditions in the Layout: Tables component (not scored)
- [CVE-2026-117878](https://insights.sbomify.com/CVE-2026-117878/): Other issue, use-after-free in the Storage: IndexedDB component (not scored)
- [CVE-2026-117877](https://insights.sbomify.com/CVE-2026-117877/): Use-after-free in the Layout: Text and Fonts component (not scored)
- [CVE-2026-117876](https://insights.sbomify.com/CVE-2026-117876/): Use-after-free in the Layout: Text and Fonts component (not scored)
- [CVE-2026-117875](https://insights.sbomify.com/CVE-2026-117875/): Use-after-free in the Layout: Scrolling and Overflow component (not scored)
- [CVE-2026-117874](https://insights.sbomify.com/CVE-2026-117874/): Use-after-free in the Internationalization component (not scored)
- [CVE-2026-117873](https://insights.sbomify.com/CVE-2026-117873/): Incorrect boundary conditions in the Audio/Video: Playback component (not scored)
- [CVE-2026-117872](https://insights.sbomify.com/CVE-2026-117872/): Use-after-free in the JavaScript: Standard Library component (not scored)
- [CVE-2026-117871](https://insights.sbomify.com/CVE-2026-117871/): Invalid pointer in the Graphics component (not scored)
- [CVE-2026-117870](https://insights.sbomify.com/CVE-2026-117870/): Use-after-free in the JavaScript Engine component (not scored)
- [CVE-2026-11787](https://insights.sbomify.com/CVE-2026-11787/): 389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev() via str2simple filter parsing (medium 5.0)
- [CVE-2026-117869](https://insights.sbomify.com/CVE-2026-117869/): Use-after-free in the DOM: Core & HTML component (not scored)
- [CVE-2026-117868](https://insights.sbomify.com/CVE-2026-117868/): Sandbox escape in the DOM: Networking component (not scored)
- [CVE-2026-117867](https://insights.sbomify.com/CVE-2026-117867/): Use-after-free in the Layout component (not scored)
- [CVE-2026-117866](https://insights.sbomify.com/CVE-2026-117866/): Privilege escalation due to use-after-free in the Graphics: Canvas2D component (not scored)
- [CVE-2026-117865](https://insights.sbomify.com/CVE-2026-117865/): Use-after-free in the JavaScript: GC component (not scored)
- [CVE-2026-117864](https://insights.sbomify.com/CVE-2026-117864/): Sandbox escape in the Form Manager component (not scored)
- [CVE-2026-117863](https://insights.sbomify.com/CVE-2026-117863/): Information disclosure due to uninitialized memory in the Audio/Video component (not scored)
- [CVE-2026-117862](https://insights.sbomify.com/CVE-2026-117862/): Privilege escalation due to incorrect boundary conditions in the Networking component (not scored)
- [CVE-2026-117861](https://insights.sbomify.com/CVE-2026-117861/): Sandbox escape in the DOM: Navigation component (not scored)
- [CVE-2026-117860](https://insights.sbomify.com/CVE-2026-117860/): Same-origin policy bypass in the DOM: Navigation component (not scored)
- [CVE-2026-11786](https://insights.sbomify.com/CVE-2026-11786/): 389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type() (low 1.9)
- [CVE-2026-117859](https://insights.sbomify.com/CVE-2026-117859/): Keycloak-services: keycloak-services: par single-use bypass via flow restart (medium 5.4)
- [CVE-2026-11785](https://insights.sbomify.com/CVE-2026-11785/): 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler (medium 4.3)
- [CVE-2026-11784](https://insights.sbomify.com/CVE-2026-11784/): Cross-site request forgery in Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization (medium 4.3)
- [CVE-2026-11783](https://insights.sbomify.com/CVE-2026-11783/): Cross-site scripting in Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy (medium 6.4)
- [CVE-2026-11782](https://insights.sbomify.com/CVE-2026-11782/): Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR (medium 5.9)
- [CVE-2026-11781](https://insights.sbomify.com/CVE-2026-11781/): Adminify < 4.2.10 - Contributor+ Sensitive Information Disclosure via Global Search AJAX (low 2.7)
- [CVE-2026-11780](https://insights.sbomify.com/CVE-2026-11780/): Cross-site scripting in Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker (medium 6.4)
- [CVE-2026-1178](https://insights.sbomify.com/CVE-2026-1178/): Yonyou KSOA HTTP GET Parameter select.jsp sql injection (medium 6.9)
- [CVE-2026-11779](https://insights.sbomify.com/CVE-2026-11779/): PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access (medium 5.3)
- [CVE-2026-11778](https://insights.sbomify.com/CVE-2026-11778/): CURCY <= 2.2.14 - Unauthenticated Arbitrary Shortcode Execution via 'exchange' Parameter (medium 5.4)
- [CVE-2026-11777](https://insights.sbomify.com/CVE-2026-11777/): Form Maker by 10Web <= 1.15.43 - Authenticated (Administrator+) SQL Injection via 'name' Parameter (medium 4.9)
- [CVE-2026-11776](https://insights.sbomify.com/CVE-2026-11776/): Form Maker by 10Web <= 1.15.43 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter (medium 4.9)
- [CVE-2026-11775](https://insights.sbomify.com/CVE-2026-11775/): User Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2026-11774](https://insights.sbomify.com/CVE-2026-11774/): 389-ds-base: 389-ds-base: integer overflow in sasl packet length bypasses size limit leading to heap buffer overflow (high 7.6)
- [CVE-2026-11773](https://insights.sbomify.com/CVE-2026-11773/): Masteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification (medium 4.3)
- [CVE-2026-11772](https://insights.sbomify.com/CVE-2026-11772/): Reflected XSS in DRIMO CMS (medium 5.1)
- [CVE-2026-11771](https://insights.sbomify.com/CVE-2026-11771/): Memory corruption in OpenVPN (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/895/