# Vulnerabilities published in 2026


- [CVE-2026-109727](https://insights.sbomify.com/CVE-2026-109727/): Use-after-free in the Audio/Video component (medium 5.4)
- [CVE-2026-109726](https://insights.sbomify.com/CVE-2026-109726/): Use-after-free in the SVG component (medium 5.4)
- [CVE-2026-109725](https://insights.sbomify.com/CVE-2026-109725/): Use-after-free in the DOM: Core & HTML component (medium 5.4)
- [CVE-2026-109724](https://insights.sbomify.com/CVE-2026-109724/): Use-after-free in the DOM: Core & HTML component (medium 5.4)
- [CVE-2026-109723](https://insights.sbomify.com/CVE-2026-109723/): Integer overflow in the Layout: Text and Fonts component (medium 5.4)
- [CVE-2026-109722](https://insights.sbomify.com/CVE-2026-109722/): JIT miscompilation in the JavaScript Engine: JIT component (high 8.1)
- [CVE-2026-109721](https://insights.sbomify.com/CVE-2026-109721/): Incorrect boundary conditions in the JavaScript Engine: JIT component (medium 5.4)
- [CVE-2026-109720](https://insights.sbomify.com/CVE-2026-109720/): JIT miscompilation in the JavaScript: WebAssembly component (high 7.1)
- [CVE-2026-10972](https://insights.sbomify.com/CVE-2026-10972/): Use after free in Chrome (critical 9.6)
- [CVE-2026-109719](https://insights.sbomify.com/CVE-2026-109719/): Race condition, use-after-free in the Graphics: CanvasWebGL component (medium 4.2)
- [CVE-2026-109718](https://insights.sbomify.com/CVE-2026-109718/): Use-after-free in the XML component (medium 5.4)
- [CVE-2026-109717](https://insights.sbomify.com/CVE-2026-109717/): Use-after-free in the DOM: Bindings (WebIDL) component (medium 5.4)
- [CVE-2026-109716](https://insights.sbomify.com/CVE-2026-109716/): Incorrect boundary conditions in the JavaScript Engine component (high 8.1)
- [CVE-2026-109715](https://insights.sbomify.com/CVE-2026-109715/): Incorrect boundary conditions in the JavaScript Engine component (high 8.1)
- [CVE-2026-109714](https://insights.sbomify.com/CVE-2026-109714/): Incorrect boundary conditions in the Layout component (medium 5.4)
- [CVE-2026-109713](https://insights.sbomify.com/CVE-2026-109713/): Use-after-free in the Crash Reporting component (medium 5.4)
- [CVE-2026-109712](https://insights.sbomify.com/CVE-2026-109712/): Sandbox escape due to uninitialized memory in the Graphics component (high 7.1)
- [CVE-2026-109711](https://insights.sbomify.com/CVE-2026-109711/): Use-after-free in the Graphics: Canvas2D component (medium 5.4)
- [CVE-2026-109710](https://insights.sbomify.com/CVE-2026-109710/): Use-after-free in the Graphics: Text component (medium 5.4)
- [CVE-2026-10971](https://insights.sbomify.com/CVE-2026-10971/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-109709](https://insights.sbomify.com/CVE-2026-109709/): Information disclosure, privilege escalation in the Security: Process Sandboxing component (high 8.8)
- [CVE-2026-109708](https://insights.sbomify.com/CVE-2026-109708/): Sandbox escape due to incorrect boundary conditions in the Networking component (critical 9.6)
- [CVE-2026-109707](https://insights.sbomify.com/CVE-2026-109707/): Sandbox escape due to use-after-free in the Networking component (critical 9.6)
- [CVE-2026-109706](https://insights.sbomify.com/CVE-2026-109706/): Use-after-free in the Storage: IndexedDB component (medium 5.4)
- [CVE-2026-109705](https://insights.sbomify.com/CVE-2026-109705/): Sandbox escape, site isolation issue due to incorrect boundary conditions, use-after-free in the Networking component (critical 9.6)
- [CVE-2026-109704](https://insights.sbomify.com/CVE-2026-109704/): Privilege escalation in the Application Update component (high 8.8)
- [CVE-2026-109703](https://insights.sbomify.com/CVE-2026-109703/): WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2026-109702](https://insights.sbomify.com/CVE-2026-109702/): WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-109701](https://insights.sbomify.com/CVE-2026-109701/): WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-109700](https://insights.sbomify.com/CVE-2026-109700/): WordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2026-10970](https://insights.sbomify.com/CVE-2026-10970/): Security feature bypass in Chrome (high 8.3)
- [CVE-2026-1097](https://insights.sbomify.com/CVE-2026-1097/): Cross-site scripting in ThemeRuby Multi Authors – Assign Multiple Writers to Posts (medium 6.4)
