# Vulnerabilities published in 2026


- [CVE-2026-83589](https://insights.sbomify.com/CVE-2026-83589/): Oauth-proxy: open redirect via /\ and /\t bypass in post-login redirect (medium 6.1)
- [CVE-2026-83588](https://insights.sbomify.com/CVE-2026-83588/): Windows USB Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83587](https://insights.sbomify.com/CVE-2026-83587/): Windows Core Messaging Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83586](https://insights.sbomify.com/CVE-2026-83586/): Windows Resilient File System (ReFS) Deduplication Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83585](https://insights.sbomify.com/CVE-2026-83585/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83584](https://insights.sbomify.com/CVE-2026-83584/): Windows Smart Card Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83583](https://insights.sbomify.com/CVE-2026-83583/): Windows Geotag Broker Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83582](https://insights.sbomify.com/CVE-2026-83582/): Windows Graphics Kernel Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-83580](https://insights.sbomify.com/CVE-2026-83580/): Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-8358](https://insights.sbomify.com/CVE-2026-8358/): Heap buffer overflow in spreadsheet tracked-changes import (medium 5.4)
- [CVE-2026-83579](https://insights.sbomify.com/CVE-2026-83579/): Windows Smart Card Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83578](https://insights.sbomify.com/CVE-2026-83578/): Microsoft PowerShell Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-83575](https://insights.sbomify.com/CVE-2026-83575/): Windows Search Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83574](https://insights.sbomify.com/CVE-2026-83574/): Windows Search Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83573](https://insights.sbomify.com/CVE-2026-83573/): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-83571](https://insights.sbomify.com/CVE-2026-83571/): Windows Audio Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83570](https://insights.sbomify.com/CVE-2026-83570/): Windows Search Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-8357](https://insights.sbomify.com/CVE-2026-8357/): Heap buffer overflow in Calc formula compilation (medium 5.4)
- [CVE-2026-83569](https://insights.sbomify.com/CVE-2026-83569/): HID Parser Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83568](https://insights.sbomify.com/CVE-2026-83568/): Windows Kernel-Mode Drivers Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83567](https://insights.sbomify.com/CVE-2026-83567/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83566](https://insights.sbomify.com/CVE-2026-83566/): Windows Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83565](https://insights.sbomify.com/CVE-2026-83565/): Windows Encrypting File System (EFS) Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83564](https://insights.sbomify.com/CVE-2026-83564/): Windows Search Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83562](https://insights.sbomify.com/CVE-2026-83562/): WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2026-83561](https://insights.sbomify.com/CVE-2026-83561/): Cross-site scripting in Complianz GDPR/CCPA Cookie Consent Banner (high 7.2)
- [CVE-2026-83560](https://insights.sbomify.com/CVE-2026-83560/): New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass (medium 5.3)
- [CVE-2026-8356](https://insights.sbomify.com/CVE-2026-8356/): Stack buffer overflow in PPT presentation import (medium 5.4)
- [CVE-2026-83557](https://insights.sbomify.com/CVE-2026-83557/): jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types (medium 5.6)
- [CVE-2026-83555](https://insights.sbomify.com/CVE-2026-83555/): Missing authorization in Email Subscribers & Newsletters (medium 5.3)
- [CVE-2026-83551](https://insights.sbomify.com/CVE-2026-83551/): Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path (high 8.5)
- [CVE-2026-83550](https://insights.sbomify.com/CVE-2026-83550/): Postgres-exporter: net/http/pprof exposed on metrics listener (high 7.1)
- [CVE-2026-8355](https://insights.sbomify.com/CVE-2026-8355/): IBM ContextForge MCP Gateway is affected by server-side request forgery (medium 5.4)
- [CVE-2026-83549](https://insights.sbomify.com/CVE-2026-83549/): SonicWall SMA1000 Appliances OS Command Injection (high 7.8, exploited in the wild)
