# Vulnerabilities published in 2026


- [CVE-2026-83909](https://insights.sbomify.com/CVE-2026-83909/): Windows Win32 Kernel Subsystem Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-83908](https://insights.sbomify.com/CVE-2026-83908/): RPC Runtime Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83907](https://insights.sbomify.com/CVE-2026-83907/): Windows Hello Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83906](https://insights.sbomify.com/CVE-2026-83906/): Windows Shell Spoofing Vulnerability (medium 6.5)
- [CVE-2026-83905](https://insights.sbomify.com/CVE-2026-83905/): Windows Shell Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-83904](https://insights.sbomify.com/CVE-2026-83904/): HID Parser Library Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83903](https://insights.sbomify.com/CVE-2026-83903/): Windows Direct Composition Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83902](https://insights.sbomify.com/CVE-2026-83902/): Windows Direct Composition Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83901](https://insights.sbomify.com/CVE-2026-83901/): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83900](https://insights.sbomify.com/CVE-2026-83900/): Windows Bind Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-8390](https://insights.sbomify.com/CVE-2026-8390/): Use-after-free in the JavaScript: WebAssembly component (high 7.3)
- [CVE-2026-83899](https://insights.sbomify.com/CVE-2026-83899/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83898](https://insights.sbomify.com/CVE-2026-83898/): HID Parser Library Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83897](https://insights.sbomify.com/CVE-2026-83897/): Windows Win32 Kernel Subsystem Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-83896](https://insights.sbomify.com/CVE-2026-83896/): Windows Direct Composition Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83895](https://insights.sbomify.com/CVE-2026-83895/): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-83893](https://insights.sbomify.com/CVE-2026-83893/): Windows Clipboard User Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83892](https://insights.sbomify.com/CVE-2026-83892/): Windows Human Interface Device Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83891](https://insights.sbomify.com/CVE-2026-83891/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-8389](https://insights.sbomify.com/CVE-2026-8389/): JIT miscompilation in the JavaScript Engine: JIT component (high 8.8)
- [CVE-2026-83889](https://insights.sbomify.com/CVE-2026-83889/): Windows DNS Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-83888](https://insights.sbomify.com/CVE-2026-83888/): Windows CD-ROM Driver Elevation of Privilege Vulnerability (medium 6.5)
- [CVE-2026-83887](https://insights.sbomify.com/CVE-2026-83887/): HID Parser Library Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83886](https://insights.sbomify.com/CVE-2026-83886/): Windows Update Orchestrator Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83885](https://insights.sbomify.com/CVE-2026-83885/): Windows Virtualization-Based Security (VBS) Enclave Spoofing Vulnerability (medium 5.6)
- [CVE-2026-83884](https://insights.sbomify.com/CVE-2026-83884/): Windows Human Interface Device Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83883](https://insights.sbomify.com/CVE-2026-83883/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83882](https://insights.sbomify.com/CVE-2026-83882/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83881](https://insights.sbomify.com/CVE-2026-83881/): Windows exFAT File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-8388](https://insights.sbomify.com/CVE-2026-8388/): Incorrect boundary conditions in the JavaScript Engine: JIT component (medium 6.5)
- [CVE-2026-83879](https://insights.sbomify.com/CVE-2026-83879/): Windows Overlay Filter Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83877](https://insights.sbomify.com/CVE-2026-83877/): Windows Devices Human Interface Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83876](https://insights.sbomify.com/CVE-2026-83876/): Windows Shell Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83875](https://insights.sbomify.com/CVE-2026-83875/): Windows Human Interface Device Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83874](https://insights.sbomify.com/CVE-2026-83874/): Windows Event Tracing Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-83873](https://insights.sbomify.com/CVE-2026-83873/): Windows Shell Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83872](https://insights.sbomify.com/CVE-2026-83872/): Windows TCP/IP Local Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83871](https://insights.sbomify.com/CVE-2026-83871/): Microsoft OpenSSH for Windows Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83870](https://insights.sbomify.com/CVE-2026-83870/): Windows Aggregated Data Platform Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-8387](https://insights.sbomify.com/CVE-2026-8387/): Relative Path Traversal in allegroai/clearml (low 2.4)
- [CVE-2026-83869](https://insights.sbomify.com/CVE-2026-83869/): Windows Domain Name Service Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-83868](https://insights.sbomify.com/CVE-2026-83868/): Microsoft Bluetooth Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83867](https://insights.sbomify.com/CVE-2026-83867/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83866](https://insights.sbomify.com/CVE-2026-83866/): Windows Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83865](https://insights.sbomify.com/CVE-2026-83865/): Windows Internet (wininet.dll) Tampering Vulnerability (medium 4.7)
- [CVE-2026-83864](https://insights.sbomify.com/CVE-2026-83864/): Windows NTFS Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83863](https://insights.sbomify.com/CVE-2026-83863/): Servicing Stack Updates Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83862](https://insights.sbomify.com/CVE-2026-83862/): Windows Network Load Balancing Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-83861](https://insights.sbomify.com/CVE-2026-83861/): Windows Remote Desktop Protocol Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83860](https://insights.sbomify.com/CVE-2026-83860/): Windows GDI Denial of Service Vulnerability (high 7.5)
