# Vulnerabilities published in 2026


- [CVE-2026-7301](https://insights.sbomify.com/CVE-2026-7301/): CVE-2026-7301 (critical 9.8)
- [CVE-2026-73009](https://insights.sbomify.com/CVE-2026-73009/): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-73008](https://insights.sbomify.com/CVE-2026-73008/): Windows Biometric Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-73007](https://insights.sbomify.com/CVE-2026-73007/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-73006](https://insights.sbomify.com/CVE-2026-73006/): DirectWrite Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-73005](https://insights.sbomify.com/CVE-2026-73005/): Windows Authentication Methods Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-73004](https://insights.sbomify.com/CVE-2026-73004/): Windows Autopilot Tampering Vulnerability (medium 5.5)
- [CVE-2026-73003](https://insights.sbomify.com/CVE-2026-73003/): Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-73002](https://insights.sbomify.com/CVE-2026-73002/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-73001](https://insights.sbomify.com/CVE-2026-73001/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-73000](https://insights.sbomify.com/CVE-2026-73000/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-7300](https://insights.sbomify.com/CVE-2026-7300/): Memory corruption in Connext Professional (high 8.8)
- [CVE-2026-72999](https://insights.sbomify.com/CVE-2026-72999/): Windows USB Hub Driver Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-72997](https://insights.sbomify.com/CVE-2026-72997/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72996](https://insights.sbomify.com/CVE-2026-72996/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72995](https://insights.sbomify.com/CVE-2026-72995/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72994](https://insights.sbomify.com/CVE-2026-72994/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72993](https://insights.sbomify.com/CVE-2026-72993/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72992](https://insights.sbomify.com/CVE-2026-72992/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72991](https://insights.sbomify.com/CVE-2026-72991/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72990](https://insights.sbomify.com/CVE-2026-72990/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-7299](https://insights.sbomify.com/CVE-2026-7299/): CVE-2026-7299 (medium 6.3)
- [CVE-2026-72989](https://insights.sbomify.com/CVE-2026-72989/): Windows Failover Cluster Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-72988](https://insights.sbomify.com/CVE-2026-72988/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72987](https://insights.sbomify.com/CVE-2026-72987/): Windows DNS Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-72986](https://insights.sbomify.com/CVE-2026-72986/): Graphic Fonts Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-72985](https://insights.sbomify.com/CVE-2026-72985/): Volume Shadow Copy Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-72984](https://insights.sbomify.com/CVE-2026-72984/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-72983](https://insights.sbomify.com/CVE-2026-72983/): Internet Connection Sharing (ICS) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-72982](https://insights.sbomify.com/CVE-2026-72982/): Windows Netlogon Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-72981](https://insights.sbomify.com/CVE-2026-72981/): IP Helper Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-72980](https://insights.sbomify.com/CVE-2026-72980/): Windows Hello Security Feature Bypass Vulnerability (medium 4.4)
- [CVE-2026-7298](https://insights.sbomify.com/CVE-2026-7298/): Reflected XSS in IdeaSoft's Smart E-Commerce (medium 6.1)
- [CVE-2026-72979](https://insights.sbomify.com/CVE-2026-72979/): Windows DHCP Server Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-72978](https://insights.sbomify.com/CVE-2026-72978/): Active Directory Federation Services (AD FS) Denial of Service Vulnerability (medium 5.9)
- [CVE-2026-72977](https://insights.sbomify.com/CVE-2026-72977/): Microsoft Office PowerPoint Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-72976](https://insights.sbomify.com/CVE-2026-72976/): Microsoft Office Word Information Disclosure Vulnerability (medium 5.0)
- [CVE-2026-72975](https://insights.sbomify.com/CVE-2026-72975/): Microsoft Office PowerPoint Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-72974](https://insights.sbomify.com/CVE-2026-72974/): Microsoft Office Excel Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-72973](https://insights.sbomify.com/CVE-2026-72973/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-72972](https://insights.sbomify.com/CVE-2026-72972/): Microsoft Office Word Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-72971](https://insights.sbomify.com/CVE-2026-72971/): Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability (medium 5.5)
- [CVE-2026-72970](https://insights.sbomify.com/CVE-2026-72970/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 8.3)
- [CVE-2026-7297](https://insights.sbomify.com/CVE-2026-7297/): SourceCodester Pizzafy Ecommerce System ajax.php save_user cross site scripting (medium 4.8)
- [CVE-2026-72969](https://insights.sbomify.com/CVE-2026-72969/): Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-72968](https://insights.sbomify.com/CVE-2026-72968/): Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-72967](https://insights.sbomify.com/CVE-2026-72967/): Windows Network Connection Broker Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72966](https://insights.sbomify.com/CVE-2026-72966/): Windows Remote Access Connection Manager Tampering Vulnerability (medium 5.5)
- [CVE-2026-72965](https://insights.sbomify.com/CVE-2026-72965/): Windows WebClient Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72964](https://insights.sbomify.com/CVE-2026-72964/): Windows Internet Connection Sharing (ICS) Tampering Vulnerability (medium 5.5)
- [CVE-2026-72963](https://insights.sbomify.com/CVE-2026-72963/): Windows Modern Execution Server Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-72962](https://insights.sbomify.com/CVE-2026-72962/): Windows USB Video Driver Elevation of Privilege Vulnerability (high 8.2)
- [CVE-2026-72961](https://insights.sbomify.com/CVE-2026-72961/): Windows Hyper-V Elevation of Privilege Vulnerability (high 8.2)