- [CVE-2026-109699](https://insights.sbomify.com/CVE-2026-109699/): WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-109698](https://insights.sbomify.com/CVE-2026-109698/): WordPress Mang Board WP plugin <= 2.4.4 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-109697](https://insights.sbomify.com/CVE-2026-109697/): WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-109696](https://insights.sbomify.com/CVE-2026-109696/): WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2026-109695](https://insights.sbomify.com/CVE-2026-109695/): WordPress FluentCart plugin <= 1.7.1 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2026-109694](https://insights.sbomify.com/CVE-2026-109694/): WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2026-109693](https://insights.sbomify.com/CVE-2026-109693/): WordPress Fluent CRM plugin <= 3.2.5 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2026-109692](https://insights.sbomify.com/CVE-2026-109692/): WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability (high 7.1)
- [CVE-2026-109691](https://insights.sbomify.com/CVE-2026-109691/): WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-10969](https://insights.sbomify.com/CVE-2026-10969/): Privilege escalation in Chrome (high 7.5)
- [CVE-2026-109689](https://insights.sbomify.com/CVE-2026-109689/): WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-109688](https://insights.sbomify.com/CVE-2026-109688/): WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability (critical 9.3)
- [CVE-2026-109687](https://insights.sbomify.com/CVE-2026-109687/): WordPress Link Whisper Free plugin <= 0.9.7 - SQL Injection vulnerability (high 7.6)
- [CVE-2026-109686](https://insights.sbomify.com/CVE-2026-109686/): WordPress Link Whisper Free plugin <= 0.9.7 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2026-109685](https://insights.sbomify.com/CVE-2026-109685/): WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2026-109684](https://insights.sbomify.com/CVE-2026-109684/): WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2026-109682](https://insights.sbomify.com/CVE-2026-109682/): Metasploit Framework HTTP Redirect Server-Side Request Forgery (medium 4.7)
- [CVE-2026-109681](https://insights.sbomify.com/CVE-2026-109681/): Metasploit Framework FTP PASV Response SSRF (medium 4.7)
- [CVE-2026-109680](https://insights.sbomify.com/CVE-2026-109680/): FreeRDP 3.18.0 before 3.32.0 Heap Out-of-Bounds Write via ARM Redirected Username (medium 6.0)
- [CVE-2026-10968](https://insights.sbomify.com/CVE-2026-10968/): Information disclosure in Chrome (high 7.4)
- [CVE-2026-109679](https://insights.sbomify.com/CVE-2026-109679/): FreeRDP 3.0.0-beta4 before 3.32.0 NULL Pointer Crash via ARM Response (medium 6.0)
- [CVE-2026-109678](https://insights.sbomify.com/CVE-2026-109678/): FreeRDP 3.0.0-beta1 before 3.32.0 Reachable Assertion via Emulated SCardStatusA (high 7.1)
- [CVE-2026-109677](https://insights.sbomify.com/CVE-2026-109677/): FreeRDP 2.0.0-beta1 before 3.28.0 Out-of-Bounds Read via LocateCardsByATRA Handler (high 7.1)
- [CVE-2026-109676](https://insights.sbomify.com/CVE-2026-109676/): FreeRDP 3.0.0-beta1 before 3.32.0 Use-After-Free via Smartcard Connect (high 8.7)
- [CVE-2026-109675](https://insights.sbomify.com/CVE-2026-109675/): Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs (medium 5.3)
- [CVE-2026-109674](https://insights.sbomify.com/CVE-2026-109674/): Frappe ERPNext before 16.6.0 SQL Injection via Missing Input Validation (high 7.1)
- [CVE-2026-109673](https://insights.sbomify.com/CVE-2026-109673/): Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names (high 8.5)
- [CVE-2026-109672](https://insights.sbomify.com/CVE-2026-109672/): Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data (high 7.1)
- [CVE-2026-109671](https://insights.sbomify.com/CVE-2026-109671/): Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages (high 8.5)
- [CVE-2026-109670](https://insights.sbomify.com/CVE-2026-109670/): Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name (medium 5.1)
- [CVE-2026-10967](https://insights.sbomify.com/CVE-2026-10967/): Use after free in Chrome (high 8.3)
- [CVE-2026-109669](https://insights.sbomify.com/CVE-2026-109669/): Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification (medium 5.3)
- [CVE-2026-109668](https://insights.sbomify.com/CVE-2026-109668/): Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints (medium 5.3)
- [CVE-2026-109667](https://insights.sbomify.com/CVE-2026-109667/): Frappe ERPNext before 15.111.0 Privilege Escalation via Unauthorized Record Creation (high 8.7)
- [CVE-2026-109666](https://insights.sbomify.com/CVE-2026-109666/): Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints (high 7.1)
