# Vulnerabilities published in 2026


- [CVE-2026-69326](https://insights.sbomify.com/CVE-2026-69326/): Graphic Fonts Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-69325](https://insights.sbomify.com/CVE-2026-69325/): Microsoft JScript Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-69324](https://insights.sbomify.com/CVE-2026-69324/): Windows Performance Monitor Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69323](https://insights.sbomify.com/CVE-2026-69323/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69322](https://insights.sbomify.com/CVE-2026-69322/): Microsoft Windows Search Component Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2026-69321](https://insights.sbomify.com/CVE-2026-69321/): Windows Power Dependency Coordinator Tampering Vulnerability (medium 5.5)
- [CVE-2026-69320](https://insights.sbomify.com/CVE-2026-69320/): Visual Studio Code Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-6932](https://insights.sbomify.com/CVE-2026-6932/): Woo Commerce Minimum Weight <= 3.0.1 - Cross-Site Request Forgery via Settings Update Form (medium 4.3)
- [CVE-2026-69319](https://insights.sbomify.com/CVE-2026-69319/): Windows USB Video Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-69318](https://insights.sbomify.com/CVE-2026-69318/): Windows Imaging Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-69317](https://insights.sbomify.com/CVE-2026-69317/): Windows Remote Desktop Client Information Disclosure Vulnerability (medium 5.7)
- [CVE-2026-69316](https://insights.sbomify.com/CVE-2026-69316/): Windows Overlay Filter Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-69315](https://insights.sbomify.com/CVE-2026-69315/): Windows License Manager Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-69314](https://insights.sbomify.com/CVE-2026-69314/): Windows Device Association Broker Service Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2026-69313](https://insights.sbomify.com/CVE-2026-69313/): Microsoft Standard XPS Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2026-69312](https://insights.sbomify.com/CVE-2026-69312/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69311](https://insights.sbomify.com/CVE-2026-69311/): Windows Audio Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-69310](https://insights.sbomify.com/CVE-2026-69310/): Windows DNS Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-69309](https://insights.sbomify.com/CVE-2026-69309/): Windows Print Spooler Components Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-69308](https://insights.sbomify.com/CVE-2026-69308/): Microsoft Standard XPS Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-69307](https://insights.sbomify.com/CVE-2026-69307/): Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69306](https://insights.sbomify.com/CVE-2026-69306/): Visual Studio Code Security Feature Bypass Vulnerability (high 8.2)
- [CVE-2026-69305](https://insights.sbomify.com/CVE-2026-69305/): Microsoft Windows Search Component Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2026-69304](https://insights.sbomify.com/CVE-2026-69304/): ASP.NET Core Denial of Service Vulnerability (medium 5.9)
- [CVE-2026-69303](https://insights.sbomify.com/CVE-2026-69303/): Push Message Routing Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-69301](https://insights.sbomify.com/CVE-2026-69301/): Windows Win32k Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2026-69300](https://insights.sbomify.com/CVE-2026-69300/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-6930](https://insights.sbomify.com/CVE-2026-6930/): IBM Concert Software Risky Cryptographic Algorithm (low 3.7)
- [CVE-2026-69299](https://insights.sbomify.com/CVE-2026-69299/): Microsoft COM for Windows Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-69298](https://insights.sbomify.com/CVE-2026-69298/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69297](https://insights.sbomify.com/CVE-2026-69297/): Windows DHCP Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-69296](https://insights.sbomify.com/CVE-2026-69296/): Windows Device Association Service Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2026-69295](https://insights.sbomify.com/CVE-2026-69295/): Windows USB Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69294](https://insights.sbomify.com/CVE-2026-69294/): Microsoft COM for