# Vulnerabilities published in 2026


- [CVE-2026-83694](https://insights.sbomify.com/CVE-2026-83694/): Windows Volume Manager Extension Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83693](https://insights.sbomify.com/CVE-2026-83693/): Windows Error Reporting Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-83692](https://insights.sbomify.com/CVE-2026-83692/): Windows Bind Filter Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83691](https://insights.sbomify.com/CVE-2026-83691/): Windows DHCP Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83690](https://insights.sbomify.com/CVE-2026-83690/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-8369](https://insights.sbomify.com/CVE-2026-8369/): Improper Input Validation in OpenThread NAT64 Translator (medium 6.0)
- [CVE-2026-83689](https://insights.sbomify.com/CVE-2026-83689/): Windows Error Reporting Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83688](https://insights.sbomify.com/CVE-2026-83688/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-83687](https://insights.sbomify.com/CVE-2026-83687/): Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83686](https://insights.sbomify.com/CVE-2026-83686/): Microsoft Windows Search Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83685](https://insights.sbomify.com/CVE-2026-83685/): Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-83683](https://insights.sbomify.com/CVE-2026-83683/): Windows Encrypting File System (EFS) Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-83682](https://insights.sbomify.com/CVE-2026-83682/): Windows TCP/IP Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83681](https://insights.sbomify.com/CVE-2026-83681/): Microsoft PowerToys Tampering Vulnerability (medium 5.5)
- [CVE-2026-83680](https://insights.sbomify.com/CVE-2026-83680/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-8368](https://insights.sbomify.com/CVE-2026-8368/): Information disclosure in LWP::UserAgent (medium 6.5)
- [CVE-2026-83679](https://insights.sbomify.com/CVE-2026-83679/): Windows Defender Firewall Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83678](https://insights.sbomify.com/CVE-2026-83678/): Windows TCP/IP Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83677](https://insights.sbomify.com/CVE-2026-83677/): Windows DHCP Client Denial of Service Vulnerability (high 7.5)
- [CVE-2026-83676](https://insights.sbomify.com/CVE-2026-83676/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83675](https://insights.sbomify.com/CVE-2026-83675/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83674](https://insights.sbomify.com/CVE-2026-83674/): Active Directory Federation Services (AD FS) Spoofing Vulnerability (high 8.1)
- [CVE-2026-83672](https://insights.sbomify.com/CVE-2026-83672/): Windows Installer Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-83671](https://insights.sbomify.com/CVE-2026-83671/): Windows Hyper-V Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-83670](https://insights.sbomify.com/CVE-2026-83670/): Function Discovery Service (fdwsd.dll) Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-8367](https://insights.sbomify.com/CVE-2026-8367/): aria2c Improper Certificate Validation (medium 4.8)
- [CVE-2026-83669](https://insights.sbomify.com/CVE-2026-83669/): Windows Error Reporting Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83668](https://insights.sbomify.com/CVE-2026-83668/): Windows WLAN Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83667](https://insights.sbomify.com/CVE-2026-83667/): Windows Active Directory Domain Services Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-83666](https://insights.sbomify.com/CVE-2026-83666/): Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83665](https://insights.sbomify.com/CVE-2026-83665/): Windows DHCP Server Denial of Service Vulnerability (high 7.5)
- [CVE-2026-83664](https://insights.sbomify.com/CVE-2026-83664/): Windows Portable Device File System Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83663](https://insights.sbomify.com/CVE-2026-83663/): Apache Thrift: TFramedTransport and THeaderTransport re-enter Read once per frame that carries no payload (Go) (high 8.7)
- [CVE-2026-83662](https://insights.sbomify.com/CVE-2026-83662/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (critical 9.3)
