Vulnerabilities published in 2026
101,255 vulnerabilities were published in 2026: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 438 of 1013.
- CVE-2026-69326 Graphic Fonts Remote Code Execution Vulnerability
- CVE-2026-69325 Microsoft JScript Remote Code Execution Vulnerability
- CVE-2026-69324 Windows Performance Monitor Elevation of Privilege Vulnerability
- CVE-2026-69323 Windows Biometric Service Elevation of Privilege Vulnerability
- CVE-2026-69322 Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-69321 Windows Power Dependency Coordinator Tampering Vulnerability
- CVE-2026-69320 Visual Studio Code Remote Code Execution Vulnerability
- CVE-2026-6932 Woo Commerce Minimum Weight <= 3.0.1 - Cross-Site Request Forgery via Settings Update Form
- CVE-2026-69319 Windows USB Video Driver Elevation of Privilege Vulnerability
- CVE-2026-69318 Windows Imaging Component Information Disclosure Vulnerability
- CVE-2026-69317 Windows Remote Desktop Client Information Disclosure Vulnerability
- CVE-2026-69316 Windows Overlay Filter Information Disclosure Vulnerability
- CVE-2026-69315 Windows License Manager Information Disclosure Vulnerability
- CVE-2026-69314 Windows Device Association Broker Service Elevation of Privilege Vulnerability
- CVE-2026-69313 Microsoft Standard XPS Elevation of Privilege Vulnerability
- CVE-2026-69312 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-69311 Windows Audio Service Elevation of Privilege Vulnerability
- CVE-2026-69310 Windows DNS Elevation of Privilege Vulnerability
- CVE-2026-69309 Windows Print Spooler Components Elevation of Privilege Vulnerability
- CVE-2026-69308 Microsoft Standard XPS Information Disclosure Vulnerability
- CVE-2026-69307 Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability
- CVE-2026-69306 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-69305 Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-69304 ASP.NET Core Denial of Service Vulnerability
- CVE-2026-69303 Push Message Routing Service Information Disclosure Vulnerability
- CVE-2026-69301 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-69300 Windows Push Notifications Elevation of Privilege Vulnerability
- CVE-2026-6930 IBM Concert Software Risky Cryptographic Algorithm
- CVE-2026-69299 Microsoft COM for Windows Elevation of Privilege Vulnerability
- CVE-2026-69298 Windows Biometric Service Elevation of Privilege Vulnerability
- CVE-2026-69297 Windows DHCP Server Information Disclosure Vulnerability
- CVE-2026-69296 Windows Device Association Service Elevation of Privilege Vulnerability
- CVE-2026-69295 Windows USB Driver Elevation of Privilege Vulnerability
- CVE-2026-69294 Microsoft COM for Windows Information Disclosure Vulnerability
- CVE-2026-69293 Windows Biometric Service Elevation of Privilege Vulnerability
- CVE-2026-69292 Remote Desktop Gateway Service Elevation of Privilege Vulnerability
- CVE-2026-69291 Windows Volume Manager Extension Driver Remote Code Execution Vulnerability
- CVE-2026-69290 Windows Storage Spaces Controller Elevation of Privilege Vulnerability
- CVE-2026-6929 JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter
- CVE-2026-69289 Windows Setup Files Cleanup Elevation of Privilege Vulnerability
- CVE-2026-69288 Windows GDI+ Information Disclosure Vulnerability
- CVE-2026-69287 Windows Remote Desktop Services Elevation of Privilege Vulnerability
- CVE-2026-69286 Windows USB Audio Class Driver Information Disclosure Vulnerability
- CVE-2026-69285 Microsoft Office Remote Code Execution Vulnerability
- CVE-2026-69284 Windows DCOM Server Elevation of Privilege Vulnerability
- CVE-2026-69283 Windows CD-ROM Driver Elevation of Privilege Vulnerability
- CVE-2026-69282 Microsoft Office SharePoint Remote Code Execution Vulnerability
- CVE-2026-69281 Windows License Manager Elevation of Privilege Vulnerability
- CVE-2026-69280 Windows Push Notifications Elevation of Privilege Vulnerability
- CVE-2026-6928 Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-69279 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
- CVE-2026-69278 Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-69277 Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
- CVE-2026-69276 Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability
- CVE-2026-69275 Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
- CVE-2026-69274 Windows Win32k Elevation of Privilege Vulnerability
- CVE-2026-69273 Microsoft Office SharePoint Remote Code Execution Vulnerability
- CVE-2026-69272 Microsoft Standard XPS Elevation of Privilege Vulnerability
- CVE-2026-69271 Microsoft Standard XPS Elevation of Privilege Vulnerability
- CVE-2026-69270 Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability
- CVE-2026-69269 Microsoft Standard XPS Elevation of Privilege Vulnerability
- CVE-2026-69268 Microsoft Office SharePoint Remote Code Execution Vulnerability
- CVE-2026-69267 Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability
- CVE-2026-69266 Windows DHCP Server Remote Code Execution Vulnerability
- CVE-2026-69265 Windows NTFS Elevation of Privilege Vulnerability
- CVE-2026-69264 Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation
- CVE-2026-69263 Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
- CVE-2026-69262 Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type
- CVE-2026-69259 Flowise RCE via SQLite Record Manager Node
- CVE-2026-69258 Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API
- CVE-2026-69257 Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses
- CVE-2026-69256 Flowise: Remote Code Execution Vulnerability in CSVAgent
- CVE-2026-69255 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified
- CVE-2026-69254 Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override
- CVE-2026-69253 Flowise Sandbox Escape to RCE
- CVE-2026-69252 Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization
- CVE-2026-69251 Flowise RCE via TypeORM DataSource
- CVE-2026-69250 Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration
- CVE-2026-6925 Multiple Vulnerabilities in IBM Concert Software
- CVE-2026-69249 python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
- CVE-2026-69248 python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
- CVE-2026-69247 cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
- CVE-2026-69246 Guzzle: Noncanonical host can bypass host-based checks
- CVE-2026-69245 Guzzle: Noncanonical cookie domain keeps subdomain scope
- CVE-2026-69244 AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
- CVE-2026-69243 AIOHTTP: HTTP request smuggling via WebSocket upgrade
- CVE-2026-69242 libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident write
- CVE-2026-69240 Sequelize: SQL Injection (Oracle DB)
- CVE-2026-6924 Weak entropy initialization in Silicon Labs Matter SiWx917 TinyCrypt path
- CVE-2026-69238 HTML injection vulnerability in Esri Portal for ArcGIS
- CVE-2026-69237 HTML injection vulnerability in Esri Portal for ArcGIS
- CVE-2026-69236 stored cross site scripting issue in Esri Portal for ArcGIS
- CVE-2026-69235 stored cross site scripting issue in Esri Portal for ArcGIS
- CVE-2026-69234 reflected cross site scripting vulnerability in Esri Portal for ArcGIS
- CVE-2026-69233 stored cross site scripting issue in Esri Portal for ArcGIS
- CVE-2026-69232 stored cross site scripting issue in Esri Portal for ArcGIS
- CVE-2026-69231 stored cross site scripting issue in Esri Portal for ArcGIS
- CVE-2026-69230 stored cross site scripting issue in Esri Portal for ArcGIS
- CVE-2026-6923 Nuvoton - CWE-1300: Improper Protection of Physical Side Channels
- CVE-2026-69229 HTML injection vulnerability in Esri Portal for ArcGIS