# Vulnerabilities published in 2026


- [CVE-2026-62895](https://insights.sbomify.com/CVE-2026-62895/): Azure Arc SQL Server Extension Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-62894](https://insights.sbomify.com/CVE-2026-62894/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62893](https://insights.sbomify.com/CVE-2026-62893/): Windows Deployment Services TFTP Server Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-62892](https://insights.sbomify.com/CVE-2026-62892/): Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62890](https://insights.sbomify.com/CVE-2026-62890/): Windows GDI+ Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62889](https://insights.sbomify.com/CVE-2026-62889/): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-62888](https://insights.sbomify.com/CVE-2026-62888/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62887](https://insights.sbomify.com/CVE-2026-62887/): Windows NTFS Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62886](https://insights.sbomify.com/CVE-2026-62886/): .NET Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62885](https://insights.sbomify.com/CVE-2026-62885/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62883](https://insights.sbomify.com/CVE-2026-62883/): Windows DNS Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-62882](https://insights.sbomify.com/CVE-2026-62882/): Microsoft Outlook Spoofing Vulnerability (medium 4.3)
- [CVE-2026-62881](https://insights.sbomify.com/CVE-2026-62881/): Windows DNS Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-62880](https://insights.sbomify.com/CVE-2026-62880/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62879](https://insights.sbomify.com/CVE-2026-62879/): Windows SmartScreen Tampering Vulnerability (medium 5.5)
- [CVE-2026-62878](https://insights.sbomify.com/CVE-2026-62878/): Windows DNS Server Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-62877](https://insights.sbomify.com/CVE-2026-62877/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62876](https://insights.sbomify.com/CVE-2026-62876/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62874](https://insights.sbomify.com/CVE-2026-62874/): Azure Billing Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-62873](https://insights.sbomify.com/CVE-2026-62873/): Microsoft 365 Admin Center Elevation of Privilege Vulnerability (critical 9.8)
- [CVE-2026-62872](https://insights.sbomify.com/CVE-2026-62872/): .NET Framework Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-62871](https://insights.sbomify.com/CVE-2026-62871/): .NET Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62870](https://insights.sbomify.com/CVE-2026-62870/): Microsoft Excel Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-6287](https://insights.sbomify.com/CVE-2026-6287/): Cross-site scripting in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (medium 5.4)
- [CVE-2026-62869](https://insights.sbomify.com/CVE-2026-62869/): Azure Entra ID Spoofing Vulnerability (high 8.8)
- [CVE-2026-62867](https://insights.sbomify.com/CVE-2026-62867/): Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution (critical 9.9)
- [CVE-2026-62866](https://insights.sbomify.com/CVE-2026-62866/): Dasel: Selector lexer panics on trailing whitespace in `parseCurRune` (medium 6.2)
- [CVE-2026-62865](https://insights.sbomify.com/CVE-2026-62865/): TypeBot: Arbitrary server file read via Send Email block attachment path (high 8.7)
- [CVE-2026-62862](https://insights.sbomify.com/CVE-2026-62862/): TypeBot: Account takeover via brute-forceable 6-digit magic-link code (critical 9.1)
- [CVE-2026-62861](https://insights.sbomify.com/CVE-2026-62861/): TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain (medium 6.4)
- [CVE-2026-6286](https://insights.sbomify.com/CVE-2026-6286/): Cross-site scripting in Booking for Appointments and Events Calendar – Amelia (high 7.2)
- [CVE-2026-62858](https://insights.sbomify.com/CVE-2026-62858/): YOURLS: Unauthenticated File Inclusion (medium 5.3)
- [CVE-2026-62857](https://insights.sbomify.com/CVE-2026-62857/): Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources (high 8.8)
- [CVE-2026-6285](https://insights.sbomify.com/CVE-2026-6285/): Improper Authentication in Ankaref's LIBRID/LIBREF (high 7.5)
- [CVE-2026-62845](https://insights.sbomify.com/CVE-2026-62845/): Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers (medium 4.7)
- [CVE-2026-62843](https://insights.sbomify.com/CVE-2026-62843/): File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) (medium 6.8)
- [CVE-2026-62842](https://insights.sbomify.com/CVE-2026-62842/): Microsoft Office Graphics Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62840](https://insights.sbomify.com/CVE-2026-62840/): Linux Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-6284](https://insights.sbomify.com/CVE-2026-6284/): Horner Automation Cscape and XL4, XL7 PLC Weak password requirements (critical 9.3)
- [CVE-2026-62839](https://insights.sbomify.com/CVE-2026-62839/): Microsoft SharePoint Server Spoofing Vulnerability (medium 6.5)
- [CVE-2026-62837](https://insights.sbomify.com/CVE-2026-62837/): Microsoft SharePoint Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-62836](https://insights.sbomify.com/CVE-2026-62836/): Azure SQL Managed Instance Elevation of Privilege Vulnerability (high 8.7)
- [CVE-2026-62835](https://insights.sbomify.com/CVE-2026-62835/): Azure Portal Information Disclosure Vulnerability (critical 9.3)
- [CVE-2026-62834](https://insights.sbomify.com/CVE-2026-62834/): Azure Data Factory Elevation of Privilege Vulnerability (critical 9.3)
- [CVE-2026-62832](https://insights.sbomify.com/CVE-2026-62832/): Windows User Profile Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62830](https://insights.sbomify.com/CVE-2026-62830/): Azure SRE Agent Elevation of Privilege Vulnerability (critical 9.9)
- [CVE-2026-6283](https://insights.sbomify.com/CVE-2026-6283/): Stored XSS in DivvyDrive Information Technologies' DivvyDrive (medium 5.4)
- [CVE-2026-62829](https://insights.sbomify.com/CVE-2026-62829/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-62828](https://insights.sbomify.com/CVE-2026-62828/): Microsoft Edge for Android (Chromium-based) Tampering Vulnerability (medium 5.4)
