# Vulnerabilities published in 2026


- [CVE-2026-87696](https://insights.sbomify.com/CVE-2026-87696/): Microsoft Exchange Server Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-87695](https://insights.sbomify.com/CVE-2026-87695/): Microsoft Exchange Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-87694](https://insights.sbomify.com/CVE-2026-87694/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-87693](https://insights.sbomify.com/CVE-2026-87693/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-87692](https://insights.sbomify.com/CVE-2026-87692/): Microsoft Exchange Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-87691](https://insights.sbomify.com/CVE-2026-87691/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-87690](https://insights.sbomify.com/CVE-2026-87690/): Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution (high 8.8)
- [CVE-2026-8769](https://insights.sbomify.com/CVE-2026-8769/): vercel ai provider-utils response-handler.ts createJsonErrorResponseHandler resource consumption (medium 5.3)
- [CVE-2026-87689](https://insights.sbomify.com/CVE-2026-87689/): Metasploit Framework Web Service REST API Missing Authentication on Credential Endpoints (critical 9.8)
- [CVE-2026-87688](https://insights.sbomify.com/CVE-2026-87688/): Command injection in Fabric OS (high 8.5)
- [CVE-2026-87687](https://insights.sbomify.com/CVE-2026-87687/): Missing authorization in Fabric OS (high 8.5)
- [CVE-2026-87686](https://insights.sbomify.com/CVE-2026-87686/): Auth bypass in Fabric OS (medium 5.3)
- [CVE-2026-87685](https://insights.sbomify.com/CVE-2026-87685/): Path traversal in Fabric OS (high 8.4)
- [CVE-2026-87684](https://insights.sbomify.com/CVE-2026-87684/): Memory corruption in Fabric OS (high 8.7)
- [CVE-2026-87683](https://insights.sbomify.com/CVE-2026-87683/): Memory corruption in Fabric OS (high 8.6)
- [CVE-2026-87682](https://insights.sbomify.com/CVE-2026-87682/): Command injection in Fabric OS (high 8.6)
- [CVE-2026-87681](https://insights.sbomify.com/CVE-2026-87681/): Privilege escalation in Fabric OS (high 7.1)
- [CVE-2026-87680](https://insights.sbomify.com/CVE-2026-87680/): Command injection in Fabric OS (high 8.5)
- [CVE-2026-8768](https://insights.sbomify.com/CVE-2026-8768/): vercel ai provider-utils download-blob.ts validateDownloadUrl server-side request forgery (medium 6.9)
- [CVE-2026-87679](https://insights.sbomify.com/CVE-2026-87679/): Memory corruption in Fabric OS (high 8.5)
- [CVE-2026-87678](https://insights.sbomify.com/CVE-2026-87678/): Code injection in Fabric OS (medium 6.9)
- [CVE-2026-87677](https://insights.sbomify.com/CVE-2026-87677/): Command injection in Fabric OS (medium 5.4)
- [CVE-2026-87676](https://insights.sbomify.com/CVE-2026-87676/): Memory corruption in Fabric OS (medium 6.9)
- [CVE-2026-87675](https://insights.sbomify.com/CVE-2026-87675/): Command injection in Fabric OS (high 7.3)
- [CVE-2026-87674](https://insights.sbomify.com/CVE-2026-87674/): Privilege escalation in Fabric OS (high 8.5)
- [CVE-2026-87673](https://insights.sbomify.com/CVE-2026-87673/): Command injection in Fabric OS (high 7.0)
- [CVE-2026-87672](https://insights.sbomify.com/CVE-2026-87672/): Information disclosure in Fabric OS (medium 6.8)
- [CVE-2026-87671](https://insights.sbomify.com/CVE-2026-87671/): Memory corruption in Fabric OS (high 7.1)
- [CVE-2026-87670](https://insights.sbomify.com/CVE-2026-87670/): Auth bypass in Fabric OS (medium 5.1)
- [CVE-2026-8767](https://insights.sbomify.com/CVE-2026-8767/): vercel ai PR Branch Name Interpolation prettier-on-automerge.yml run os command injection (low 2.3)
- [CVE-2026-87669](https://insights.sbomify.com/CVE-2026-87669/): Missing authorization in Fabric OS (medium 5.1)