- [CVE-2026-109665](https://insights.sbomify.com/CVE-2026-109665/): Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation (medium 5.3)
- [CVE-2026-109664](https://insights.sbomify.com/CVE-2026-109664/): Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification (medium 5.3)
- [CVE-2026-109663](https://insights.sbomify.com/CVE-2026-109663/): Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters (high 7.1)
- [CVE-2026-109662](https://insights.sbomify.com/CVE-2026-109662/): Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form (medium 5.3)
- [CVE-2026-109661](https://insights.sbomify.com/CVE-2026-109661/): Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data (high 7.1)
- [CVE-2026-109660](https://insights.sbomify.com/CVE-2026-109660/): Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints (high 7.1)
- [CVE-2026-10966](https://insights.sbomify.com/CVE-2026-10966/): Security feature bypass in Chrome (critical 9.6)
- [CVE-2026-109659](https://insights.sbomify.com/CVE-2026-109659/): Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data (high 7.1)
- [CVE-2026-109658](https://insights.sbomify.com/CVE-2026-109658/): Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints (high 7.1)
- [CVE-2026-109657](https://insights.sbomify.com/CVE-2026-109657/): Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name (medium 5.1)
- [CVE-2026-109656](https://insights.sbomify.com/CVE-2026-109656/): Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access (high 7.1)
- [CVE-2026-109655](https://insights.sbomify.com/CVE-2026-109655/): Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints (high 7.1)
- [CVE-2026-109654](https://insights.sbomify.com/CVE-2026-109654/): Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints (medium 5.3)
- [CVE-2026-109653](https://insights.sbomify.com/CVE-2026-109653/): Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover (high 8.5)
- [CVE-2026-109652](https://insights.sbomify.com/CVE-2026-109652/): Frappe ERPNext before 15.119.1 Server-Side Template Injection via Message Fields (high 8.7)
- [CVE-2026-109651](https://insights.sbomify.com/CVE-2026-109651/): Frappe ERPNext before 15.112.0 Server-Side Request Forgery via Configuration Field (medium 5.3)
- [CVE-2026-109650](https://insights.sbomify.com/CVE-2026-109650/): Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data (high 7.1)
- [CVE-2026-10965](https://insights.sbomify.com/CVE-2026-10965/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-109649](https://insights.sbomify.com/CVE-2026-109649/): Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests (high 7.1)
- [CVE-2026-109648](https://insights.sbomify.com/CVE-2026-109648/): Frappe ERPNext before 15.106.0 SQL Injection via Missing Input Validation (high 7.1)
- [CVE-2026-109647](https://insights.sbomify.com/CVE-2026-109647/): Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation (high 7.1)
- [CVE-2026-109646](https://insights.sbomify.com/CVE-2026-109646/): Frappe ERPNext before 15.106.0 SQL Injection via Missing Validation (high 7.1)
- [CVE-2026-109645](https://insights.sbomify.com/CVE-2026-109645/): Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization (high 7.1)
- [CVE-2026-109644](https://insights.sbomify.com/CVE-2026-109644/): Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data (high 7.1)
- [CVE-2026-109643](https://insights.sbomify.com/CVE-2026-109643/): Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data (high 7.1)
- [CVE-2026-109642](https://insights.sbomify.com/CVE-2026-109642/): Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints (medium 5.3)
- [CVE-2026-109641](https://insights.sbomify.com/CVE-2026-109641/): Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints (medium 6.9)
- [CVE-2026-109640](https://insights.sbomify.com/CVE-2026-109640/): Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification (high 7.2)
- [CVE-2026-10964](https://insights.sbomify.com/CVE-2026-10964/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-109639](https://insights.sbomify.com/CVE-2026-109639/): Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests (high 7.1)
- [CVE-2026-109638](https://insights.sbomify.com/CVE-2026-109638/): Frappe ERPNext before 15.110.0 SQL Injection via Missing Input Validation (high 7.1)
- [CVE-2026-109637](https://insights.sbomify.com/CVE-2026-109637/): Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification (high 7.1)
- [CVE-2026-109636](https://insights.sbomify.com/CVE-2026-109636/): Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/941/