# Vulnerabilities published in 2026


- [CVE-2026-88150](https://insights.sbomify.com/CVE-2026-88150/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-88149](https://insights.sbomify.com/CVE-2026-88149/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88147](https://insights.sbomify.com/CVE-2026-88147/): Windows Secure Socket Tunneling Protocol (SSTP) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88146](https://insights.sbomify.com/CVE-2026-88146/): Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88145](https://insights.sbomify.com/CVE-2026-88145/): Microsoft Office Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-88144](https://insights.sbomify.com/CVE-2026-88144/): Microsoft Office PowerPoint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-88143](https://insights.sbomify.com/CVE-2026-88143/): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-88142](https://insights.sbomify.com/CVE-2026-88142/): Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-88141](https://insights.sbomify.com/CVE-2026-88141/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88140](https://insights.sbomify.com/CVE-2026-88140/): Windows Key Storage Provider Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-8814](https://insights.sbomify.com/CVE-2026-8814/): ExifReader is vulnerable to denial of service via unbounded decompression of image metadata (medium 6.9)
- [CVE-2026-88139](https://insights.sbomify.com/CVE-2026-88139/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88137](https://insights.sbomify.com/CVE-2026-88137/): WebDAV Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-88136](https://insights.sbomify.com/CVE-2026-88136/): Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-88135](https://insights.sbomify.com/CVE-2026-88135/): WebDAV Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88134](https://insights.sbomify.com/CVE-2026-88134/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88133](https://insights.sbomify.com/CVE-2026-88133/): Windows Portable Device Enumerator Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88132](https://insights.sbomify.com/CVE-2026-88132/): Azure Key Vault Information Disclosure Vulnerability (medium 5.9)
- [CVE-2026-88131](https://insights.sbomify.com/CVE-2026-88131/): Microsoft Dataverse Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-88130](https://insights.sbomify.com/CVE-2026-88130/): Role: DNS Server Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-8813](https://insights.sbomify.com/CVE-2026-8813/): ExifReader is vulnerable to denial of service via crafted ICC `mluc` tag (high 8.7)
- [CVE-2026-88129](https://insights.sbomify.com/CVE-2026-88129/): Role: DNS Server Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-88128](https://insights.sbomify.com/CVE-2026-88128/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88127](https://insights.sbomify.com/CVE-2026-88127/): Windows SMB Server Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88126](https://insights.sbomify.com/CVE-2026-88126/): WebDAV Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88125](https://insights.sbomify.com/CVE-2026-88125/): Role: DNS Server Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-88124](https://insights.sbomify.com/CVE-2026-88124/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88123](https://insights.sbomify.com/CVE-2026-88123/): Role: DNS Server Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-88122](https://insights.sbomify.com/CVE-2026-88122/): Role: DNS Server Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-88121](https://insights.sbomify.com/CVE-2026-88121/): Windows Background Intelligent Transfer Service (BITS) Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-88120](https://insights.sbomify.com/CVE-2026-88120/): Windows DHCP Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-88119](https://insights.sbomify.com/CVE-2026-88119/): Windows DHCP Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-88118](https://insights.sbomify.com/CVE-2026-88118/): Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88117](https://insights.sbomify.com/CVE-2026-88117/): Windows DHCP Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-88116](https://insights.sbomify.com/CVE-2026-88116/): Windows Domain Name Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-88115](https://insights.sbomify.com/CVE-2026-88115/): Windows Server for NFS Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-88114](https://insights.sbomify.com/CVE-2026-88114/): Windows Domain Name Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-88113](https://insights.sbomify.com/CVE-2026-88113/): Windows Broadcast DVR User Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88112](https://insights.sbomify.com/CVE-2026-88112/): Windows Domain Name Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-88110](https://insights.sbomify.com/CVE-2026-88110/): Windows Graphics Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-8811](https://insights.sbomify.com/CVE-2026-8811/): Path traversal in PDF generation module (high 7.1)
- [CVE-2026-88109](https://insights.sbomify.com/CVE-2026-88109/): Microsoft Office Click-To-Run Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88107](https://insights.sbomify.com/CVE-2026-88107/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88106](https://insights.sbomify.com/CVE-2026-88106/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88105](https://insights.sbomify.com/CVE-2026-88105/): Windows Broadcast DVR User Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88103](https://insights.sbomify.com/CVE-2026-88103/): Windows Broadcast DVR User Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88102](https://insights.sbomify.com/CVE-2026-88102/): Microsoft Failover Cluster Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-88101](https://insights.sbomify.com/CVE-2026-88101/): Microsoft Input Method Editor (IME) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88100](https://insights.sbomify.com/CVE-2026-88100/): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-8810](https://insights.sbomify.com/CVE-2026-8810/): HDD Password leakage vulnerability (medium 6.9)
- [CVE-2026-88099](https://insights.sbomify.com/CVE-2026-88099/): Windows Failover Cluster Denial of Service Vulnerability (medium 5.9)