- [CVE-2026-83548](https://insights.sbomify.com/CVE-2026-83548/): SonicWall SMA1000 Appliances Server-Side Request Forgery (critical 10.0, exploited in the wild)
- [CVE-2026-83547](https://insights.sbomify.com/CVE-2026-83547/): Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets (medium 6.8)
- [CVE-2026-83546](https://insights.sbomify.com/CVE-2026-83546/): CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute (medium 6.8)
- [CVE-2026-83545](https://insights.sbomify.com/CVE-2026-83545/): CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON (medium 6.8)
- [CVE-2026-83544](https://insights.sbomify.com/CVE-2026-83544/): Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute (medium 6.8)
- [CVE-2026-83543](https://insights.sbomify.com/CVE-2026-83543/): Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint (medium 4.1)
- [CVE-2026-83541](https://insights.sbomify.com/CVE-2026-83541/): Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget (medium 6.8)
- [CVE-2026-83540](https://insights.sbomify.com/CVE-2026-83540/): wolfSSHd on Windows race condition leading to logon token reused across connections (high 7.7)
- [CVE-2026-8354](https://insights.sbomify.com/CVE-2026-8354/): Cross-site scripting in Gum Addon for Elementor (medium 6.4)
- [CVE-2026-83537](https://insights.sbomify.com/CVE-2026-83537/): WP Express Checkout < 2.5.0 - Unauthenticated Payment Bypass via wpec_process_empty_payment (medium 5.3)
- [CVE-2026-83536](https://insights.sbomify.com/CVE-2026-83536/): Openstack-network-exporter: http.server has no readheadertimeout / readtimeout (slowloris) (medium 5.3)
- [CVE-2026-83535](https://insights.sbomify.com/CVE-2026-83535/): Openstack-network-exporter: basic-auth uses plaintext password storage and non-constant-time comparison (high 7.4)
- [CVE-2026-83534](https://insights.sbomify.com/CVE-2026-83534/): PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel() (medium 6.4)
- [CVE-2026-83533](https://insights.sbomify.com/CVE-2026-83533/): WP Express Checkout < 2.4.9 - Unauthenticated Payment Bypass via wpec_process_payment (medium 5.3)
- [CVE-2026-83532](https://insights.sbomify.com/CVE-2026-83532/): Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes (medium 6.8)
- [CVE-2026-83531](https://insights.sbomify.com/CVE-2026-83531/): Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages (high 8.8)
- [CVE-2026-83530](https://insights.sbomify.com/CVE-2026-83530/): Uncontrolled Memory Allocation in cel-go (medium 6.9)
- [CVE-2026-8353](https://insights.sbomify.com/CVE-2026-8353/): Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in atomik theme (low 2.1)
- [CVE-2026-83527](https://insights.sbomify.com/CVE-2026-83527/): Auth bypass in Sentry (high 8.1)
- [CVE-2026-83526](https://insights.sbomify.com/CVE-2026-83526/): File upload in FV Player 8 (high 8.8)
- [CVE-2026-83525](https://insights.sbomify.com/CVE-2026-83525/): Denial of service in Apache Kafka (not scored)
- [CVE-2026-83524](https://insights.sbomify.com/CVE-2026-83524/): RedPort Optimizer wXa-223 System Clock datetime.php exec command injection (critical 9.4)
- [CVE-2026-83523](https://insights.sbomify.com/CVE-2026-83523/): Windows Image Acquisition Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-83522](https://insights.sbomify.com/CVE-2026-83522/): Windows IKE Extension Spoofing Vulnerability (high 8.1)
- [CVE-2026-83521](https://insights.sbomify.com/CVE-2026-83521/): Windows IKE Extension Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-83520](https://insights.sbomify.com/CVE-2026-83520/): .NET Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-83519](https://insights.sbomify.com/CVE-2026-83519/): Windows Error Reporting Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-83518](https://insights.sbomify.com/CVE-2026-83518/): RPC Runtime Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83517](https://insights.sbomify.com/CVE-2026-83517/): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-83516](https://insights.sbomify.com/CVE-2026-83516/): Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability (high 7.5)
