Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 322 of 1013.
- CVE-2026-83694 Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability
- CVE-2026-83693 Windows Error Reporting Remote Code Execution Vulnerability
- CVE-2026-83692 Windows Bind Filter Driver Elevation of Privilege Vulnerability
- CVE-2026-83691 Windows DHCP Server Elevation of Privilege Vulnerability
- CVE-2026-83690 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-8369 Improper Input Validation in OpenThread NAT64 Translator
- CVE-2026-83689 Windows Error Reporting Elevation of Privilege Vulnerability
- CVE-2026-83688 Remote Desktop Client Remote Code Execution Vulnerability
- CVE-2026-83687 Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
- CVE-2026-83686 Microsoft Windows Search Component Information Disclosure Vulnerability
- CVE-2026-83685 Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
- CVE-2026-83683 Windows Encrypting File System (EFS) Information Disclosure Vulnerability
- CVE-2026-83682 Windows TCP/IP Elevation of Privilege Vulnerability
- CVE-2026-83681 Microsoft PowerToys Tampering Vulnerability
- CVE-2026-83680 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-8368 Information disclosure in LWP::UserAgent
- CVE-2026-83679 Windows Defender Firewall Service Elevation of Privilege Vulnerability
- CVE-2026-83678 Windows TCP/IP Elevation of Privilege Vulnerability
- CVE-2026-83677 Windows DHCP Client Denial of Service Vulnerability
- CVE-2026-83676 Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-83675 Windows Kernel Elevation of Privilege Vulnerability
- CVE-2026-83674 Active Directory Federation Services (AD FS) Spoofing Vulnerability
- CVE-2026-83672 Windows Installer Information Disclosure Vulnerability
- CVE-2026-83671 Windows Hyper-V Information Disclosure Vulnerability
- CVE-2026-83670 Function Discovery Service (fdwsd.dll) Information Disclosure Vulnerability
- CVE-2026-8367 aria2c Improper Certificate Validation
- CVE-2026-83669 Windows Error Reporting Elevation of Privilege Vulnerability
- CVE-2026-83668 Windows WLAN Service Information Disclosure Vulnerability
- CVE-2026-83667 Windows Active Directory Domain Services Denial of Service Vulnerability
- CVE-2026-83666 Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability
- CVE-2026-83665 Windows DHCP Server Denial of Service Vulnerability
- CVE-2026-83664 Windows Portable Device File System Driver Information Disclosure Vulnerability
- CVE-2026-83663 Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go)
- CVE-2026-83662 Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)
- CVE-2026-83661 Photoshop Desktop | Integer Overflow or Wraparound (CWE-190)
- CVE-2026-83660 Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)
- CVE-2026-83659 Windows User Profile Service Elevation of Privilege Vulnerability
- CVE-2026-83658 Windows Error Reporting Information Disclosure Vulnerability
- CVE-2026-83657 Windows Modern Device Management (MDM) Tampering Vulnerability
- CVE-2026-83656 Windows Modern Device Management (MDM) Tampering Vulnerability
- CVE-2026-83655 Network Policy Server (NPS) Denial of Service Vulnerability
- CVE-2026-83654 Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability
- CVE-2026-83652 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-83651 Windows GDI Information Disclosure Vulnerability
- CVE-2026-83650 Windows Media Elevation of Privilege Vulnerability
- CVE-2026-8365 Deserialization in Blocksy
- CVE-2026-83649 Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
- CVE-2026-83648 Windows Active Directory Domain Services Denial of Service Vulnerability
- CVE-2026-83647 Windows Active Directory Domain Services Denial of Service Vulnerability
- CVE-2026-83646 Active Directory Federation Services (AD FS) Spoofing Vulnerability
- CVE-2026-83645 Active Directory Federation Services (AD FS) Denial of Service Vulnerability
- CVE-2026-83644 Windows Audio Service Elevation of Privilege Vulnerability
- CVE-2026-83643 Windows Error Reporting Remote Code Execution Vulnerability
- CVE-2026-83642 Windows Domain Name Service Remote Code Execution Vulnerability
- CVE-2026-83641 Windows Media Elevation of Privilege Vulnerability
- CVE-2026-83640 Windows NTFS Remote Code Execution Vulnerability
- CVE-2026-8364 Gladinet Triofox Missing Authentication for Critical Functions
- CVE-2026-83639 Windows Sensor Data Service Elevation of Privilege Vulnerability
- CVE-2026-83638 Windows USB Driver Elevation of Privilege Vulnerability
- CVE-2026-83637 Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability
- CVE-2026-83636 Windows Hyper-V Denial of Service Vulnerability
- CVE-2026-83635 Role: DNS Server Denial of Service Vulnerability
- CVE-2026-83634 Windows BitLocker Elevation of Privilege Vulnerability
- CVE-2026-83632 Apache Thrift: C++ THttpTransport grows its line buffer without bound
- CVE-2026-8363 Gladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dll
- CVE-2026-83628 Missing authorization in Theme My Login
- CVE-2026-83627 Code injection in Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN
- CVE-2026-83625 Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header
- CVE-2026-83621 ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs
- CVE-2026-8362 Gladinet Triofox Stack-based Buffer Overflow in WOSDefaultHttpModule.dll
- CVE-2026-83619 xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser
- CVE-2026-83618 xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator
- CVE-2026-83617 xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator
- CVE-2026-83616 xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
- CVE-2026-83615 xmldom: Quadratic-memory consumption
- CVE-2026-83614 xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge
- CVE-2026-83613 xmldom: Quadratic-time attribute deduplication
- CVE-2026-83612 xmldom: HTML raw-text closing-tag case mismatch causes output amplification
- CVE-2026-83611 xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
- CVE-2026-83610 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization
- CVE-2026-8361 Gladinet Triofox Path Traversal in WOSDefaultHttpModule.dll
- CVE-2026-83609 xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
- CVE-2026-83608 xmldom: DocType `name` Injection Bypasses requireWellFormed
- CVE-2026-83607 xmldom: Element name injection via createElement() bypasses requireWellFormed
- CVE-2026-83606 xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
- CVE-2026-83605 xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
- CVE-2026-83603 Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
- CVE-2026-83602 Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK
- CVE-2026-83601 Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write
- CVE-2026-83600 Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent
- CVE-2026-8360 Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOS
- CVE-2026-83599 Netdata: WebSocket Decompression Bomb
- CVE-2026-83598 Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair
- CVE-2026-83597 Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution
- CVE-2026-83596 Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature
- CVE-2026-83595 AVideo Cross-Site Request Forgery via plugin/API/set.json.php
- CVE-2026-83593 WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
- CVE-2026-83592 Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values
- CVE-2026-83591 AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation
- CVE-2026-8359 Gladinet Triofox WOSHttpStatusModule.dll NULL Function Pointer Call DoS