- [CVE-2026-72960](https://insights.sbomify.com/CVE-2026-72960/): Windows Media Player Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-7296](https://insights.sbomify.com/CVE-2026-7296/): SourceCodester Pizzafy Ecommerce System ajax.php save_order cross site scripting (medium 4.8)
- [CVE-2026-72959](https://insights.sbomify.com/CVE-2026-72959/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-72958](https://insights.sbomify.com/CVE-2026-72958/): Windows Credential Guard Elevation of Privilege Vulnerability (high 8.2)
- [CVE-2026-72957](https://insights.sbomify.com/CVE-2026-72957/): Windows Deployment Services Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-72956](https://insights.sbomify.com/CVE-2026-72956/): Microsoft Office PowerPoint Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-72955](https://insights.sbomify.com/CVE-2026-72955/): Windows Application Compatibility Cache Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-72954](https://insights.sbomify.com/CVE-2026-72954/): Windows Deployment Services Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-72953](https://insights.sbomify.com/CVE-2026-72953/): Windows USB Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72952](https://insights.sbomify.com/CVE-2026-72952/): Windows Spaceport.sys Remote Code Execution Vulnerability (high 7.0)
- [CVE-2026-72950](https://insights.sbomify.com/CVE-2026-72950/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-7295](https://insights.sbomify.com/CVE-2026-7295/): SourceCodester Pizzafy Ecommerce System ajax.php save_menu cross site scripting (medium 4.8)
- [CVE-2026-72949](https://insights.sbomify.com/CVE-2026-72949/): Windows SMB Server Network Transport Driver (srvnet.sys) Denial of Service Vulnerability (high 7.5)
- [CVE-2026-72948](https://insights.sbomify.com/CVE-2026-72948/): Windows DNS Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-72947](https://insights.sbomify.com/CVE-2026-72947/): Windows File History Service Elevation of Privilege Vulnerability (medium 6.4)
- [CVE-2026-72946](https://insights.sbomify.com/CVE-2026-72946/): Microsoft Storage Port Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72945](https://insights.sbomify.com/CVE-2026-72945/): Windows Task Scheduler Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-72944](https://insights.sbomify.com/CVE-2026-72944/): Role: Windows Fax Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72943](https://insights.sbomify.com/CVE-2026-72943/): Windows Deployment Services Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-72942](https://insights.sbomify.com/CVE-2026-72942/): Windows Spaceport.sys Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-72941](https://insights.sbomify.com/CVE-2026-72941/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72940](https://insights.sbomify.com/CVE-2026-72940/): Windows Schannel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-7294](https://insights.sbomify.com/CVE-2026-7294/): SourceCodester Pizzafy Ecommerce System index.php save_settings cross site scripting (medium 4.8)
- [CVE-2026-72939](https://insights.sbomify.com/CVE-2026-72939/): Windows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-72938](https://insights.sbomify.com/CVE-2026-72938/): Microsoft Office PowerPoint Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-72937](https://insights.sbomify.com/CVE-2026-72937/): Windows Storage Port Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-72936](https://insights.sbomify.com/CVE-2026-72936/): Windows SMB Client Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-72935](https://insights.sbomify.com/CVE-2026-72935/): Windows NTFS Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-72934](https://insights.sbomify.com/CVE-2026-72934/): Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-72933](https://insights.sbomify.com/CVE-2026-72933/): Microsoft WDAC OLE DB provider for SQL Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-72932](https://insights.sbomify.com/CVE-2026-72932/): Windows Message Queuing Queue Manager Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-72931](https://insights.sbomify.com/CVE-2026-72931/): Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability (medium 4.7)
- [CVE-2026-72930](https://insights.sbomify.com/CVE-2026-72930/): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (high 7.0)
- [CVE-2026-7293](https://insights.sbomify.com/CVE-2026-7293/): SourceCodester Pizzafy Ecommerce System ajax.php delete_category sql injection (medium 5.1)
- [CVE-2026-72929](https://insights.sbomify.com/CVE-2026-72929/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-72928](https://insights.sbomify.com/CVE-2026-72928/): Windows DNS Server Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-72927](https://insights.sbomify.com/CVE-2026-72927/): Winsock Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-72926](https://insights.sbomify.com/CVE-2026-72926/): Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-72925](https://insights.sbomify.com/CVE-2026-72925/): SWC HTML minifier may allow script element breakout when minifying embedded JSON (medium 6.1)
- [CVE-2026-72924](https://insights.sbomify.com/CVE-2026-72924/): GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by default (low 2.1)
- [CVE-2026-72923](https://insights.sbomify.com/CVE-2026-72923/): Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion (high 7.5)
- [CVE-2026-72922](https://insights.sbomify.com/CVE-2026-72922/): AutoGPT: Webhook provider path confusion bypasses generic webhook secret verification (high 8.2)
- [CVE-2026-72921](https://insights.sbomify.com/CVE-2026-72921/): SeaweedFS: Filer JWT allowed_prefixes literal prefix match allows cross-tenant access to sibling paths (high 8.1)
- [CVE-2026-72920](https://insights.sbomify.com/CVE-2026-72920/): SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control (critical 9.8)
- [CVE-2026-7292](https://insights.sbomify.com/CVE-2026-7292/): o2oa NodeAgent NodeAgent.java syncFile improper authorization (medium 6.3)
- [CVE-2026-72919](https://insights.sbomify.com/CVE-2026-72919/): Missing authorization in Rocket.Chat (medium 4.3)
- [CVE-2026-72918](https://insights.sbomify.com/CVE-2026-72918/): Rocket.Chat: Insecure implementation of websocket notifications (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/405/