- [CVE-2026-62827](https://insights.sbomify.com/CVE-2026-62827/): Microsoft SharePoint Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-62826](https://insights.sbomify.com/CVE-2026-62826/): Microsoft SharePoint Server Spoofing Vulnerability (medium 4.6)
- [CVE-2026-62825](https://insights.sbomify.com/CVE-2026-62825/): Azure Key Vault Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-62824](https://insights.sbomify.com/CVE-2026-62824/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62823](https://insights.sbomify.com/CVE-2026-62823/): Windows DHCP Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62822](https://insights.sbomify.com/CVE-2026-62822/): Windows GDI+ Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62820](https://insights.sbomify.com/CVE-2026-62820/): Windows DNS Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-6282](https://insights.sbomify.com/CVE-2026-6282/): Path traversal in Home Storage Hub T20 (high 8.6)
- [CVE-2026-62819](https://insights.sbomify.com/CVE-2026-62819/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-62818](https://insights.sbomify.com/CVE-2026-62818/): Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62817](https://insights.sbomify.com/CVE-2026-62817/): Windows DNS Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62816](https://insights.sbomify.com/CVE-2026-62816/): Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62815](https://insights.sbomify.com/CVE-2026-62815/): Microsoft QUIC Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-62814](https://insights.sbomify.com/CVE-2026-62814/): Windows DHCP Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-62813](https://insights.sbomify.com/CVE-2026-62813/): Windows Active Directory Domain Services Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-62812](https://insights.sbomify.com/CVE-2026-62812/): Windows DHCP Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62811](https://insights.sbomify.com/CVE-2026-62811/): Windows HTTP.sys Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62810](https://insights.sbomify.com/CVE-2026-62810/): Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-6281](https://insights.sbomify.com/CVE-2026-6281/): Command injection in Home Storage Hub T20 (high 8.7)
- [CVE-2026-62807](https://insights.sbomify.com/CVE-2026-62807/): Windows DHCP Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62804](https://insights.sbomify.com/CVE-2026-62804/): Microsoft Word Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-62803](https://insights.sbomify.com/CVE-2026-62803/): Windows DHCP Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62801](https://insights.sbomify.com/CVE-2026-62801/): Microsoft PowerShell Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2026-62800](https://insights.sbomify.com/CVE-2026-62800/): Windows SMBv3 Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-6280](https://insights.sbomify.com/CVE-2026-6280/): Improper Access Control in Nomysoft Informatics' Nomysem (medium 6.5)
- [CVE-2026-62799](https://insights.sbomify.com/CVE-2026-62799/): Windows SMB Client Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62798](https://insights.sbomify.com/CVE-2026-62798/): Win32k Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62797](https://insights.sbomify.com/CVE-2026-62797/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62796](https://insights.sbomify.com/CVE-2026-62796/): Windows NTFS Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62795](https://insights.sbomify.com/CVE-2026-62795/): Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62793](https://insights.sbomify.com/CVE-2026-62793/): Windows NTFS Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62792](https://insights.sbomify.com/CVE-2026-62792/): Windows TCP/IP Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-62790](https://insights.sbomify.com/CVE-2026-62790/): Windows SMBv3 Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-6279](https://insights.sbomify.com/CVE-2026-6279/): Code injection in Avada (Fusion) Builder (critical 9.8)
- [CVE-2026-62788](https://insights.sbomify.com/CVE-2026-62788/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62787](https://insights.sbomify.com/CVE-2026-62787/): Windows DNS Server Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-62786](https://insights.sbomify.com/CVE-2026-62786/): Win32k Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62785](https://insights.sbomify.com/CVE-2026-62785/): Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62784](https://insights.sbomify.com/CVE-2026-62784/): Microsoft Local Security Authority Server (lsasrv) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62783](https://insights.sbomify.com/CVE-2026-62783/): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62782](https://insights.sbomify.com/CVE-2026-62782/): Windows SMB Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-62781](https://insights.sbomify.com/CVE-2026-62781/): RPC Runtime Library Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-62780](https://insights.sbomify.com/CVE-2026-62780/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62779](https://insights.sbomify.com/CVE-2026-62779/): Windows Schannel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62778](https://insights.sbomify.com/CVE-2026-62778/): Windows DNS Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2026-62777](https://insights.sbomify.com/CVE-2026-62777/): Windows License Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62776](https://insights.sbomify.com/CVE-2026-62776/): Windows DHCP Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62775](https://insights.sbomify.com/CVE-2026-62775/): Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62774](https://insights.sbomify.com/CVE-2026-62774/): Windows Graphics Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62773](https://insights.sbomify.com/CVE-2026-62773/): Windows Kerberos Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62772](https://insights.sbomify.com/CVE-2026-62772/): Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/483/