- [CVE-2026-83515](https://insights.sbomify.com/CVE-2026-83515/): RPC Runtime Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-83514](https://insights.sbomify.com/CVE-2026-83514/): Windows Partition Management Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83513](https://insights.sbomify.com/CVE-2026-83513/): Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83511](https://insights.sbomify.com/CVE-2026-83511/): Active Directory Federation Services (AD FS) Spoofing Vulnerability (high 7.4)
- [CVE-2026-83510](https://insights.sbomify.com/CVE-2026-83510/): Windows Setup Files Cleanup Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-8351](https://insights.sbomify.com/CVE-2026-8351/): Cross-site scripting in RTMKit (medium 6.4)
- [CVE-2026-83509](https://insights.sbomify.com/CVE-2026-83509/): Windows Setup Files Cleanup Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83508](https://insights.sbomify.com/CVE-2026-83508/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83507](https://insights.sbomify.com/CVE-2026-83507/): Windows Update Orchestrator Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83506](https://insights.sbomify.com/CVE-2026-83506/): Servicing Stack Updates Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83505](https://insights.sbomify.com/CVE-2026-83505/): Windows Setup Files Cleanup Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-83504](https://insights.sbomify.com/CVE-2026-83504/): Windows SmartScreen Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-83501](https://insights.sbomify.com/CVE-2026-83501/): Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-83500](https://insights.sbomify.com/CVE-2026-83500/): Windows BitLocker Security Feature Bypass Vulnerability (medium 6.1)
- [CVE-2026-8350](https://insights.sbomify.com/CVE-2026-8350/): Concrete CMS is vulnerable to missing authorization in the bulk_user_assignment.php (high 7.5)
- [CVE-2026-83499](https://insights.sbomify.com/CVE-2026-83499/): Windows Server Update Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83498](https://insights.sbomify.com/CVE-2026-83498/): Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-83497](https://insights.sbomify.com/CVE-2026-83497/): Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination (high 8.7)
- [CVE-2026-83492](https://insights.sbomify.com/CVE-2026-83492/): WordPress Kubio AI Website Builder - Denial Of Service (medium 6.9)
- [CVE-2026-83491](https://insights.sbomify.com/CVE-2026-83491/): Missing authorization in Oracle iRecruitment (medium 6.8)
- [CVE-2026-83490](https://insights.sbomify.com/CVE-2026-83490/): Missing authorization in Oracle iRecruitment (high 8.5)
- [CVE-2026-8349](https://insights.sbomify.com/CVE-2026-8349/): omec-project amf NGAP Message memory corruption (medium 5.3)
- [CVE-2026-83489](https://insights.sbomify.com/CVE-2026-83489/): Privilege escalation in Oracle Banking Origination (high 7.5)
- [CVE-2026-83488](https://insights.sbomify.com/CVE-2026-83488/): Missing authorization in Helidon (medium 5.4)
- [CVE-2026-83487](https://insights.sbomify.com/CVE-2026-83487/): Missing authorization in Oracle Product Hub (high 7.7)
- [CVE-2026-83486](https://insights.sbomify.com/CVE-2026-83486/): Missing authorization in Oracle Product Hub (high 7.7)
- [CVE-2026-83485](https://insights.sbomify.com/CVE-2026-83485/): Missing authorization in Oracle Product Hub (high 7.7)
- [CVE-2026-83484](https://insights.sbomify.com/CVE-2026-83484/): Missing authorization in Oracle US Federal Human Resources (high 7.1)
- [CVE-2026-83483](https://insights.sbomify.com/CVE-2026-83483/): Privilege escalation in Oracle Advanced Benefits (high 8.0)
- [CVE-2026-83482](https://insights.sbomify.com/CVE-2026-83482/): Privilege escalation in Oracle Contracts (high 7.2)
- [CVE-2026-83481](https://insights.sbomify.com/CVE-2026-83481/): Privilege escalation in Oracle Contracts (high 7.2)
- [CVE-2026-83480](https://insights.sbomify.com/CVE-2026-83480/): Denial of service in Helidon (medium 5.3)
- [CVE-2026-83479](https://insights.sbomify.com/CVE-2026-83479/): Privilege escalation in Oracle Contracts (high 8.8)
- [CVE-2026-83477](https://insights.sbomify.com/CVE-2026-83477/): Missing authorization in Oracle Work in Process (high 8.1)
- [CVE-2026-8347](https://insights.sbomify.com/CVE-2026-8347/): Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog (low 2.3)
- [CVE-2026-83465](https://insights.sbomify.com/CVE-2026-83465/): Denial of service in Oracle Mobile Application Server (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/323/