- [CVE-2026-83661](https://insights.sbomify.com/CVE-2026-83661/): Photoshop Desktop | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2026-83660](https://insights.sbomify.com/CVE-2026-83660/): Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918) (critical 9.9)
- [CVE-2026-83659](https://insights.sbomify.com/CVE-2026-83659/): Windows User Profile Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83658](https://insights.sbomify.com/CVE-2026-83658/): Windows Error Reporting Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83657](https://insights.sbomify.com/CVE-2026-83657/): Windows Modern Device Management (MDM) Tampering Vulnerability (medium 5.5)
- [CVE-2026-83656](https://insights.sbomify.com/CVE-2026-83656/): Windows Modern Device Management (MDM) Tampering Vulnerability (medium 4.7)
- [CVE-2026-83655](https://insights.sbomify.com/CVE-2026-83655/): Network Policy Server (NPS) Denial of Service Vulnerability (high 7.5)
- [CVE-2026-83654](https://insights.sbomify.com/CVE-2026-83654/): Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83652](https://insights.sbomify.com/CVE-2026-83652/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83651](https://insights.sbomify.com/CVE-2026-83651/): Windows GDI Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-83650](https://insights.sbomify.com/CVE-2026-83650/): Windows Media Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-8365](https://insights.sbomify.com/CVE-2026-8365/): Deserialization in Blocksy (high 8.8)
- [CVE-2026-83649](https://insights.sbomify.com/CVE-2026-83649/): Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-83648](https://insights.sbomify.com/CVE-2026-83648/): Windows Active Directory Domain Services Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-83647](https://insights.sbomify.com/CVE-2026-83647/): Windows Active Directory Domain Services Denial of Service Vulnerability (high 7.5)
- [CVE-2026-83646](https://insights.sbomify.com/CVE-2026-83646/): Active Directory Federation Services (AD FS) Spoofing Vulnerability (medium 4.8)
- [CVE-2026-83645](https://insights.sbomify.com/CVE-2026-83645/): Active Directory Federation Services (AD FS) Denial of Service Vulnerability (high 7.5)
- [CVE-2026-83644](https://insights.sbomify.com/CVE-2026-83644/): Windows Audio Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83643](https://insights.sbomify.com/CVE-2026-83643/): Windows Error Reporting Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-83642](https://insights.sbomify.com/CVE-2026-83642/): Windows Domain Name Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-83641](https://insights.sbomify.com/CVE-2026-83641/): Windows Media Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83640](https://insights.sbomify.com/CVE-2026-83640/): Windows NTFS Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-8364](https://insights.sbomify.com/CVE-2026-8364/): Gladinet Triofox Missing Authentication for Critical Functions (critical 9.8)
- [CVE-2026-83639](https://insights.sbomify.com/CVE-2026-83639/): Windows Sensor Data Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83638](https://insights.sbomify.com/CVE-2026-83638/): Windows USB Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83637](https://insights.sbomify.com/CVE-2026-83637/): Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83636](https://insights.sbomify.com/CVE-2026-83636/): Windows Hyper-V Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-83635](https://insights.sbomify.com/CVE-2026-83635/): Role: DNS Server Denial of Service Vulnerability (high 7.5)
- [CVE-2026-83634](https://insights.sbomify.com/CVE-2026-83634/): Windows BitLocker Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83632](https://insights.sbomify.com/CVE-2026-83632/): Apache Thrift: C++ THttpTransport grows its line buffer without bound (critical 9.2)
- [CVE-2026-8363](https://insights.sbomify.com/CVE-2026-8363/): Gladinet Triofox Stack-based Buffer Overflow in WOSDeviceDropFolder.dll (critical 9.8)
- [CVE-2026-83628](https://insights.sbomify.com/CVE-2026-83628/): Missing authorization in Theme My Login (medium 4.3)
- [CVE-2026-83627](https://insights.sbomify.com/CVE-2026-83627/): Code injection in Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN (critical 9.8)
- [CVE-2026-83625](https://insights.sbomify.com/CVE-2026-83625/): Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header (high 7.2)
- [CVE-2026-83621](https://insights.sbomify.com/CVE-2026-83621/): ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs (high 8.1)
