# Vulnerabilities published in 2026


- [CVE-2026-109635](https://insights.sbomify.com/CVE-2026-109635/): Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints (medium 5.3)
- [CVE-2026-109634](https://insights.sbomify.com/CVE-2026-109634/): Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoints (medium 6.9)
- [CVE-2026-109633](https://insights.sbomify.com/CVE-2026-109633/): Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page (high 8.6)
- [CVE-2026-109632](https://insights.sbomify.com/CVE-2026-109632/): Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints (high 7.1)
- [CVE-2026-109631](https://insights.sbomify.com/CVE-2026-109631/): Frappe ERPNext before 15.119.1 SQL Injection via Missing Validation (high 7.1)
- [CVE-2026-109630](https://insights.sbomify.com/CVE-2026-109630/): Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints (medium 5.3)
- [CVE-2026-10963](https://insights.sbomify.com/CVE-2026-10963/): Integer overflow in Chrome (high 8.8)
- [CVE-2026-109629](https://insights.sbomify.com/CVE-2026-109629/): Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint (medium 5.3)
- [CVE-2026-109628](https://insights.sbomify.com/CVE-2026-109628/): Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization (high 7.1)
- [CVE-2026-109627](https://insights.sbomify.com/CVE-2026-109627/): Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data (high 7.1)
- [CVE-2026-109626](https://insights.sbomify.com/CVE-2026-109626/): Frappe ERPNext before 16.34.2 SQL Injection via Multiple Endpoints (high 7.1)
- [CVE-2026-109625](https://insights.sbomify.com/CVE-2026-109625/): Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data (high 7.1)
- [CVE-2026-109624](https://insights.sbomify.com/CVE-2026-109624/): Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data (high 7.1)
- [CVE-2026-109623](https://insights.sbomify.com/CVE-2026-109623/): Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization (medium 5.3)
- [CVE-2026-109622](https://insights.sbomify.com/CVE-2026-109622/): Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization (medium 5.3)
- [CVE-2026-109621](https://insights.sbomify.com/CVE-2026-109621/): Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass (high 7.1)
- [CVE-2026-109620](https://insights.sbomify.com/CVE-2026-109620/): SourceCodester Online Reviewer System index.php prepare sql injection (medium 6.9)
- [CVE-2026-10962](https://insights.sbomify.com/CVE-2026-10962/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-109619](https://insights.sbomify.com/CVE-2026-109619/): PHP Stale Internal Request-State (critical 9.2, exploited in the wild)
- [CVE-2026-109618](https://insights.sbomify.com/CVE-2026-109618/): PHP Memory Corruption (critical 9.2, exploited in the wild)
- [CVE-2026-109617](https://insights.sbomify.com/CVE-2026-109617/): Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints (high 7.1)
- [CVE-2026-109616](https://insights.sbomify.com/CVE-2026-109616/): Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification (high 7.1)
- [CVE-2026-109615](https://insights.sbomify.com/CVE-2026-109615/): Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints (high 7.1)
- [CVE-2026-109614](https://insights.sbomify.com/CVE-2026-109614/): Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data (high 7.1)
- [CVE-2026-109613](https://insights.sbomify.com/CVE-2026-109613/): Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification (high 7.1)
- [CVE-2026-109612](https://insights.sbomify.com/CVE-2026-109612/): Frappe ERPNext before 15.120.0 Stored XSS via Report View (high 8.5)
- [CVE-2026-109611](https://insights.sbomify.com/CVE-2026-109611/): Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints (medium 5.3)
- [CVE-2026-109610](https://insights.sbomify.com/CVE-2026-109610/): Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification (high 7.1)
- [CVE-2026-10961](https://insights.sbomify.com/CVE-2026-10961/): Use after free in Chrome (high 8.3)
- [CVE-2026-109609](https://insights.sbomify.com/CVE-2026-109609/): Frappe ERPNext before 15.119.1 SQL Injection via Missing Input Validation (high 7.1)
- [CVE-2026-109608](https://insights.sbomify.com/CVE-2026-109608/): Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input (high 8.7)
- [CVE-2026-109607](https://insights.sbomify.com/CVE-2026-109607/): SourceCodester Online Exam System Login Endpoint loginExe.php sql injection (medium 6.9)
- [CVE-2026-109606](https://insights.sbomify.com/CVE-2026-109606/): SourceCodester Art Gallery Management System Account Creation admin_class.php save_user sql injection (medium 6.9)
