# Vulnerabilities published in 2026


- [CVE-2026-68844](https://insights.sbomify.com/CVE-2026-68844/): Windows Storage Spaces Controller Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68843](https://insights.sbomify.com/CVE-2026-68843/): Microsoft Office Word Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-68842](https://insights.sbomify.com/CVE-2026-68842/): Windows MIDI Service Module Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-68841](https://insights.sbomify.com/CVE-2026-68841/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-68840](https://insights.sbomify.com/CVE-2026-68840/): Windows USB Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-68839](https://insights.sbomify.com/CVE-2026-68839/): Windows USB Mass Storage Class Driver Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-68838](https://insights.sbomify.com/CVE-2026-68838/): Windows NTFS Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2026-68837](https://insights.sbomify.com/CVE-2026-68837/): Windows File History Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-68836](https://insights.sbomify.com/CVE-2026-68836/): Windows kernel32.dll Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-68835](https://insights.sbomify.com/CVE-2026-68835/): Windows Print Spooler Components Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2026-68834](https://insights.sbomify.com/CVE-2026-68834/): Windows NTFS Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2026-68833](https://insights.sbomify.com/CVE-2026-68833/): Windows NTFS Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2026-68832](https://insights.sbomify.com/CVE-2026-68832/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-68831](https://insights.sbomify.com/CVE-2026-68831/): Windows Defender Firewall Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-68830](https://insights.sbomify.com/CVE-2026-68830/): Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-6883](https://insights.sbomify.com/CVE-2026-6883/): Missing Authorization in GitLab (low 2.6)
- [CVE-2026-68828](https://insights.sbomify.com/CVE-2026-68828/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-68827](https://insights.sbomify.com/CVE-2026-68827/): Windows GDI+ Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2026-68825](https://insights.sbomify.com/CVE-2026-68825/): Windows Bind Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-68824](https://insights.sbomify.com/CVE-2026-68824/): Connected User Experiences and Telemetry Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-68823](https://insights.sbomify.com/CVE-2026-68823/): Azure Confidential Ledger Remote Code Execution Vulnerability (critical 9.1)
- [CVE-2026-68821](https://insights.sbomify.com/CVE-2026-68821/): Windows Package Manager Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2026-68820](https://insights.sbomify.com/CVE-2026-68820/): Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free (high 7.0, exploited in the wild)
- [CVE-2026-68819](https://insights.sbomify.com/CVE-2026-68819/): Windows Network File System Denial of Service Vulnerability (medium 5.9)
- [CVE-2026-68817](https://insights.sbomify.com/CVE-2026-68817/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68816](https://insights.sbomify.com/CVE-2026-68816/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68815](https://insights.sbomify.com/CVE-2026-68815/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68814](https://insights.sbomify.com/CVE-2026-68814/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68813](https://insights.sbomify.com/CVE-2026-68813/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-68812](https://insights.sbomify.com/CVE-2026-68812/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68811](https://insights.sbomify.com/CVE-2026-68811/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68810](https://insights.sbomify.com/CVE-2026-68810/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-6881](https://insights.sbomify.com/CVE-2026-6881/): SQL injection in Advance Web (critical 9.4)
- [CVE-2026-68809](https://insights.sbomify.com/CVE-2026-68809/): Powerpoint Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-68808](https://insights.sbomify.com/CVE-2026-68808/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-68807](https://insights.sbomify.com/CVE-2026-68807/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68806](https://insights.sbomify.com/CVE-2026-68806/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68805](https://insights.sbomify.com/CVE-2026-68805/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68804](https://insights.sbomify.com/CVE-2026-68804/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68803](https://insights.sbomify.com/CVE-2026-68803/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68802](https://insights.sbomify.com/CVE-2026-68802/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-68801](https://insights.sbomify.com/CVE-2026-68801/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68800](https://insights.sbomify.com/CVE-2026-68800/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68799](https://insights.sbomify.com/CVE-2026-68799/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-68798](https://insights.sbomify.com/CVE-2026-68798/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68797](https://insights.sbomify.com/CVE-2026-68797/): Microsoft Excel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-68796](https://insights.sbomify.com/CVE-2026-68796/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68795](https://insights.sbomify.com/CVE-2026-68795/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68794](https://insights.sbomify.com/CVE-2026-68794/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68793](https://insights.sbomify.com/CVE-2026-68793/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68792](https://insights.sbomify.com/CVE-2026-68792/): Microsoft Office Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-68791](https://insights.sbomify.com/CVE-2026-68791/): Azure Machine Learning Information Disclosure Vulnerability (high 8.6)
- [CVE-2026-6879](https://insights.sbomify.com/CVE-2026-6879/): Quadratic Behavior in xml.etree.ElementPath Index Predicates (low 2.0)
- [CVE-2026-68789](https://insights.sbomify.com/CVE-2026-68789/): Azure SQL Database Elevation of Privilege Vulnerability (critical 9.9)
