# Vulnerabilities published in 2026


- [CVE-2026-109896](https://insights.sbomify.com/CVE-2026-109896/): WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2026-109895](https://insights.sbomify.com/CVE-2026-109895/): WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-109894](https://insights.sbomify.com/CVE-2026-109894/): WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-109893](https://insights.sbomify.com/CVE-2026-109893/): WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-109892](https://insights.sbomify.com/CVE-2026-109892/): WordPress Frontend Admin by DynamiApps plugin <= 3.29.13 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-109891](https://insights.sbomify.com/CVE-2026-109891/): WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability (medium 6.4)
- [CVE-2026-109890](https://insights.sbomify.com/CVE-2026-109890/): WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-10989](https://insights.sbomify.com/CVE-2026-10989/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-10988](https://insights.sbomify.com/CVE-2026-10988/): Use after free in Chrome (high 8.8)
- [CVE-2026-10987](https://insights.sbomify.com/CVE-2026-10987/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-109869](https://insights.sbomify.com/CVE-2026-109869/): undici vulnerable to Denial of Service via unhandled error on excessive content-encodings (high 7.5)
- [CVE-2026-10986](https://insights.sbomify.com/CVE-2026-10986/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-109855](https://insights.sbomify.com/CVE-2026-109855/): undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake (high 7.5)
- [CVE-2026-109854](https://insights.sbomify.com/CVE-2026-109854/): M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding (low 2.5)
- [CVE-2026-10985](https://insights.sbomify.com/CVE-2026-10985/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-109848](https://insights.sbomify.com/CVE-2026-109848/): Missing authorization in GROWI (low 2.3)
- [CVE-2026-109844](https://insights.sbomify.com/CVE-2026-109844/): Gitea watched repositories API disclosure after access revocation (medium 4.3)
- [CVE-2026-109841](https://insights.sbomify.com/CVE-2026-109841/): undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens (medium 5.9)
- [CVE-2026-10984](https://insights.sbomify.com/CVE-2026-10984/): Other in Chrome (medium 5.4)
- [CVE-2026-109839](https://insights.sbomify.com/CVE-2026-109839/): IBM Db2 Genius Hub Missing Cryptographic Step (low 3.1)
- [CVE-2026-109838](https://insights.sbomify.com/CVE-2026-109838/): IBM Db2 Genius Hub Improper verification of cryptographic signature (medium 5.1)
- [CVE-2026-109833](https://insights.sbomify.com/CVE-2026-109833/): Memory corruption in Red Hat Enterprise Linux 10 (medium 5.9)
- [CVE-2026-109832](https://insights.sbomify.com/CVE-2026-109832/): Gnome-remote-desktop: busy-wait dos in vnc tls i/o handlers (gnutls_e_again / gnutls_e_interrupted) (high 7.5)
- [CVE-2026-109831](https://insights.sbomify.com/CVE-2026-109831/): Memory corruption in UnRTF (medium 5.1)
- [CVE-2026-10983](https://insights.sbomify.com/CVE-2026-10983/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-109829](https://insights.sbomify.com/CVE-2026-109829/): undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects (high 7.4)
- [CVE-2026-109828](https://insights.sbomify.com/CVE-2026-109828/): libsndfile WAV Parsing wavlike.c wavlike_subchunk_parse uninitialized variable (medium 5.3)
- [CVE-2026-109827](https://insights.sbomify.com/CVE-2026-109827/): GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write (medium 5.3)
- [CVE-2026-109823](https://insights.sbomify.com/CVE-2026-109823/): Host filesystem path disclosure via DNS rebinding (low 2.3)
- [CVE-2026-109822](https://insights.sbomify.com/CVE-2026-109822/): Information disclosure in NWR100 (high 7.1)
- [CVE-2026-10982](https://insights.sbomify.com/CVE-2026-10982/): Use after free in Chrome (high 8.8)
- [CVE-2026-109813](https://insights.sbomify.com/CVE-2026-109813/): Shared Hard-coded Root CA Private Key (high 8.6)
- [CVE-2026-109812](https://insights.sbomify.com/CVE-2026-109812/): Missing Authorization on Secret Endpoints (medium 6.9)