- [CVE-2026-109605](https://insights.sbomify.com/CVE-2026-109605/): SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization (medium 6.9)
- [CVE-2026-109604](https://insights.sbomify.com/CVE-2026-109604/): ERPNext before 15.112.0 Stored XSS via Tool View Record Names (high 8.5)
- [CVE-2026-109603](https://insights.sbomify.com/CVE-2026-109603/): Frappe Framework before 16.17.0 Authenticated SSRF and LFI via pdfkit (medium 4.8)
- [CVE-2026-109602](https://insights.sbomify.com/CVE-2026-109602/): Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters (medium 5.1)
- [CVE-2026-109601](https://insights.sbomify.com/CVE-2026-109601/): Frappe Framework before v16.30.0 Arbitrary File Read via Outgoing Email HTML (high 7.1)
- [CVE-2026-109600](https://insights.sbomify.com/CVE-2026-109600/): Frappe before 16.31.0 Improper Access Control in Document Follow Notifications (medium 6.9)
- [CVE-2026-10960](https://insights.sbomify.com/CVE-2026-10960/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-1096](https://insights.sbomify.com/CVE-2026-1096/): Best-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute (medium 6.4)
- [CVE-2026-109599](https://insights.sbomify.com/CVE-2026-109599/): Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification (medium 5.3)
- [CVE-2026-109598](https://insights.sbomify.com/CVE-2026-109598/): Frappe before 16.33.0 Broken Authorization via send_sms Endpoint (medium 5.3)
- [CVE-2026-109597](https://insights.sbomify.com/CVE-2026-109597/): Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs (medium 5.1)
- [CVE-2026-109596](https://insights.sbomify.com/CVE-2026-109596/): Hugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor (medium 6.7)
- [CVE-2026-109595](https://insights.sbomify.com/CVE-2026-109595/): Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver (medium 6.7)
- [CVE-2026-109590](https://insights.sbomify.com/CVE-2026-109590/): Cross-site scripting in Travelly – Tour & Travel Booking Manager for WooCommerce (medium 6.4)
- [CVE-2026-10959](https://insights.sbomify.com/CVE-2026-10959/): Use after free in Chrome (high 8.8)
- [CVE-2026-109588](https://insights.sbomify.com/CVE-2026-109588/): Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel (critical 9.3)
- [CVE-2026-109587](https://insights.sbomify.com/CVE-2026-109587/): Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel (critical 9.3)
- [CVE-2026-109584](https://insights.sbomify.com/CVE-2026-109584/): HTTP/2 cookie crumb join expands a small HPACK header block into an unbounded allocation in Bandit (high 8.7)
- [CVE-2026-10958](https://insights.sbomify.com/CVE-2026-10958/): Use after free in Chrome (high 8.8)
- [CVE-2026-109576](https://insights.sbomify.com/CVE-2026-109576/): HMS Networks PEAK-System PCAN Windows drivers Out-of-bounds Write (medium 6.8)
- [CVE-2026-109575](https://insights.sbomify.com/CVE-2026-109575/): Auth bypass in Data Plane API CE (critical 9.8)
- [CVE-2026-109574](https://insights.sbomify.com/CVE-2026-109574/): Hugo before v0.167.0 Path Traversal via css.Sass Import Fallback (medium 6.7)
- [CVE-2026-109573](https://insights.sbomify.com/CVE-2026-109573/): phpMyFAQ before 4.1.9 SQL Injection via api/autocomplete Search Endpoint (critical 9.2)
- [CVE-2026-109572](https://insights.sbomify.com/CVE-2026-109572/): Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy (high 7.2)
- [CVE-2026-109571](https://insights.sbomify.com/CVE-2026-109571/): Fire-Boltt BSW013 firmware through V0.0.8 Unauthenticated Heart Rate Disclosure via BLE (low 2.3)
- [CVE-2026-109570](https://insights.sbomify.com/CVE-2026-109570/): Fire-Boltt BSW013 through V0.0.8 Unauthenticated BLE Notification Injection (medium 5.3)
- [CVE-2026-10957](https://insights.sbomify.com/CVE-2026-10957/): Use after free in Chrome (high 8.8)
- [CVE-2026-109569](https://insights.sbomify.com/CVE-2026-109569/): sandboxed.sh through 1.3.0 Container Escape via nsenter Missing Root Namespace (critical 9.3)
- [CVE-2026-109568](https://insights.sbomify.com/CVE-2026-109568/): Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes (high 7.1)
- [CVE-2026-109567](https://insights.sbomify.com/CVE-2026-109567/): Rapyd Admin from 9.0.0 before 9.20.0 Privilege Escalation via UsersEdit Component (high 8.6)
- [CVE-2026-109566](https://insights.sbomify.com/CVE-2026-109566/): Rapyd Admin 9.0.0 before 9.20.0 Hard-Coded Super-Admin Credentials via AuthSeeder (critical 9.3)
- [CVE-2026-109565](https://insights.sbomify.com/CVE-2026-109565/): Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component (medium 5.3)
- [CVE-2026-109564](https://insights.sbomify.com/CVE-2026-109564/): LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint (low 2.3)
