# Vulnerabilities published in 2026


- [CVE-2026-62771](https://insights.sbomify.com/CVE-2026-62771/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62770](https://insights.sbomify.com/CVE-2026-62770/): Windows Shell Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-6277](https://insights.sbomify.com/CVE-2026-6277/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2026-62769](https://insights.sbomify.com/CVE-2026-62769/): Windows DNS Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2026-62768](https://insights.sbomify.com/CVE-2026-62768/): Windows Installer Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62766](https://insights.sbomify.com/CVE-2026-62766/): Windows Kerberos Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62765](https://insights.sbomify.com/CVE-2026-62765/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-62764](https://insights.sbomify.com/CVE-2026-62764/): Apache Accumulo: A user can trigger a graceful shutdown of services without the relevant system permissions (medium 5.7)
- [CVE-2026-62762](https://insights.sbomify.com/CVE-2026-62762/): Windows Active Directory Domain Services Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-62761](https://insights.sbomify.com/CVE-2026-62761/): Windows DHCP Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-6276](https://insights.sbomify.com/CVE-2026-6276/): stale custom cookie host causes cookie leak (high 7.5)
- [CVE-2026-62759](https://insights.sbomify.com/CVE-2026-62759/): Windows Netlogon Spoofing Vulnerability (high 7.5)
- [CVE-2026-62758](https://insights.sbomify.com/CVE-2026-62758/): Windows Remote Access Connection Manager Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62757](https://insights.sbomify.com/CVE-2026-62757/): Windows Schannel Security Feature Bypass Vulnerability (medium 5.3)
- [CVE-2026-62755](https://insights.sbomify.com/CVE-2026-62755/): Windows DHCP Client Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62754](https://insights.sbomify.com/CVE-2026-62754/): Windows Kerberos Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62753](https://insights.sbomify.com/CVE-2026-62753/): Windows HTTP.sys Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62752](https://insights.sbomify.com/CVE-2026-62752/): Windows Kerberos Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62751](https://insights.sbomify.com/CVE-2026-62751/): Windows Projected File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62750](https://insights.sbomify.com/CVE-2026-62750/): Windows HTTP Protocol Stack Tampering Vulnerability (medium 6.5)
- [CVE-2026-6275](https://insights.sbomify.com/CVE-2026-6275/): StatCounter <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname (medium 6.4)
- [CVE-2026-62749](https://insights.sbomify.com/CVE-2026-62749/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62748](https://insights.sbomify.com/CVE-2026-62748/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62747](https://insights.sbomify.com/CVE-2026-62747/): Windows Device Association Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62746](https://insights.sbomify.com/CVE-2026-62746/): Win32k Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62745](https://insights.sbomify.com/CVE-2026-62745/): Windows DHCP Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-62744](https://insights.sbomify.com/CVE-2026-62744/): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62743](https://insights.sbomify.com/CVE-2026-62743/): Win32k Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62742](https://insights.sbomify.com/CVE-2026-62742/): Windows DHCP Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-62741](https://insights.sbomify.com/CVE-2026-62741/): Windows HTTP.sys Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62740](https://insights.sbomify.com/CVE-2026-62740/): Windows Imaging Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-6274](https://insights.sbomify.com/CVE-2026-6274/): Authentication Bypass in DTS Electronics' Redline WR3200 (critical 9.8)
- [CVE-2026-62739](https://insights.sbomify.com/CVE-2026-62739/): Windows HTTP.sys Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62738](https://insights.sbomify.com/CVE-2026-62738/): Windows Management Instrumentation Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62737](https://insights.sbomify.com/CVE-2026-62737/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62736](https://insights.sbomify.com/CVE-2026-62736/): Windows DHCP Client Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62735](https://insights.sbomify.com/CVE-2026-62735/): Windows HTTP.sys Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62734](https://insights.sbomify.com/CVE-2026-62734/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62733](https://insights.sbomify.com/CVE-2026-62733/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62732](https://insights.sbomify.com/CVE-2026-62732/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62730](https://insights.sbomify.com/CVE-2026-62730/): Windows Wired AutoConfig Service Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62729](https://insights.sbomify.com/CVE-2026-62729/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62728](https://insights.sbomify.com/CVE-2026-62728/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62727](https://insights.sbomify.com/CVE-2026-62727/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62726](https://insights.sbomify.com/CVE-2026-62726/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62725](https://insights.sbomify.com/CVE-2026-62725/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62724](https://insights.sbomify.com/CVE-2026-62724/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62723](https://insights.sbomify.com/CVE-2026-62723/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62722](https://insights.sbomify.com/CVE-2026-62722/): Microsoft Brokering File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62721](https://insights.sbomify.com/CVE-2026-62721/): Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62720](https://insights.sbomify.com/CVE-2026-62720/): Windows DHCP Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-6272](https://insights.sbomify.com/CVE-2026-6272/): Missing authorization in Eclipse KUKSA - Databroker (high 8.5)