- [CVE-2026-68787](https://insights.sbomify.com/CVE-2026-68787/): Microsoft SQL Server Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-68786](https://insights.sbomify.com/CVE-2026-68786/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-68785](https://insights.sbomify.com/CVE-2026-68785/): Microsoft SQL Server Remote Code Execution Vulnerability (medium 4.9)
- [CVE-2026-68784](https://insights.sbomify.com/CVE-2026-68784/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-68782](https://insights.sbomify.com/CVE-2026-68782/): Azure SQL Database Elevation of Privilege Vulnerability (critical 9.9)
- [CVE-2026-68781](https://insights.sbomify.com/CVE-2026-68781/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-68780](https://insights.sbomify.com/CVE-2026-68780/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-6878](https://insights.sbomify.com/CVE-2026-6878/): ByteDance verl grader.py math_equal sandbox (medium 6.3)
- [CVE-2026-68779](https://insights.sbomify.com/CVE-2026-68779/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-68778](https://insights.sbomify.com/CVE-2026-68778/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-68777](https://insights.sbomify.com/CVE-2026-68777/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-68776](https://insights.sbomify.com/CVE-2026-68776/): Microsoft SQL Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-68775](https://insights.sbomify.com/CVE-2026-68775/): Microsoft SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-68772](https://insights.sbomify.com/CVE-2026-68772/): ZenML 0.94.6 Remote Code Execution via CloudpickleMaterializer (high 8.5)
- [CVE-2026-68771](https://insights.sbomify.com/CVE-2026-68771/): ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization (critical 9.3)
- [CVE-2026-68770](https://insights.sbomify.com/CVE-2026-68770/): sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False (critical 9.3)
- [CVE-2026-6877](https://insights.sbomify.com/CVE-2026-6877/): Domain Separation Bypass in ServiceNow AI Platform (medium 5.3)
- [CVE-2026-68768](https://insights.sbomify.com/CVE-2026-68768/): hashcat through 7.1.2 Heap Buffer Overflow in outfile_write() via Oversized Username (medium 6.9)
- [CVE-2026-68767](https://insights.sbomify.com/CVE-2026-68767/): hashcat through 7.1.2 Off-by-One Out-of-Bounds Heap Write in fgetl() (medium 6.9)
- [CVE-2026-68766](https://insights.sbomify.com/CVE-2026-68766/): hashcat through 7.1.2 Arbitrary File Write via Restore File Option Injection (high 8.5)
- [CVE-2026-68765](https://insights.sbomify.com/CVE-2026-68765/): hashcat KeePass KDBX v4 Module Heap Buffer Overflow via Token Field (medium 5.2)
- [CVE-2026-68763](https://insights.sbomify.com/CVE-2026-68763/): Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is reset (high 7.5)
- [CVE-2026-68762](https://insights.sbomify.com/CVE-2026-68762/): Denial of service in Ktor (medium 5.9)
- [CVE-2026-68760](https://insights.sbomify.com/CVE-2026-68760/): Potential remember-me authentication bypass in JFrog Artifactory (medium 5.3)
- [CVE-2026-6876](https://insights.sbomify.com/CVE-2026-6876/): Sandbox Escape in ServiceNow AI Platform (critical 10.0)
- [CVE-2026-68759](https://insights.sbomify.com/CVE-2026-68759/): Integration credential holders may impersonate users in JFrog Access (high 7.2)
- [CVE-2026-68758](https://insights.sbomify.com/CVE-2026-68758/): Authenticated users may access restricted Artifactory support information (medium 6.5)
- [CVE-2026-68757](https://insights.sbomify.com/CVE-2026-68757/): Potential improper SAML signature verification in JFrog Artifactory (high 7.5)
- [CVE-2026-68756](https://insights.sbomify.com/CVE-2026-68756/): Potential insecure deserialization in JFrog Artifactory (medium 6.6)
- [CVE-2026-68755](https://insights.sbomify.com/CVE-2026-68755/): Bundle writers may alter trusted release information in JFrog Artifactory (medium 4.3)
- [CVE-2026-68754](https://insights.sbomify.com/CVE-2026-68754/): Publishers without delete permission can overwrite docker layer information (medium 6.5)
- [CVE-2026-68753](https://insights.sbomify.com/CVE-2026-68753/): Anonymous users may access restricted Artifactory content under specific configurations (medium 5.3)
- [CVE-2026-68752](https://insights.sbomify.com/CVE-2026-68752/): Project Resource Managers may escalate privileges in JFrog Artifactory (high 7.2)
- [CVE-2026-68750](https://insights.sbomify.com/CVE-2026-68750/): Quadratic sibling re-flattening in the html_sanitize_ex traversal engine allows CPU-exhaustion denial of service (high 8.2)
- [CVE-2026-6875](https://insights.sbomify.com/CVE-2026-6875/): Sandbox Escape in ServiceNow AI Platform (critical 9.5)
- [CVE-2026-68749](https://insights.sbomify.com/CVE-2026-68749/): Quadratic regex backtracking in the html_sanitize_ex CSS scrubber allows CPU-exhaustion denial of service (high 8.2)
- [CVE-2026-68747](https://insights.sbomify.com/CVE-2026-68747/): CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input (low 2.3)
- [CVE-2026-68746](https://insights.sbomify.com/CVE-2026-68746/): Livebook Teams identity check fails open when the deployment group is unresolvable, allowing unauthenticated access (high 7.7)
- [CVE-2026-68745](https://insights.sbomify.com/CVE-2026-68745/): Apache CloudStack: SAML2 Signature Validation Silently Skipped for Cert-less IdP (high 8.1)
- [CVE-2026-68744](https://insights.sbomify.com/CVE-2026-68744/): Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply (low 3.3)
- [CVE-2026-68743](https://insights.sbomify.com/CVE-2026-68743/): Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1 (medium 5.5)
- [CVE-2026-68742](https://insights.sbomify.com/CVE-2026-68742/): Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr (medium 5.5)
- [CVE-2026-6874](https://insights.sbomify.com/CVE-2026-6874/): ericc-ch copilot-api Header token dns rebinding (medium 5.3)
- [CVE-2026-6873](https://insights.sbomify.com/CVE-2026-6873/): Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie (low 2.3)
- [CVE-2026-6871](https://insights.sbomify.com/CVE-2026-6871/): Obfuscate - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-033 (medium 6.1)
- [CVE-2026-6870](https://insights.sbomify.com/CVE-2026-6870/): Access of Uninitialized Pointer in Wireshark (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/441/