- [CVE-2026-10981](https://insights.sbomify.com/CVE-2026-10981/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-10980](https://insights.sbomify.com/CVE-2026-10980/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-1098](https://insights.sbomify.com/CVE-2026-1098/): CM CSS Columns <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute (medium 6.4)
- [CVE-2026-10979](https://insights.sbomify.com/CVE-2026-10979/): Memory corruption in Chrome (medium 6.5)
- [CVE-2026-109786](https://insights.sbomify.com/CVE-2026-109786/): Other in fail2ban (medium 5.3)
- [CVE-2026-109783](https://insights.sbomify.com/CVE-2026-109783/): Mitigation bypass in the File Handling component (high 8.3)
- [CVE-2026-109782](https://insights.sbomify.com/CVE-2026-109782/): Mitigation bypass in the File Handling component (high 8.3)
- [CVE-2026-109781](https://insights.sbomify.com/CVE-2026-109781/): Denial-of-service in the Printing: Output component (medium 6.5)
- [CVE-2026-109780](https://insights.sbomify.com/CVE-2026-109780/): Mitigation bypass in the DOM: Core & HTML component (critical 9.8)
- [CVE-2026-10978](https://insights.sbomify.com/CVE-2026-10978/): Use after free in Chrome (high 8.8)
- [CVE-2026-109779](https://insights.sbomify.com/CVE-2026-109779/): Race condition in the Networking: DNS component (medium 4.2)
- [CVE-2026-109778](https://insights.sbomify.com/CVE-2026-109778/): Privilege escalation in the WebExtensions component (high 8.8)
- [CVE-2026-109777](https://insights.sbomify.com/CVE-2026-109777/): Information disclosure in the Storage: IndexedDB component (medium 4.3)
- [CVE-2026-109776](https://insights.sbomify.com/CVE-2026-109776/): Race condition in the XPCOM component (medium 4.2)
- [CVE-2026-109775](https://insights.sbomify.com/CVE-2026-109775/): Denial-of-service in the WebRTC component (medium 6.5)
- [CVE-2026-109774](https://insights.sbomify.com/CVE-2026-109774/): Invalid pointer, undefined behavior in the DOM: Notifications component (critical 9.8)
- [CVE-2026-109773](https://insights.sbomify.com/CVE-2026-109773/): Denial-of-service in the Sync component (medium 6.5)
- [CVE-2026-109772](https://insights.sbomify.com/CVE-2026-109772/): Same-origin policy bypass in the DevTools component (critical 9.1)
- [CVE-2026-109771](https://insights.sbomify.com/CVE-2026-109771/): Information disclosure in the WebRTC: Networking component (medium 4.3)
- [CVE-2026-109770](https://insights.sbomify.com/CVE-2026-109770/): Spoofing issue in the DOM: Web Serial component (medium 6.1)
- [CVE-2026-10977](https://insights.sbomify.com/CVE-2026-10977/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-109769](https://insights.sbomify.com/CVE-2026-109769/): Information disclosure in the Networking: Cache component (medium 4.3)
- [CVE-2026-109768](https://insights.sbomify.com/CVE-2026-109768/): Denial-of-service in the Site Reports component (medium 6.5)
- [CVE-2026-109767](https://insights.sbomify.com/CVE-2026-109767/): Information disclosure in the Networking component (medium 4.3)
- [CVE-2026-109766](https://insights.sbomify.com/CVE-2026-109766/): Mitigation bypass in the Enterprise Policies component (high 8.1)
- [CVE-2026-109765](https://insights.sbomify.com/CVE-2026-109765/): Race condition, use-after-free in the Graphics: Text component (medium 4.2)
- [CVE-2026-109764](https://insights.sbomify.com/CVE-2026-109764/): Mitigation bypass in the Enterprise Policies component (medium 5.4)
- [CVE-2026-109763](https://insights.sbomify.com/CVE-2026-109763/): Mitigation bypass in the File Handling component (not scored)
- [CVE-2026-109762](https://insights.sbomify.com/CVE-2026-109762/): Incorrect boundary conditions in the SVG component (high 8.8)
- [CVE-2026-109761](https://insights.sbomify.com/CVE-2026-109761/): Use-after-free in the JavaScript: WebAssembly component (medium 5.4)
- [CVE-2026-109760](https://insights.sbomify.com/CVE-2026-109760/): Mitigation bypass in the Networking: HTTP component (high 8.1)
- [CVE-2026-10976](https://insights.sbomify.com/CVE-2026-10976/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-109759](https://insights.sbomify.com/CVE-2026-109759/): Site isolation issue in the Networking component (high 8.1)
- [CVE-2026-109758](https://insights.sbomify.com/CVE-2026-109758/): Hardcoded credentials in Helix Authentication Service (critical 9.3)
- [CVE-2026-109757](https://insights.sbomify.com/CVE-2026-109757/): Sandbox escape due to race condition in the Networking component (high 8.3)