- [CVE-2026-62719](https://insights.sbomify.com/CVE-2026-62719/): Windows Message Queuing Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62718](https://insights.sbomify.com/CVE-2026-62718/): Windows DHCP Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-62717](https://insights.sbomify.com/CVE-2026-62717/): Windows Message Queuing Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62716](https://insights.sbomify.com/CVE-2026-62716/): Windows DHCP Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-62715](https://insights.sbomify.com/CVE-2026-62715/): Windows DHCP Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-62714](https://insights.sbomify.com/CVE-2026-62714/): Windows DHCP Server Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-62713](https://insights.sbomify.com/CVE-2026-62713/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62712](https://insights.sbomify.com/CVE-2026-62712/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62711](https://insights.sbomify.com/CVE-2026-62711/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62710](https://insights.sbomify.com/CVE-2026-62710/): Windows Device Association Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-6271](https://insights.sbomify.com/CVE-2026-6271/): Career Section <= 1.7 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2026-62709](https://insights.sbomify.com/CVE-2026-62709/): Windows GDI+ Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62708](https://insights.sbomify.com/CVE-2026-62708/): Windows Kernel Elevation of Privilege Vulnerability (medium 6.4)
- [CVE-2026-62707](https://insights.sbomify.com/CVE-2026-62707/): Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62706](https://insights.sbomify.com/CVE-2026-62706/): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-62705](https://insights.sbomify.com/CVE-2026-62705/): Microsoft Brokering File System Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62703](https://insights.sbomify.com/CVE-2026-62703/): Windows DWM Core Library Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62702](https://insights.sbomify.com/CVE-2026-62702/): Windows Graphics Kernel Denial of Service Vulnerability (medium 6.8)
- [CVE-2026-62701](https://insights.sbomify.com/CVE-2026-62701/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62700](https://insights.sbomify.com/CVE-2026-62700/): Windows NTFS Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-6270](https://insights.sbomify.com/CVE-2026-6270/): @fastify/middie vulnerable to middleware authentication bypass in child plugin scopes (critical 9.1)
- [CVE-2026-62699](https://insights.sbomify.com/CVE-2026-62699/): Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2026-62698](https://insights.sbomify.com/CVE-2026-62698/): Microsoft Digest Authentication Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62697](https://insights.sbomify.com/CVE-2026-62697/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62696](https://insights.sbomify.com/CVE-2026-62696/): Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62695](https://insights.sbomify.com/CVE-2026-62695/): Windows Storage Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62694](https://insights.sbomify.com/CVE-2026-62694/): Windows Installer Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-62693](https://insights.sbomify.com/CVE-2026-62693/): Windows MIDI Service Module Elevation of Privileges Vulnerability (high 7.0)
- [CVE-2026-62692](https://insights.sbomify.com/CVE-2026-62692/): Windows Remote Desktop Services Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-62690](https://insights.sbomify.com/CVE-2026-62690/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-6269](https://insights.sbomify.com/CVE-2026-6269/): Incorrect Authorization in GitLab (medium 5.4)
- [CVE-2026-62688](https://insights.sbomify.com/CVE-2026-62688/): Windows MIDI Service Module Elevation of Privileges Vulnerability (high 7.8)
- [CVE-2026-62687](https://insights.sbomify.com/CVE-2026-62687/): Windows Backup Engine Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-62685](https://insights.sbomify.com/CVE-2026-62685/): File Browser: Colliding username normalization gives two users the same home directory (high 8.1)
- [CVE-2026-62684](https://insights.sbomify.com/CVE-2026-62684/): File Browser: Share API exposes the password hash and bypass token (low 2.7)
- [CVE-2026-62683](https://insights.sbomify.com/CVE-2026-62683/): File Browser: Trailing-slash delete leaves a stale public share behind (low 3.1)
- [CVE-2026-62682](https://insights.sbomify.com/CVE-2026-62682/): Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) (critical 9.3)
- [CVE-2026-62681](https://insights.sbomify.com/CVE-2026-62681/): Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) (critical 9.3)
- [CVE-2026-62680](https://insights.sbomify.com/CVE-2026-62680/): Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref (high 7.1)
- [CVE-2026-6268](https://insights.sbomify.com/CVE-2026-6268/): EventPress < 22.2 – Reflected Cross-Site Scripting (high 7.1)
- [CVE-2026-62679](https://insights.sbomify.com/CVE-2026-62679/): Lychee: Path traversal in `SecurePathController` allows authenticated arbitrary file read (high 8.9)
- [CVE-2026-62677](https://insights.sbomify.com/CVE-2026-62677/): Omnigent: Unvalidated os_env.cwd in agent bundle yields arbitrary host filesystem access on runners without OMNIGENT_RUNNER_WORKSPACE (high 8.8)
- [CVE-2026-62676](https://insights.sbomify.com/CVE-2026-62676/): Omnigent Guardrail policy bypass: shell-command parser fails open in policies/builtins/_shell.py (high 7.1)
- [CVE-2026-62675](https://insights.sbomify.com/CVE-2026-62675/): Omnigent: Uploaded Agent Bundle Allows Authenticated Runner RCE via Python Callable Tools (high 8.8)
- [CVE-2026-62674](https://insights.sbomify.com/CVE-2026-62674/): Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE (critical 9.0)
- [CVE-2026-62673](https://insights.sbomify.com/CVE-2026-62673/): Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesystems (high 8.2)
- [CVE-2026-62672](https://insights.sbomify.com/CVE-2026-62672/): Grav: Authenticated ReDoS via regex_replace in Twig Sandbox (medium 6.0)
- [CVE-2026-62671](https://insights.sbomify.com/CVE-2026-62671/): Cross-site request forgery in grav-plugin-login (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/484/