- [CVE-2026-8386](https://insights.sbomify.com/CVE-2026-8386/): WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Marker ID (medium 5.3)
- [CVE-2026-83859](https://insights.sbomify.com/CVE-2026-83859/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83857](https://insights.sbomify.com/CVE-2026-83857/): Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83856](https://insights.sbomify.com/CVE-2026-83856/): Windows Event Logging Service Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-83855](https://insights.sbomify.com/CVE-2026-83855/): Windows WLAN Service Denial of Service Vulnerability (high 7.5)
- [CVE-2026-83854](https://insights.sbomify.com/CVE-2026-83854/): Windows Notification Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83853](https://insights.sbomify.com/CVE-2026-83853/): Windows Hello Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83852](https://insights.sbomify.com/CVE-2026-83852/): Windows Bind Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83851](https://insights.sbomify.com/CVE-2026-83851/): Windows Partition Management Driver Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-83850](https://insights.sbomify.com/CVE-2026-83850/): Microsoft Windows Search Component Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-8385](https://insights.sbomify.com/CVE-2026-8385/): WP Go Maps < 10.0.10 - Unauthenticated Sensitive Information Disclosure via Datatables AJAX Fallback (medium 5.3)
- [CVE-2026-83849](https://insights.sbomify.com/CVE-2026-83849/): Windows Hello Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83848](https://insights.sbomify.com/CVE-2026-83848/): Windows COM+ Event System Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83847](https://insights.sbomify.com/CVE-2026-83847/): Microsoft Account Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83846](https://insights.sbomify.com/CVE-2026-83846/): Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83845](https://insights.sbomify.com/CVE-2026-83845/): Windows Internet (wininet.dll) Spoofing Vulnerability (high 8.4)
- [CVE-2026-83844](https://insights.sbomify.com/CVE-2026-83844/): Windows Paint Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-83843](https://insights.sbomify.com/CVE-2026-83843/): Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (high 7.5)
- [CVE-2026-83842](https://insights.sbomify.com/CVE-2026-83842/): Windows TCP/IP Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83841](https://insights.sbomify.com/CVE-2026-83841/): Windows Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83840](https://insights.sbomify.com/CVE-2026-83840/): Windows Error Reporting Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-8384](https://insights.sbomify.com/CVE-2026-8384/): Eclipse Jetty: Path parameter traversal (medium 5.3)
- [CVE-2026-83839](https://insights.sbomify.com/CVE-2026-83839/): Windows Hyper-V Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83838](https://insights.sbomify.com/CVE-2026-83838/): Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2026-83837](https://insights.sbomify.com/CVE-2026-83837/): Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83836](https://insights.sbomify.com/CVE-2026-83836/): Windows Event Tracing Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-83835](https://insights.sbomify.com/CVE-2026-83835/): Windows Common Log File System Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83834](https://insights.sbomify.com/CVE-2026-83834/): Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83833](https://insights.sbomify.com/CVE-2026-83833/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83832](https://insights.sbomify.com/CVE-2026-83832/): Windows Spaceport.sys Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83831](https://insights.sbomify.com/CVE-2026-83831/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-83830](https://insights.sbomify.com/CVE-2026-83830/): Windows COM+ Event System Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-8383](https://insights.sbomify.com/CVE-2026-8383/): LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API (medium 5.3)
- [CVE-2026-83829](https://insights.sbomify.com/CVE-2026-83829/): Microsoft Windows Search Component Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83828](https://insights.sbomify.com/CVE-2026-83828/): Windows MIDI Service Module Elevation of Privileges Vulnerability (high 7.8)
- [CVE-2026-83827](https://insights.sbomify.com/CVE-2026-83827/): Windows Bluetooth Port Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83826](https://insights.sbomify.com/CVE-2026-83826/): Windows Error Reporting Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-8382](https://insights.sbomify.com/CVE-2026-8382/): Missing authorization in Advanced Custom Fields (ACF®) (medium 5.3)
- [CVE-2026-83813](https://insights.sbomify.com/CVE-2026-83813/): Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation (low 3.1)
- [CVE-2026-8381](https://insights.sbomify.com/CVE-2026-8381/): Broken Access Control in TeamViewer DEX Platform (On Premises) (medium 5.4)
- [CVE-2026-83805](https://insights.sbomify.com/CVE-2026-83805/): Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs (medium 6.4)
- [CVE-2026-83803](https://insights.sbomify.com/CVE-2026-83803/): Sentry: Unsafe pickle deserialization in Relocation Feature (high 7.7)
- [CVE-2026-83801](https://insights.sbomify.com/CVE-2026-83801/): Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text (medium 5.4)
- [CVE-2026-8380](https://insights.sbomify.com/CVE-2026-8380/): Frontend File Manager Plugin <= 23.6 - Author+ Arbitrary Post Deletion (medium 6.5)
- [CVE-2026-83798](https://insights.sbomify.com/CVE-2026-83798/): Windows Update Stack Spoofing Vulnerability (medium 5.5)
- [CVE-2026-83797](https://insights.sbomify.com/CVE-2026-83797/): Windows Partition Management Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-83796](https://insights.sbomify.com/CVE-2026-83796/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83795](https://insights.sbomify.com/CVE-2026-83795/): Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (high 7.5)
- [CVE-2026-83794](https://insights.sbomify.com/CVE-2026-83794/): Windows Portable Device MTP Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83793](https://insights.sbomify.com/CVE-2026-83793/): Windows Update Orchestrator Service Elevation of Privilege Vulnerability (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/320/