# Vulnerabilities published in 2026


- [CVE-2026-70222](https://insights.sbomify.com/CVE-2026-70222/): Windows Shell Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70220](https://insights.sbomify.com/CVE-2026-70220/): Microsoft Office Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-7022](https://insights.sbomify.com/CVE-2026-7022/): SmythOS sre HTTP Header AgentRuntime.class.ts AgentRuntime improper authentication (medium 6.9)
- [CVE-2026-70219](https://insights.sbomify.com/CVE-2026-70219/): Microsoft Office Excel Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-70218](https://insights.sbomify.com/CVE-2026-70218/): Windows StateRepository API Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70217](https://insights.sbomify.com/CVE-2026-70217/): Microsoft Office SharePoint Information Disclosure Vulnerability (medium 4.9)
- [CVE-2026-70216](https://insights.sbomify.com/CVE-2026-70216/): Windows Mobile Device Management Tampering Vulnerability (medium 5.5)
- [CVE-2026-70215](https://insights.sbomify.com/CVE-2026-70215/): Microsoft Office PowerPoint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-70214](https://insights.sbomify.com/CVE-2026-70214/): Microsoft Office Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70213](https://insights.sbomify.com/CVE-2026-70213/): Microsoft Power Apps Remote Code Execution Vulnerability (high 8.0)
- [CVE-2026-70212](https://insights.sbomify.com/CVE-2026-70212/): Windows Security Center Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70211](https://insights.sbomify.com/CVE-2026-70211/): Win32k Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70210](https://insights.sbomify.com/CVE-2026-70210/): Windows OLE DB Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-7021](https://insights.sbomify.com/CVE-2026-7021/): SmythOS sre Connector Service utils.ts information disclosure (medium 5.1)
- [CVE-2026-70209](https://insights.sbomify.com/CVE-2026-70209/): Windows Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70208](https://insights.sbomify.com/CVE-2026-70208/): HTTP.sys Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70207](https://insights.sbomify.com/CVE-2026-70207/): Network Policy Server (NPS) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-70206](https://insights.sbomify.com/CVE-2026-70206/): Microsoft Office Word Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-70205](https://insights.sbomify.com/CVE-2026-70205/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70203](https://insights.sbomify.com/CVE-2026-70203/): Windows Media Player Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-70202](https://insights.sbomify.com/CVE-2026-70202/): Microsoft Office SharePoint Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-70201](https://insights.sbomify.com/CVE-2026-70201/): Windows DHCP Server Denial of Service Vulnerability (medium 5.5)
- [CVE-2026-70200](https://insights.sbomify.com/CVE-2026-70200/): Azure Logic Apps Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-7020](https://insights.sbomify.com/CVE-2026-7020/): Ollama Tensor Model Transfer transfer.go digestToPath path traversal (medium 6.3)
- [CVE-2026-70199](https://insights.sbomify.com/CVE-2026-70199/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70198](https://insights.sbomify.com/CVE-2026-70198/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70197](https://insights.sbomify.com/CVE-2026-70197/): .NET and Visual Studio Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-70196](https://insights.sbomify.com/CVE-2026-70196/): ASP.NET Core Denial of Service Vulnerability (medium 5.9)
- [CVE-2026-70195](https://insights.sbomify.com/CVE-2026-70195/): Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-70194](https://insights.sbomify.com/CVE-2026-70194/): .NET Framework Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2026-70190](https://insights.sbomify.com/CVE-2026-70190/): .NET Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2026-7019](https://insights.sbomify.com/CVE-2026-7019/): Tenda F456 P2pListFilter fromP2pListFilter buffer overflow (high 8.7)
- [CVE-2026-70189](https://insights.sbomify.com/CVE-2026-70189/): Microsoft SQL Server Remote Code Execution Vulnerability (medium 6.7)
- [CVE-2026-70188](https://insights.sbomify.com/CVE-2026-70188/): ASP.NET Core Security Feature Bypass Vulnerability (critical 9.1)
- [CVE-2026-70187](https://insights.sbomify.com/CVE-2026-70187/): Windows Remote Desktop Services Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-70186](https://insights.sbomify.com/CVE-2026-70186/): ASP.NET Core Denial of Service Vulnerability (high 7.5)
- [CVE-2026-70185](https://insights.sbomify.com/CVE-2026-70185/): Microsoft PowerShell Security Feature Bypass Vulnerability (high 8.8)
- [CVE-2026-70184](https://insights.sbomify.com/CVE-2026-70184/): Windows Backup Engine Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70183](https://insights.sbomify.com/CVE-2026-70183/): ASP.NET Core Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-70181](https://insights.sbomify.com/CVE-2026-70181/): ASP.NET Core Denial of Service Vulnerability (high 7.5)
- [CVE-2026-7018](https://insights.sbomify.com/CVE-2026-7018/): Datavane Datavines JWT Token TokenManager.java hard-coded key (medium 6.3)
- [CVE-2026-70179](https://insights.sbomify.com/CVE-2026-70179/): ASP.NET Core Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-70178](https://insights.sbomify.com/CVE-2026-70178/): Microsoft Fabric Elevation of Privilege Vulnerability (high 8.5)
- [CVE-2026-70177](https://insights.sbomify.com/CVE-2026-70177/): Microsoft Windows Search Component Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70176](https://insights.sbomify.com/CVE-2026-70176/): Windows Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70175](https://insights.sbomify.com/CVE-2026-70175/): ASP.NET Core Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2026-70174](https://insights.sbomify.com/CVE-2026-70174/): .NET Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-70173](https://insights.sbomify.com/CVE-2026-70173/): Microsoft Windows Search Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70172](https://insights.sbomify.com/CVE-2026-70172/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70170](https://insights.sbomify.com/CVE-2026-70170/): Windows Kernel Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-7017](https://insights.sbomify.com/CVE-2026-7017/): HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets (high 7.1)
