# Vulnerabilities published in 2026


- [CVE-2026-106419](https://insights.sbomify.com/CVE-2026-106419/): Use after free in Chrome (critical 9.6)
- [CVE-2026-106418](https://insights.sbomify.com/CVE-2026-106418/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-106417](https://insights.sbomify.com/CVE-2026-106417/): Integer overflow in Chrome (critical 9.6)
- [CVE-2026-106416](https://insights.sbomify.com/CVE-2026-106416/): Code injection in Chrome (medium 5.4)
- [CVE-2026-106415](https://insights.sbomify.com/CVE-2026-106415/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-106414](https://insights.sbomify.com/CVE-2026-106414/): Other in Chrome (critical 9.6)
- [CVE-2026-106413](https://insights.sbomify.com/CVE-2026-106413/): Race condition in Chrome (medium 4.2)
- [CVE-2026-106412](https://insights.sbomify.com/CVE-2026-106412/): Race condition in Chrome (high 8.3)
- [CVE-2026-106411](https://insights.sbomify.com/CVE-2026-106411/): Use after free in Chrome (high 8.8)
- [CVE-2026-106410](https://insights.sbomify.com/CVE-2026-106410/): Missing authorization in Chrome (medium 4.2)
- [CVE-2026-10641](https://insights.sbomify.com/CVE-2026-10641/): Out-of-bounds write in Bluetooth HFP Hands-Free CIND indicator parsing (cind_handle_values) (high 7.1)
- [CVE-2026-106409](https://insights.sbomify.com/CVE-2026-106409/): Other in Chrome (high 8.3)
- [CVE-2026-106408](https://insights.sbomify.com/CVE-2026-106408/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-106407](https://insights.sbomify.com/CVE-2026-106407/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-106406](https://insights.sbomify.com/CVE-2026-106406/): Missing authorization in Chrome (medium 5.4)
- [CVE-2026-106405](https://insights.sbomify.com/CVE-2026-106405/): Race condition in Chrome (medium 6.0)
- [CVE-2026-106404](https://insights.sbomify.com/CVE-2026-106404/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-106403](https://insights.sbomify.com/CVE-2026-106403/): Security feature bypass in Chrome (high 8.1)
- [CVE-2026-106402](https://insights.sbomify.com/CVE-2026-106402/): Security feature bypass in Chrome (medium 4.8)
- [CVE-2026-106401](https://insights.sbomify.com/CVE-2026-106401/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-106400](https://insights.sbomify.com/CVE-2026-106400/): Other in Chrome (medium 5.4)
- [CVE-2026-10640](https://insights.sbomify.com/CVE-2026-10640/): Use-after-free reading `net_pkt` `iface` after send in IPv6 Neighbor Discovery (`ipv6_nbr.c`) (medium 4.2)
- [CVE-2026-1064](https://insights.sbomify.com/CVE-2026-1064/): bastillion-io Bastillion System Management SystemKtrl.java command injection (medium 5.1)
- [CVE-2026-106399](https://insights.sbomify.com/CVE-2026-106399/): Memory corruption in Chrome (low 3.3)
- [CVE-2026-106398](https://insights.sbomify.com/CVE-2026-106398/): Missing authorization in Chrome (medium 4.3)
- [CVE-2026-106397](https://insights.sbomify.com/CVE-2026-106397/): Security feature bypass in Chrome (medium 6.1)
- [CVE-2026-106396](https://insights.sbomify.com/CVE-2026-106396/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-106395](https://insights.sbomify.com/CVE-2026-106395/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-106394](https://insights.sbomify.com/CVE-2026-106394/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-106393](https://insights.sbomify.com/CVE-2026-106393/): Use after free in Chrome (high 8.3)
- [CVE-2026-106392](https://insights.sbomify.com/CVE-2026-106392/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-106391](https://insights.sbomify.com/CVE-2026-106391/): Missing authorization in Chrome (medium 4.2)