- [CVE-2026-88098](https://insights.sbomify.com/CVE-2026-88098/): Windows Security Support Provider Interface Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88097](https://insights.sbomify.com/CVE-2026-88097/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2026-88096](https://insights.sbomify.com/CVE-2026-88096/): Windows DCOM Server Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88094](https://insights.sbomify.com/CVE-2026-88094/): Azure Storage Library Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2026-88093](https://insights.sbomify.com/CVE-2026-88093/): Desktop Window Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88092](https://insights.sbomify.com/CVE-2026-88092/): ASP.NET Core Tampering Vulnerability (critical 9.4)
- [CVE-2026-88091](https://insights.sbomify.com/CVE-2026-88091/): Windows Management Instrumentation Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88090](https://insights.sbomify.com/CVE-2026-88090/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 5.4)
- [CVE-2026-8809](https://insights.sbomify.com/CVE-2026-8809/): Privilege escalation in Advanced Custom Fields: Extended (critical 9.8)
- [CVE-2026-88089](https://insights.sbomify.com/CVE-2026-88089/): Microsoft SQL Server Remote Code Execution Vulnerability (medium 6.7)
- [CVE-2026-88088](https://insights.sbomify.com/CVE-2026-88088/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88086](https://insights.sbomify.com/CVE-2026-88086/): Microsoft SQL Server Information Disclosure Vulnerability (medium 5.3)
- [CVE-2026-88085](https://insights.sbomify.com/CVE-2026-88085/): Microsoft SQL Server Elevation of Privilege Vulnerability (medium 6.4)
- [CVE-2026-88084](https://insights.sbomify.com/CVE-2026-88084/): Microsoft SQL Server Denial of Service Vulnerability (medium 5.3)
- [CVE-2026-88083](https://insights.sbomify.com/CVE-2026-88083/): Microsoft SQL Server Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-88082](https://insights.sbomify.com/CVE-2026-88082/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88081](https://insights.sbomify.com/CVE-2026-88081/): Microsoft SQL Server Information Disclosure Vulnerability (high 7.7)
- [CVE-2026-88080](https://insights.sbomify.com/CVE-2026-88080/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88079](https://insights.sbomify.com/CVE-2026-88079/): Windows MIDI Service Module Elevation of Privileges Vulnerability (high 7.0)
- [CVE-2026-88078](https://insights.sbomify.com/CVE-2026-88078/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 4.3)
- [CVE-2026-88077](https://insights.sbomify.com/CVE-2026-88077/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-88076](https://insights.sbomify.com/CVE-2026-88076/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-88075](https://insights.sbomify.com/CVE-2026-88075/): Configuration Manager Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-88074](https://insights.sbomify.com/CVE-2026-88074/): Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88073](https://insights.sbomify.com/CVE-2026-88073/): Windows Graphics Kernel Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-88072](https://insights.sbomify.com/CVE-2026-88072/): Windows Host Guardian Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88071](https://insights.sbomify.com/CVE-2026-88071/): Windows Hyper-V Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88070](https://insights.sbomify.com/CVE-2026-88070/): Windows BitLocker Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-88069](https://insights.sbomify.com/CVE-2026-88069/): Path traversal in pandora (critical 9.3)
- [CVE-2026-88065](https://insights.sbomify.com/CVE-2026-88065/): `tts-be` application has a Broken Access Control vulnerability (high 7.5)
- [CVE-2026-88064](https://insights.sbomify.com/CVE-2026-88064/): Backstage: Improper input validation in TechDocs MkDocs configuration (high 8.8)
- [CVE-2026-88062](https://insights.sbomify.com/CVE-2026-88062/): OmniRoute ACP Custom-Agent Remote Code Execution (RCE) (critical 9.5)
- [CVE-2026-88061](https://insights.sbomify.com/CVE-2026-88061/): Cross-site request forgery in career-ops (medium 5.8)
- [CVE-2026-88060](https://insights.sbomify.com/CVE-2026-88060/): Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements (high 8.6)
- [CVE-2026-8806](https://insights.sbomify.com/CVE-2026-8806/): Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series FX5-ENET/IP Ethernet module (high 8.7)
- [CVE-2026-88059](https://insights.sbomify.com/CVE-2026-88059/): Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent` (medium 4.0)
- [CVE-2026-88058](https://insights.sbomify.com/CVE-2026-88058/): Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements (high 8.6)
- [CVE-2026-88057](https://insights.sbomify.com/CVE-2026-88057/): Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler (medium 5.3)
- [CVE-2026-88056](https://insights.sbomify.com/CVE-2026-88056/): Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR (high 8.6)
- [CVE-2026-88055](https://insights.sbomify.com/CVE-2026-88055/): AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator (medium 5.5)
- [CVE-2026-88054](https://insights.sbomify.com/CVE-2026-88054/): Tesseract: Denial of service via empty-stack dereference in Plumbing/Series at model load (medium 6.9)
- [CVE-2026-88053](https://insights.sbomify.com/CVE-2026-88053/): Tesseract: Heap out-of-bounds write in Classify::ReadIntTemplates via unvalidated counts in crafted .traineddata (high 8.6)
- [CVE-2026-88052](https://insights.sbomify.com/CVE-2026-88052/): Tesseract: Heap out-of-bounds write in UNICHARSET::load_via_fgets via count/insert desynchronization (high 7.8)
- [CVE-2026-88051](https://insights.sbomify.com/CVE-2026-88051/): Tesseract: Heap out-of-bounds write in GenericVector<T>::read due to independent reserved/size_used_ fields (high 8.6)
- [CVE-2026-88050](https://insights.sbomify.com/CVE-2026-88050/): Tesseract: Out-of-bounds write in UnicharCompress via unvalidated recoder code values (medium 6.9)
- [CVE-2026-8805](https://insights.sbomify.com/CVE-2026-8805/): Denial-of-service (DoS) vulnerability in MELSEC iQ-F Series EtherNet/IP module (high 8.7)
- [CVE-2026-88049](https://insights.sbomify.com/CVE-2026-88049/): Tesseract: Heap out-of-bounds write in LSTM::Forward via na_/gate-matrix dimension mismatch (high 8.6)
- [CVE-2026-88048](https://insights.sbomify.com/CVE-2026-88048/): Tesseract: Heap out-of-bounds write/read in FullyConnected::Forward via layer/weight-matrix dimension mismatch (high 8.6)
- [CVE-2026-88047](https://insights.sbomify.com/CVE-2026-88047/): Tesseract: ReadNormProtos stack buffer overflow (high 8.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/283/