- [CVE-2026-109563](https://insights.sbomify.com/CVE-2026-109563/): N3.js before 2.11.1 ReDoS via N3Lexer Numeric-Literal Regex (high 8.7)
- [CVE-2026-109562](https://insights.sbomify.com/CVE-2026-109562/): SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API (medium 5.3)
- [CVE-2026-109561](https://insights.sbomify.com/CVE-2026-109561/): goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations (low 2.3)
- [CVE-2026-109560](https://insights.sbomify.com/CVE-2026-109560/): Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining (high 7.7)
- [CVE-2026-10956](https://insights.sbomify.com/CVE-2026-10956/): Use after free in Chrome (high 8.8)
- [CVE-2026-109559](https://insights.sbomify.com/CVE-2026-109559/): EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate (high 8.4)
- [CVE-2026-109558](https://insights.sbomify.com/CVE-2026-109558/): EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview (high 8.5)
- [CVE-2026-109557](https://insights.sbomify.com/CVE-2026-109557/): EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview (high 8.4)
- [CVE-2026-109556](https://insights.sbomify.com/CVE-2026-109556/): EdgeEver Desktop 1.92.0 through 1.112.0 Local Program Execution via ACP IPC (high 7.3)
- [CVE-2026-109553](https://insights.sbomify.com/CVE-2026-109553/): Gitea SSH certificate principal impersonation of other users (high 7.5)
- [CVE-2026-10955](https://insights.sbomify.com/CVE-2026-10955/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-10954](https://insights.sbomify.com/CVE-2026-10954/): Use after free in Chrome (high 8.8)
- [CVE-2026-10953](https://insights.sbomify.com/CVE-2026-10953/): Use after free in Chrome (high 8.3)
- [CVE-2026-109527](https://insights.sbomify.com/CVE-2026-109527/): Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies (high 7.5)
- [CVE-2026-109526](https://insights.sbomify.com/CVE-2026-109526/): HBAI-Ltd Toonflow-app exportData Endpoint information disclosure (medium 4.8)
- [CVE-2026-109525](https://insights.sbomify.com/CVE-2026-109525/): girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization (medium 6.9)
- [CVE-2026-109524](https://insights.sbomify.com/CVE-2026-109524/): girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization (medium 6.9)
- [CVE-2026-109523](https://insights.sbomify.com/CVE-2026-109523/): girishsaraf Online-Appointment-Booking-System AJAX Endpoint getclinic.php sql injection (medium 6.9)
- [CVE-2026-109522](https://insights.sbomify.com/CVE-2026-109522/): girishsaraf Online-Appointment-Booking-System Admin CRUD Endpoint deleteclinic.php sql injection (medium 6.9)
- [CVE-2026-109521](https://insights.sbomify.com/CVE-2026-109521/): girishsaraf Online-Appointment-Booking-System changebookingstatus.php sql injection (medium 6.9)
- [CVE-2026-109520](https://insights.sbomify.com/CVE-2026-109520/): Colorful iGameCenter Dispatch AMDRyzenMasterDriver.sys MmMapIoSpace privilege defined with unsafe actions (critical 9.3)
- [CVE-2026-10952](https://insights.sbomify.com/CVE-2026-10952/): Use after free in Chrome (high 8.8)
- [CVE-2026-109519](https://insights.sbomify.com/CVE-2026-109519/): YouTransfer Template Rendering template path traversal (medium 6.9)
- [CVE-2026-109516](https://insights.sbomify.com/CVE-2026-109516/): Auth bypass in Bot for Telegram on WooCommerce (critical 9.8)
- [CVE-2026-109515](https://insights.sbomify.com/CVE-2026-109515/): MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter (critical 9.8)
- [CVE-2026-109513](https://insights.sbomify.com/CVE-2026-109513/): NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route (high 7.2)
- [CVE-2026-109512](https://insights.sbomify.com/CVE-2026-109512/): Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter (medium 6.4)
- [CVE-2026-10951](https://insights.sbomify.com/CVE-2026-10951/): Use after free in Chrome (high 8.8)
- [CVE-2026-109506](https://insights.sbomify.com/CVE-2026-109506/): Improper Authentication in Multiple TP-Link WiFi Repeaters (medium 5.9)
- [CVE-2026-10950](https://insights.sbomify.com/CVE-2026-10950/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-1095](https://insights.sbomify.com/CVE-2026-1095/): Canto Testimonials <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fx' Shortcode Attribute (medium 6.4)
- [CVE-2026-10949](https://insights.sbomify.com/CVE-2026-10949/): Memory corruption in Chrome (high 8.3)
- [CVE-2026-10948](https://insights.sbomify.com/CVE-2026-10948/): Use after free in Chrome (high 8.8)
- [CVE-2026-10947](https://insights.sbomify.com/CVE-2026-10947/): Use after free in Chrome (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/942/