- [CVE-2026-106390](https://insights.sbomify.com/CVE-2026-106390/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-10639](https://insights.sbomify.com/CVE-2026-10639/): Use-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()` (medium 4.8)
- [CVE-2026-106389](https://insights.sbomify.com/CVE-2026-106389/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-106388](https://insights.sbomify.com/CVE-2026-106388/): Missing authorization in Chrome (medium 5.3)
- [CVE-2026-106387](https://insights.sbomify.com/CVE-2026-106387/): Missing authorization in Chrome (high 8.8)
- [CVE-2026-106386](https://insights.sbomify.com/CVE-2026-106386/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-106385](https://insights.sbomify.com/CVE-2026-106385/): Race condition in Chrome (medium 5.3)
- [CVE-2026-106384](https://insights.sbomify.com/CVE-2026-106384/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-106383](https://insights.sbomify.com/CVE-2026-106383/): Use after free in Chrome (high 8.8)
- [CVE-2026-106382](https://insights.sbomify.com/CVE-2026-106382/): Use after free in Chrome (critical 9.6)
- [CVE-2026-106381](https://insights.sbomify.com/CVE-2026-106381/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-106380](https://insights.sbomify.com/CVE-2026-106380/): Other in Chrome (medium 5.4)
- [CVE-2026-10638](https://insights.sbomify.com/CVE-2026-10638/): Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error (medium 5.9)
- [CVE-2026-106379](https://insights.sbomify.com/CVE-2026-106379/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-106378](https://insights.sbomify.com/CVE-2026-106378/): Privilege escalation in Chrome (high 8.3)
- [CVE-2026-106377](https://insights.sbomify.com/CVE-2026-106377/): Race condition in Chrome (high 8.3)
- [CVE-2026-106376](https://insights.sbomify.com/CVE-2026-106376/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-106375](https://insights.sbomify.com/CVE-2026-106375/): Other in Chrome (critical 9.6)
- [CVE-2026-106374](https://insights.sbomify.com/CVE-2026-106374/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-106373](https://insights.sbomify.com/CVE-2026-106373/): Use after free in Chrome (high 8.8)
- [CVE-2026-106372](https://insights.sbomify.com/CVE-2026-106372/): Missing authorization in Chrome (critical 9.6)
- [CVE-2026-106371](https://insights.sbomify.com/CVE-2026-106371/): Missing authorization in Chrome (high 8.8)
- [CVE-2026-106370](https://insights.sbomify.com/CVE-2026-106370/): Information disclosure in Chrome (medium 4.7)
- [CVE-2026-10637](https://insights.sbomify.com/CVE-2026-10637/): Use-after-free of `net_pkt` in IPv6 MLD send path triggerable by a link-local MLD Query (medium 5.9)
- [CVE-2026-106369](https://insights.sbomify.com/CVE-2026-106369/): Missing authorization in Chrome (medium 4.2)
- [CVE-2026-106368](https://insights.sbomify.com/CVE-2026-106368/): Other in Chrome (medium 5.4)
- [CVE-2026-106367](https://insights.sbomify.com/CVE-2026-106367/): Missing authorization in Chrome (high 8.4)
- [CVE-2026-106366](https://insights.sbomify.com/CVE-2026-106366/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-106365](https://insights.sbomify.com/CVE-2026-106365/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-106364](https://insights.sbomify.com/CVE-2026-106364/): Missing authorization in Chrome (medium 5.3)
- [CVE-2026-106363](https://insights.sbomify.com/CVE-2026-106363/): Missing authorization in Chrome (high 8.3)
- [CVE-2026-106362](https://insights.sbomify.com/CVE-2026-106362/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-106361](https://insights.sbomify.com/CVE-2026-106361/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-106360](https://insights.sbomify.com/CVE-2026-106360/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-10636](https://insights.sbomify.com/CVE-2026-10636/): Use-after-free in Zephyr IPv4 IGMP send path (`igmp_send`) (low 3.7)