- [CVE-2026-87668](https://insights.sbomify.com/CVE-2026-87668/): Memory corruption in Fabric OS (medium 6.9)
- [CVE-2026-87667](https://insights.sbomify.com/CVE-2026-87667/): Command injection in Fabric OS (high 8.4)
- [CVE-2026-87666](https://insights.sbomify.com/CVE-2026-87666/): Command injection in Fabric OS (high 8.6)
- [CVE-2026-87665](https://insights.sbomify.com/CVE-2026-87665/): Memory corruption in Fabric OS (medium 6.0)
- [CVE-2026-87664](https://insights.sbomify.com/CVE-2026-87664/): Auth bypass in Fabric OS (high 8.5)
- [CVE-2026-87663](https://insights.sbomify.com/CVE-2026-87663/): Command injection in Fabric OS (high 7.1)
- [CVE-2026-87662](https://insights.sbomify.com/CVE-2026-87662/): Command injection in Fabric OS (high 7.0)
- [CVE-2026-87661](https://insights.sbomify.com/CVE-2026-87661/): Denial of service in Fabric OS (medium 6.8)
- [CVE-2026-87660](https://insights.sbomify.com/CVE-2026-87660/): Missing authorization in Fabric OS (high 7.0)
- [CVE-2026-8766](https://insights.sbomify.com/CVE-2026-8766/): Kilo-Org kilocode Environment Variable config.ts load information disclosure (medium 5.3)
- [CVE-2026-87659](https://insights.sbomify.com/CVE-2026-87659/): Auth bypass in Fabric OS (high 7.1)
- [CVE-2026-87658](https://insights.sbomify.com/CVE-2026-87658/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-87657](https://insights.sbomify.com/CVE-2026-87657/): Use after free in Chrome (low 3.1)
- [CVE-2026-87656](https://insights.sbomify.com/CVE-2026-87656/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-87655](https://insights.sbomify.com/CVE-2026-87655/): Other in Chrome (medium 5.4)
- [CVE-2026-87654](https://insights.sbomify.com/CVE-2026-87654/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-87653](https://insights.sbomify.com/CVE-2026-87653/): Other in Chrome (medium 5.4)
- [CVE-2026-87652](https://insights.sbomify.com/CVE-2026-87652/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-87651](https://insights.sbomify.com/CVE-2026-87651/): Missing authorization in Chrome (medium 4.3)
- [CVE-2026-87650](https://insights.sbomify.com/CVE-2026-87650/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-8765](https://insights.sbomify.com/CVE-2026-8765/): Kilo-Org kilocode File Diff API Endpoint worktree-diff.ts Bun.file path traversal (medium 5.3)
- [CVE-2026-87649](https://insights.sbomify.com/CVE-2026-87649/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-87648](https://insights.sbomify.com/CVE-2026-87648/): Use after free in Chrome (high 8.3)
- [CVE-2026-87647](https://insights.sbomify.com/CVE-2026-87647/): Information disclosure in Chrome (low 3.4)
- [CVE-2026-87646](https://insights.sbomify.com/CVE-2026-87646/): Use after free in Chrome (critical 9.6)
- [CVE-2026-87645](https://insights.sbomify.com/CVE-2026-87645/): Security feature bypass in Chrome (medium 5.4)
- [CVE-2026-87644](https://insights.sbomify.com/CVE-2026-87644/): Missing authorization in Chrome (high 8.3)
- [CVE-2026-87643](https://insights.sbomify.com/CVE-2026-87643/): Integer overflow in Chrome (critical 9.6)
- [CVE-2026-87642](https://insights.sbomify.com/CVE-2026-87642/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-87641](https://insights.sbomify.com/CVE-2026-87641/): Race condition in Chrome (medium 5.3)
- [CVE-2026-87640](https://insights.sbomify.com/CVE-2026-87640/): Memory corruption in Chrome (medium 6.1)
- [CVE-2026-8764](https://insights.sbomify.com/CVE-2026-8764/): H3C Magic B3 aspForm UpdateWanParams buffer overflow (high 8.6)
- [CVE-2026-87639](https://insights.sbomify.com/CVE-2026-87639/): Use after free in Chrome (high 8.3)
- [CVE-2026-87638](https://insights.sbomify.com/CVE-2026-87638/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-87637](https://insights.sbomify.com/CVE-2026-87637/): Use after free in Chrome (critical 9.6)