Windows Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-69293](https://insights.sbomify.com/CVE-2026-69293/): Windows Biometric Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69292](https://insights.sbomify.com/CVE-2026-69292/): Remote Desktop Gateway Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-69291](https://insights.sbomify.com/CVE-2026-69291/): Windows Volume Manager Extension Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-69290](https://insights.sbomify.com/CVE-2026-69290/): Windows Storage Spaces Controller Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-6929](https://insights.sbomify.com/CVE-2026-6929/): JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter (high 7.5)
- [CVE-2026-69289](https://insights.sbomify.com/CVE-2026-69289/): Windows Setup Files Cleanup Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69288](https://insights.sbomify.com/CVE-2026-69288/): Windows GDI+ Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-69287](https://insights.sbomify.com/CVE-2026-69287/): Windows Remote Desktop Services Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-69286](https://insights.sbomify.com/CVE-2026-69286/): Windows USB Audio Class Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-69285](https://insights.sbomify.com/CVE-2026-69285/): Microsoft Office Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-69284](https://insights.sbomify.com/CVE-2026-69284/): Windows DCOM Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69283](https://insights.sbomify.com/CVE-2026-69283/): Windows CD-ROM Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69282](https://insights.sbomify.com/CVE-2026-69282/): Microsoft Office SharePoint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-69281](https://insights.sbomify.com/CVE-2026-69281/): Windows License Manager Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-69280](https://insights.sbomify.com/CVE-2026-69280/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-6928](https://insights.sbomify.com/CVE-2026-6928/): Multiple Vulnerabilities in IBM Concert Software (critical 9.8)
- [CVE-2026-69279](https://insights.sbomify.com/CVE-2026-69279/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-69278](https://insights.sbomify.com/CVE-2026-69278/): Visual Studio Code Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2026-69277](https://insights.sbomify.com/CVE-2026-69277/): Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69276](https://insights.sbomify.com/CVE-2026-69276/): Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-69275](https://insights.sbomify.com/CVE-2026-69275/): Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-69274](https://insights.sbomify.com/CVE-2026-69274/): Windows Win32k Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2026-69273](https://insights.sbomify.com/CVE-2026-69273/): Microsoft Office SharePoint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-69272](https://insights.sbomify.com/CVE-2026-69272/): Microsoft Standard XPS Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2026-69271](https://insights.sbomify.com/CVE-2026-69271/): Microsoft Standard XPS Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2026-69270](https://insights.sbomify.com/CVE-2026-69270/): Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69269](https://insights.sbomify.com/CVE-2026-69269/): Microsoft Standard XPS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69268](https://insights.sbomify.com/CVE-2026-69268/): Microsoft Office SharePoint Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-69267](https://insights.sbomify.com/CVE-2026-69267/): Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-69266](https://insights.sbomify.com/CVE-2026-69266/): Windows DHCP Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-69265](https://insights.sbomify.com/CVE-2026-69265/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-69264](https://insights.sbomify.com/CVE-2026-69264/): Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation (critical 9.4)
- [CVE-2026-69263](https://insights.sbomify.com/CVE-2026-69263/): Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE) (high 8.7)
- [CVE-2026-69262](https://insights.sbomify.com/CVE-2026-69262/): Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type (high 7.1)
- [CVE-2026-69259](https://insights.sbomify.com/CVE-2026-69259/): Flowise RCE via SQLite Record Manager Node (critical 9.4)