- [CVE-2026-109756](https://insights.sbomify.com/CVE-2026-109756/): Privilege escalation in the DOM: Navigation component (high 8.8)
- [CVE-2026-109755](https://insights.sbomify.com/CVE-2026-109755/): Sandbox escape in the DOM: Content Processes component (critical 9.6)
- [CVE-2026-109754](https://insights.sbomify.com/CVE-2026-109754/): Incorrect boundary conditions in the DOM: Editor component (high 8.1)
- [CVE-2026-109753](https://insights.sbomify.com/CVE-2026-109753/): Incorrect boundary conditions in the Layout component (high 8.1)
- [CVE-2026-109752](https://insights.sbomify.com/CVE-2026-109752/): Use-after-free in the DOM: Workers component (medium 5.4)
- [CVE-2026-109751](https://insights.sbomify.com/CVE-2026-109751/): Information disclosure in the Networking component (medium 4.3)
- [CVE-2026-109750](https://insights.sbomify.com/CVE-2026-109750/): Site isolation issue in the DOM: Web Authentication component (critical 9.6)
- [CVE-2026-10975](https://insights.sbomify.com/CVE-2026-10975/): Use after free in Chrome (high 8.8)
- [CVE-2026-109749](https://insights.sbomify.com/CVE-2026-109749/): Use-after-free in the JavaScript: WebAssembly component (medium 5.4)
- [CVE-2026-109748](https://insights.sbomify.com/CVE-2026-109748/): Use-after-free in the JavaScript: WebAssembly component (medium 5.4)
- [CVE-2026-109747](https://insights.sbomify.com/CVE-2026-109747/): Other issue in the Address Bar component (high 7.3)
- [CVE-2026-109746](https://insights.sbomify.com/CVE-2026-109746/): Mitigation bypass in the DOM: Security component (high 7.3)
- [CVE-2026-109745](https://insights.sbomify.com/CVE-2026-109745/): Sandbox escape due to uninitialized memory in the DOM: Web Serial component (critical 9.6)
- [CVE-2026-109744](https://insights.sbomify.com/CVE-2026-109744/): Other issue in the DOM: File component (high 8.1)
- [CVE-2026-109743](https://insights.sbomify.com/CVE-2026-109743/): Privilege escalation in the Panning and Zooming component (high 8.8)
- [CVE-2026-109742](https://insights.sbomify.com/CVE-2026-109742/): Information disclosure in the PDF Viewer component (medium 4.3)
- [CVE-2026-109741](https://insights.sbomify.com/CVE-2026-109741/): Use-after-free in the Storage: Bucket File System component (medium 5.4)
- [CVE-2026-109740](https://insights.sbomify.com/CVE-2026-109740/): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (critical 9.6)
- [CVE-2026-10974](https://insights.sbomify.com/CVE-2026-10974/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-109739](https://insights.sbomify.com/CVE-2026-109739/): Privilege escalation in the WebExtensions component (high 8.8)
- [CVE-2026-109738](https://insights.sbomify.com/CVE-2026-109738/): Use-after-free in the Audio/Video: Playback component (medium 5.4)
- [CVE-2026-109737](https://insights.sbomify.com/CVE-2026-109737/): Mitigation bypass in the Enterprise Policies component (high 8.1)
- [CVE-2026-109736](https://insights.sbomify.com/CVE-2026-109736/): Frame poisoning in the Layout component (high 8.1)
- [CVE-2026-109735](https://insights.sbomify.com/CVE-2026-109735/): Use-after-free in the DOM: Animation component (medium 5.4)
- [CVE-2026-109734](https://insights.sbomify.com/CVE-2026-109734/): Mitigation bypass in the DOM: Security component (high 8.1)
- [CVE-2026-109733](https://insights.sbomify.com/CVE-2026-109733/): JIT miscompilation in the JavaScript Engine: JIT component (high 8.1)
- [CVE-2026-109732](https://insights.sbomify.com/CVE-2026-109732/): Use-after-free in the DOM: Streams component (medium 5.4)
- [CVE-2026-109731](https://insights.sbomify.com/CVE-2026-109731/): Incorrect boundary conditions in the Graphics: Canvas2D component (medium 5.4)
- [CVE-2026-109730](https://insights.sbomify.com/CVE-2026-109730/): Integer overflow in the Graphics component (high 8.8)
- [CVE-2026-10973](https://insights.sbomify.com/CVE-2026-10973/): Information disclosure in Chrome (high 7.4)
- [CVE-2026-109729](https://insights.sbomify.com/CVE-2026-109729/): Use-after-free in the JavaScript Engine: JIT component (medium 5.4)
- [CVE-2026-109728](https://insights.sbomify.com/CVE-2026-109728/): Use-after-free in the DOM: Animation component (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/940/