- [CVE-2026-8362](https://insights.sbomify.com/CVE-2026-8362/): Gladinet Triofox Stack-based Buffer Overflow in WOSDefaultHttpModule.dll (critical 9.8)
- [CVE-2026-83619](https://insights.sbomify.com/CVE-2026-83619/): xmldom: End-tag Whitespace-Trim Regex ReDoS — quadratic backtracking in the 0.8.x end-tag parser (high 8.7)
- [CVE-2026-83618](https://insights.sbomify.com/CVE-2026-83618/): xmldom: requireWellFormed DocType publicId/systemId validation is bypassable via an embedded line terminator (high 8.7)
- [CVE-2026-83617](https://insights.sbomify.com/CVE-2026-83617/): xmldom: requireWellFormed element/attribute name validation is bypassable via an embedded line terminator (high 8.7)
- [CVE-2026-83616](https://insights.sbomify.com/CVE-2026-83616/): xmldom: Processing Instruction Target Injection Bypasses requireWellFormed (high 8.7)
- [CVE-2026-83615](https://insights.sbomify.com/CVE-2026-83615/): xmldom: Quadratic-memory consumption (high 8.7)
- [CVE-2026-83614](https://insights.sbomify.com/CVE-2026-83614/): xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge (high 8.7)
- [CVE-2026-83613](https://insights.sbomify.com/CVE-2026-83613/): xmldom: Quadratic-time attribute deduplication (high 8.7)
- [CVE-2026-83612](https://insights.sbomify.com/CVE-2026-83612/): xmldom: HTML raw-text closing-tag case mismatch causes output amplification (high 8.7)
- [CVE-2026-83611](https://insights.sbomify.com/CVE-2026-83611/): xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content (medium 6.9)
- [CVE-2026-83610](https://insights.sbomify.com/CVE-2026-83610/): xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization (medium 6.3)
- [CVE-2026-8361](https://insights.sbomify.com/CVE-2026-8361/): Gladinet Triofox Path Traversal in WOSDefaultHttpModule.dll (high 7.5)
- [CVE-2026-83609](https://insights.sbomify.com/CVE-2026-83609/): xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path (high 8.7)
- [CVE-2026-83608](https://insights.sbomify.com/CVE-2026-83608/): xmldom: DocType `name` Injection Bypasses requireWellFormed (high 8.7)
- [CVE-2026-83607](https://insights.sbomify.com/CVE-2026-83607/): xmldom: Element name injection via createElement() bypasses requireWellFormed (high 8.7)
- [CVE-2026-83606](https://insights.sbomify.com/CVE-2026-83606/): xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions (high 8.7)
- [CVE-2026-83605](https://insights.sbomify.com/CVE-2026-83605/): xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed (high 8.7)
- [CVE-2026-83603](https://insights.sbomify.com/CVE-2026-83603/): Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE (high 8.4)
- [CVE-2026-83602](https://insights.sbomify.com/CVE-2026-83602/): Netdata: Unauthenticated remote PUT to /api/v3/settings bypasses IP allowlist controls via HTTP_ACL_NOCHECK (medium 6.5)
- [CVE-2026-83601](https://insights.sbomify.com/CVE-2026-83601/): Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write (medium 6.5)
- [CVE-2026-83600](https://insights.sbomify.com/CVE-2026-83600/): Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent (medium 6.5)
- [CVE-2026-8360](https://insights.sbomify.com/CVE-2026-8360/): Gladinet Triofox Unchecked Return Value to NULL Pointer Dereference DOS (high 7.5)
- [CVE-2026-83599](https://insights.sbomify.com/CVE-2026-83599/): Netdata: WebSocket Decompression Bomb (high 7.5)
- [CVE-2026-83598](https://insights.sbomify.com/CVE-2026-83598/): Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair (high 7.8)
- [CVE-2026-83597](https://insights.sbomify.com/CVE-2026-83597/): Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution (high 7.0)
- [CVE-2026-83596](https://insights.sbomify.com/CVE-2026-83596/): Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature (high 8.8)
- [CVE-2026-83595](https://insights.sbomify.com/CVE-2026-83595/): AVideo Cross-Site Request Forgery via plugin/API/set.json.php (high 7.2)
- [CVE-2026-83593](https://insights.sbomify.com/CVE-2026-83593/): WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter (high 7.2)
- [CVE-2026-83592](https://insights.sbomify.com/CVE-2026-83592/): Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values (high 7.2)
- [CVE-2026-83591](https://insights.sbomify.com/CVE-2026-83591/): AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation (high 7.2)
- [CVE-2026-8359](https://insights.sbomify.com/CVE-2026-8359/): Gladinet Triofox WOSHttpStatusModule.dll NULL Function Pointer Call DoS (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/322/