- [CVE-2026-70169](https://insights.sbomify.com/CVE-2026-70169/): Windows Connected Devices Platform Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70168](https://insights.sbomify.com/CVE-2026-70168/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70167](https://insights.sbomify.com/CVE-2026-70167/): Windows Domain Name Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-70166](https://insights.sbomify.com/CVE-2026-70166/): Windows DNS Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-70165](https://insights.sbomify.com/CVE-2026-70165/): .NET Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-70164](https://insights.sbomify.com/CVE-2026-70164/): Windows TCP/IP Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70163](https://insights.sbomify.com/CVE-2026-70163/): Microsoft OpenSSH for Windows Denial of Service Vulnerability (high 7.5)
- [CVE-2026-70162](https://insights.sbomify.com/CVE-2026-70162/): .NET Denial of Service Vulnerability (medium 5.9)
- [CVE-2026-70161](https://insights.sbomify.com/CVE-2026-70161/): .NET Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2026-70160](https://insights.sbomify.com/CVE-2026-70160/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-7016](https://insights.sbomify.com/CVE-2026-7016/): MaxSite CMS ushki Plugin cross site scripting (medium 4.8)
- [CVE-2026-70159](https://insights.sbomify.com/CVE-2026-70159/): ASP.NET Core Denial of Service Vulnerability (high 7.5)
- [CVE-2026-70158](https://insights.sbomify.com/CVE-2026-70158/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-70157](https://insights.sbomify.com/CVE-2026-70157/): Windows System Information Console Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-70156](https://insights.sbomify.com/CVE-2026-70156/): Microsoft Windows Search Component Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70155](https://insights.sbomify.com/CVE-2026-70155/): Windows DNS Denial of Service Vulnerability (high 7.5)
- [CVE-2026-70153](https://insights.sbomify.com/CVE-2026-70153/): Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-70151](https://insights.sbomify.com/CVE-2026-70151/): Windows Direct Composition Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70150](https://insights.sbomify.com/CVE-2026-70150/): Microsoft Windows Search Component Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-7015](https://insights.sbomify.com/CVE-2026-7015/): MaxSite CMS Guestbook Plugin cross site scripting (medium 4.8)
- [CVE-2026-70149](https://insights.sbomify.com/CVE-2026-70149/): Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-70148](https://insights.sbomify.com/CVE-2026-70148/): Windows Broadcast DVR User Service Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-70147](https://insights.sbomify.com/CVE-2026-70147/): Microsoft PostScript Printer Driver Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-70145](https://insights.sbomify.com/CVE-2026-70145/): Microsoft Windows Search Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70144](https://insights.sbomify.com/CVE-2026-70144/): Windows Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70143](https://insights.sbomify.com/CVE-2026-70143/): Windows Network File System Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-70142](https://insights.sbomify.com/CVE-2026-70142/): Windows Update Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70141](https://insights.sbomify.com/CVE-2026-70141/): Microsoft Windows Search Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70140](https://insights.sbomify.com/CVE-2026-70140/): Windows Audio Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-7014](https://insights.sbomify.com/CVE-2026-7014/): MaxSite CMS down_count Plugin cross site scripting (medium 4.8)
- [CVE-2026-70139](https://insights.sbomify.com/CVE-2026-70139/): Windows Update Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70138](https://insights.sbomify.com/CVE-2026-70138/): Windows OLE Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70137](https://insights.sbomify.com/CVE-2026-70137/): Windows Remote Access Connection Manager Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70136](https://insights.sbomify.com/CVE-2026-70136/): Microsoft Windows Search Component Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70135](https://insights.sbomify.com/CVE-2026-70135/): Windows Remote POS Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70134](https://insights.sbomify.com/CVE-2026-70134/): Windows Event Tracing Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-70133](https://insights.sbomify.com/CVE-2026-70133/): Windows SMB Server Denial of Service Vulnerability (high 7.5)
- [CVE-2026-70132](https://insights.sbomify.com/CVE-2026-70132/): Windows Portable Device File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70131](https://insights.sbomify.com/CVE-2026-70131/): Microsoft Windows Media Foundation Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70130](https://insights.sbomify.com/CVE-2026-70130/): Microsoft Office Remote Code Execution Vulnerability (high 8.4)
- [CVE-2026-7013](https://insights.sbomify.com/CVE-2026-7013/): MaxSite CMS mail_send Plugin cross site scripting (medium 4.8)
- [CVE-2026-70128](https://insights.sbomify.com/CVE-2026-70128/): HID Parser Library Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-70127](https://insights.sbomify.com/CVE-2026-70127/): Windows Domain Name Service Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-70126](https://insights.sbomify.com/CVE-2026-70126/): Windows Bluetooth Port Driver Remote Code Execution (high 7.1)
- [CVE-2026-70125](https://insights.sbomify.com/CVE-2026-70125/): Microsoft Office Outlook Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-70124](https://insights.sbomify.com/CVE-2026-70124/): Windows DHCP Server Information Disclosure Vulnerability (medium 5.9)
- [CVE-2026-70123](https://insights.sbomify.com/CVE-2026-70123/): Microsoft Graphics Component Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-70122](https://insights.sbomify.com/CVE-2026-70122/): Windows Broadcast DVR User Service Elevation of Privilege Vulnerability (medium 6.5)
- [CVE-2026-70121](https://insights.sbomify.com/CVE-2026-70121/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/430/