- [CVE-2026-87636](https://insights.sbomify.com/CVE-2026-87636/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-87635](https://insights.sbomify.com/CVE-2026-87635/): Other in Chrome (medium 5.4)
- [CVE-2026-87634](https://insights.sbomify.com/CVE-2026-87634/): Use after free in Chrome (critical 9.6)
- [CVE-2026-87633](https://insights.sbomify.com/CVE-2026-87633/): Use after free in Chrome (high 8.6)
- [CVE-2026-87632](https://insights.sbomify.com/CVE-2026-87632/): Cross-site scripting in Chrome (medium 4.3)
- [CVE-2026-87631](https://insights.sbomify.com/CVE-2026-87631/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-87630](https://insights.sbomify.com/CVE-2026-87630/): Integer overflow in Chrome (medium 4.3)
- [CVE-2026-8763](https://insights.sbomify.com/CVE-2026-8763/): Name Constraints bypass via trailing dot in rfc822Name and URI (critical 9.3)
- [CVE-2026-87629](https://insights.sbomify.com/CVE-2026-87629/): Missing authorization in Chrome (medium 6.5)
- [CVE-2026-87628](https://insights.sbomify.com/CVE-2026-87628/): Use after free in Chrome (high 8.3)
- [CVE-2026-87627](https://insights.sbomify.com/CVE-2026-87627/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-87626](https://insights.sbomify.com/CVE-2026-87626/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-87625](https://insights.sbomify.com/CVE-2026-87625/): Use after free in Chrome (high 8.8)
- [CVE-2026-87624](https://insights.sbomify.com/CVE-2026-87624/): Other in Chrome (medium 4.2)
- [CVE-2026-87623](https://insights.sbomify.com/CVE-2026-87623/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-87622](https://insights.sbomify.com/CVE-2026-87622/): Missing authorization in Chrome (medium 4.3)
- [CVE-2026-87621](https://insights.sbomify.com/CVE-2026-87621/): Memory corruption in Chrome (critical 9.6)
- [CVE-2026-87620](https://insights.sbomify.com/CVE-2026-87620/): Information disclosure in Chrome (medium 6.5)
- [CVE-2026-87619](https://insights.sbomify.com/CVE-2026-87619/): Information disclosure in Chrome (medium 4.3)
- [CVE-2026-87618](https://insights.sbomify.com/CVE-2026-87618/): Other in Chrome (high 8.3)
- [CVE-2026-87617](https://insights.sbomify.com/CVE-2026-87617/): Use after free in Chrome (high 8.8)
- [CVE-2026-87616](https://insights.sbomify.com/CVE-2026-87616/): Other in Chrome (high 8.3)
- [CVE-2026-87615](https://insights.sbomify.com/CVE-2026-87615/): Race condition in Chrome (medium 5.4)
- [CVE-2026-87614](https://insights.sbomify.com/CVE-2026-87614/): Security feature bypass in Chrome (low 3.1)
- [CVE-2026-87613](https://insights.sbomify.com/CVE-2026-87613/): Other in Chrome (critical 9.0)
- [CVE-2026-87612](https://insights.sbomify.com/CVE-2026-87612/): Memory corruption in Chrome (high 8.8)
- [CVE-2026-87611](https://insights.sbomify.com/CVE-2026-87611/): Missing authorization in Chrome (low 3.1)
- [CVE-2026-87610](https://insights.sbomify.com/CVE-2026-87610/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2026-8761](https://insights.sbomify.com/CVE-2026-8761/): Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation (high 8.8)
- [CVE-2026-87609](https://insights.sbomify.com/CVE-2026-87609/): Use after free in Chrome (critical 9.6)
- [CVE-2026-87608](https://insights.sbomify.com/CVE-2026-87608/): Security feature bypass in Chrome (high 7.5)
- [CVE-2026-87607](https://insights.sbomify.com/CVE-2026-87607/): Use after free in Chrome (critical 9.6)
- [CVE-2026-87606](https://insights.sbomify.com/CVE-2026-87606/): Missing authorization in Chrome (high 8.1)
- [CVE-2026-87605](https://insights.sbomify.com/CVE-2026-87605/): Missing authorization in Chrome (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/287/