- [CVE-2026-106359](https://insights.sbomify.com/CVE-2026-106359/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2026-106358](https://insights.sbomify.com/CVE-2026-106358/): Use after free in Chrome (critical 9.6)
- [CVE-2026-106357](https://insights.sbomify.com/CVE-2026-106357/): Use after free in Chrome (high 8.8)
- [CVE-2026-106356](https://insights.sbomify.com/CVE-2026-106356/): Other in Chrome (medium 5.4)
- [CVE-2026-106355](https://insights.sbomify.com/CVE-2026-106355/): Missing authorization in Chrome (medium 5.3)
- [CVE-2026-106354](https://insights.sbomify.com/CVE-2026-106354/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-106353](https://insights.sbomify.com/CVE-2026-106353/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-106352](https://insights.sbomify.com/CVE-2026-106352/): Missing authorization in Chrome (high 8.8)
- [CVE-2026-106351](https://insights.sbomify.com/CVE-2026-106351/): Information disclosure in Chrome (medium 5.3)
- [CVE-2026-106350](https://insights.sbomify.com/CVE-2026-106350/): Missing authorization in Chrome (high 8.8)
- [CVE-2026-10635](https://insights.sbomify.com/CVE-2026-10635/): Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init (medium 6.3)
- [CVE-2026-106349](https://insights.sbomify.com/CVE-2026-106349/): Use after free in Chrome (high 8.8)
- [CVE-2026-106348](https://insights.sbomify.com/CVE-2026-106348/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-106347](https://insights.sbomify.com/CVE-2026-106347/): Use after free in Chrome (high 8.8)
- [CVE-2026-106346](https://insights.sbomify.com/CVE-2026-106346/): Other in Chrome (high 8.8)
- [CVE-2026-106345](https://insights.sbomify.com/CVE-2026-106345/): Use after free in Chrome (medium 4.2)
- [CVE-2026-106344](https://insights.sbomify.com/CVE-2026-106344/): Missing authorization in Chrome (medium 5.4)
- [CVE-2026-106343](https://insights.sbomify.com/CVE-2026-106343/): Other in Chrome (medium 5.4)
- [CVE-2026-106342](https://insights.sbomify.com/CVE-2026-106342/): Information disclosure in Chrome (high 8.8)
- [CVE-2026-106341](https://insights.sbomify.com/CVE-2026-106341/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-106340](https://insights.sbomify.com/CVE-2026-106340/): Missing authorization in Chrome (medium 4.6)
- [CVE-2026-10634](https://insights.sbomify.com/CVE-2026-10634/): Use-after-free in Zephyr native TCP `net_tcp_foreach()` due to dropping `tcp_lock` during the callback (medium 4.8)
- [CVE-2026-106339](https://insights.sbomify.com/CVE-2026-106339/): Use after free in Chrome (low 3.1)
- [CVE-2026-106338](https://insights.sbomify.com/CVE-2026-106338/): Other in Chrome (medium 5.4)
- [CVE-2026-106337](https://insights.sbomify.com/CVE-2026-106337/): Other in Chrome (medium 5.4)
- [CVE-2026-106336](https://insights.sbomify.com/CVE-2026-106336/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-106335](https://insights.sbomify.com/CVE-2026-106335/): Use after free in Chrome (high 8.8)
- [CVE-2026-106334](https://insights.sbomify.com/CVE-2026-106334/): Information disclosure in Chrome (high 8.8)
- [CVE-2026-106333](https://insights.sbomify.com/CVE-2026-106333/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-106332](https://insights.sbomify.com/CVE-2026-106332/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-106331](https://insights.sbomify.com/CVE-2026-106331/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-106330](https://insights.sbomify.com/CVE-2026-106330/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-106329](https://insights.sbomify.com/CVE-2026-106329/): Missing authorization in Chrome (critical 9.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/962/