- [CVE-2026-69258](https://insights.sbomify.com/CVE-2026-69258/): Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API (high 8.8)
- [CVE-2026-69257](https://insights.sbomify.com/CVE-2026-69257/): Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses (high 7.6)
- [CVE-2026-69256](https://insights.sbomify.com/CVE-2026-69256/): Flowise: Remote Code Execution Vulnerability in CSVAgent (critical 9.4)
- [CVE-2026-69255](https://insights.sbomify.com/CVE-2026-69255/): Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified (critical 9.2)
- [CVE-2026-69254](https://insights.sbomify.com/CVE-2026-69254/): Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override (critical 9.4)
- [CVE-2026-69253](https://insights.sbomify.com/CVE-2026-69253/): Flowise Sandbox Escape to RCE (critical 9.0)
- [CVE-2026-69252](https://insights.sbomify.com/CVE-2026-69252/): Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization (high 7.2)
- [CVE-2026-69251](https://insights.sbomify.com/CVE-2026-69251/): Flowise RCE via TypeORM DataSource (critical 9.0)
- [CVE-2026-69250](https://insights.sbomify.com/CVE-2026-69250/): Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration (high 8.5)
- [CVE-2026-6925](https://insights.sbomify.com/CVE-2026-6925/): Multiple Vulnerabilities in IBM Concert Software (medium 5.3)
- [CVE-2026-69249](https://insights.sbomify.com/CVE-2026-69249/): python-cryptography: Duplicate self-signed intermediates can cause exponential path-building (high 8.7)
- [CVE-2026-69248](https://insights.sbomify.com/CVE-2026-69248/): python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees (medium 6.9)
- [CVE-2026-69247](https://insights.sbomify.com/CVE-2026-69247/): cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing (high 8.2)
- [CVE-2026-69246](https://insights.sbomify.com/CVE-2026-69246/): Guzzle: Noncanonical host can bypass host-based checks (high 7.2)
- [CVE-2026-69245](https://insights.sbomify.com/CVE-2026-69245/): Guzzle: Noncanonical cookie domain keeps subdomain scope (medium 6.5)
- [CVE-2026-69244](https://insights.sbomify.com/CVE-2026-69244/): AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response) (high 7.1)
- [CVE-2026-69243](https://insights.sbomify.com/CVE-2026-69243/): AIOHTTP: HTTP request smuggling via WebSocket upgrade (medium 6.3)
- [CVE-2026-69242](https://insights.sbomify.com/CVE-2026-69242/): libvips: Integer overflow leading to heap buffer overflow leading to possible attacker-controlled mmap-resident write (high 8.4)
- [CVE-2026-69240](https://insights.sbomify.com/CVE-2026-69240/): Sequelize: SQL Injection (Oracle DB) (critical 9.8)
- [CVE-2026-6924](https://insights.sbomify.com/CVE-2026-6924/): Weak entropy initialization in Silicon Labs Matter SiWx917 TinyCrypt path (high 8.7)
- [CVE-2026-69238](https://insights.sbomify.com/CVE-2026-69238/): HTML injection vulnerability in Esri Portal for ArcGIS (low 3.5)
- [CVE-2026-69237](https://insights.sbomify.com/CVE-2026-69237/): HTML injection vulnerability in Esri Portal for ArcGIS (low 3.8)
- [CVE-2026-69236](https://insights.sbomify.com/CVE-2026-69236/): stored cross site scripting issue in Esri Portal for ArcGIS (medium 6.1)
- [CVE-2026-69235](https://insights.sbomify.com/CVE-2026-69235/): stored cross site scripting issue in Esri Portal for ArcGIS (medium 6.1)
- [CVE-2026-69234](https://insights.sbomify.com/CVE-2026-69234/): reflected cross site scripting vulnerability in Esri Portal for ArcGIS (medium 6.1)
- [CVE-2026-69233](https://insights.sbomify.com/CVE-2026-69233/): stored cross site scripting issue in Esri Portal for ArcGIS (medium 5.5)
- [CVE-2026-69232](https://insights.sbomify.com/CVE-2026-69232/): stored cross site scripting issue in Esri Portal for ArcGIS (medium 5.5)
- [CVE-2026-69231](https://insights.sbomify.com/CVE-2026-69231/): stored cross site scripting issue in Esri Portal for ArcGIS (medium 5.5)
- [CVE-2026-69230](https://insights.sbomify.com/CVE-2026-69230/): stored cross site scripting issue in Esri Portal for ArcGIS (medium 5.5)
- [CVE-2026-6923](https://insights.sbomify.com/CVE-2026-6923/): Nuvoton - CWE-1300: Improper Protection of Physical Side Channels (low 3.8)
- [CVE-2026-69229](https://insights.sbomify.com/CVE-2026-69229/): HTML injection vulnerability in Esri Portal for ArcGIS (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/438/