# Vulnerabilities published in 2026


- [CVE-2026-57105](https://insights.sbomify.com/CVE-2026-57105/): Microsoft Office SharePoint Spoofing Vulnerability (high 8.0)
- [CVE-2026-57104](https://insights.sbomify.com/CVE-2026-57104/): Azure Storage Explorer Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-57102](https://insights.sbomify.com/CVE-2026-57102/): Visual Studio Code Security Feature Bypass Vulnerability (high 8.8)
- [CVE-2026-57101](https://insights.sbomify.com/CVE-2026-57101/): Visual Studio Code Security Feature Bypass Vulnerability (high 7.1)
- [CVE-2026-57100](https://insights.sbomify.com/CVE-2026-57100/): Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability (critical 9.9)
- [CVE-2026-5710](https://insights.sbomify.com/CVE-2026-5710/): Path traversal in Drag and Drop Multiple File Upload for Contact Form 7 (high 7.5)
- [CVE-2026-57099](https://insights.sbomify.com/CVE-2026-57099/): ASP.NET Core Denial of Service Vulnerability (high 7.5)
- [CVE-2026-57098](https://insights.sbomify.com/CVE-2026-57098/): Microsoft Remote Desktop App for Windows Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-57097](https://insights.sbomify.com/CVE-2026-57097/): Microsoft XML Security Feature Bypass Vulnerability (medium 6.4)
- [CVE-2026-57096](https://insights.sbomify.com/CVE-2026-57096/): Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-57095](https://insights.sbomify.com/CVE-2026-57095/): Win32k Elevation of Privilege Vulnerability (medium 6.2)
- [CVE-2026-57094](https://insights.sbomify.com/CVE-2026-57094/): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-57093](https://insights.sbomify.com/CVE-2026-57093/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-57092](https://insights.sbomify.com/CVE-2026-57092/): Microsoft Windows VMSwitch Elevation of Privilege Vulnerability (critical 9.9)
- [CVE-2026-57091](https://insights.sbomify.com/CVE-2026-57091/): Windows File History Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-57090](https://insights.sbomify.com/CVE-2026-57090/): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-5709](https://insights.sbomify.com/CVE-2026-5709/): AWS Research and Engineering Studio (RES) FileBrowser Command Injection (high 7.7)
- [CVE-2026-57089](https://insights.sbomify.com/CVE-2026-57089/): Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-57088](https://insights.sbomify.com/CVE-2026-57088/): Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-57087](https://insights.sbomify.com/CVE-2026-57087/): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-57085](https://insights.sbomify.com/CVE-2026-57085/): Windows Print Spooler Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-57084](https://insights.sbomify.com/CVE-2026-57084/): Windows File Explorer Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-57083](https://insights.sbomify.com/CVE-2026-57083/): Windows Media Photo Codec Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-57082](https://insights.sbomify.com/CVE-2026-57082/): Weak cryptography in Net::BitTorrent (medium 5.9)
- [CVE-2026-57081](https://insights.sbomify.com/CVE-2026-57081/): Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input (high 7.5)
- [CVE-2026-57080](https://insights.sbomify.com/CVE-2026-57080/): Denial of service in Net::BitTorrent (high 7.5)
- [CVE-2026-5708](https://insights.sbomify.com/CVE-2026-5708/): Improper Control of User-Modifiable Attributes in RES CreateSession API (high 8.7)
- [CVE-2026-57079](https://insights.sbomify.com/CVE-2026-57079/): Path traversal in Net::BitTorrent (medium 5.3)
- [CVE-2026-57077](https://insights.sbomify.com/CVE-2026-57077/): YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len (high 7.7)
- [CVE-2026-57076](https://insights.sbomify.com/CVE-2026-57076/): Use after free in YAML::Syck (high 7.8)
- [CVE-2026-57075](https://insights.sbomify.com/CVE-2026-57075/): Memory corruption in YAML::Syck (critical 9.1)
- [CVE-2026-57074](https://insights.sbomify.com/CVE-2026-57074/): XML::Bare versions through 0.53 for Perl have an unbounded character lookahead (critical 9.1)
- [CVE-2026-57073](https://insights.sbomify.com/CVE-2026-57073/): HTML::Bare versions through 0.04 for Perl have an unbounded character lookahead (critical 9.1)
- [CVE-2026-5707](https://insights.sbomify.com/CVE-2026-5707/): Command Injection via Virtual Desktop Session Name in AWS Research and Engineering Studio (RES) (high 8.7)
- [CVE-2026-57062](https://insights.sbomify.com/CVE-2026-57062/): Weak cryptography in GnuPG (low 2.9)
- [CVE-2026-5706](https://insights.sbomify.com/CVE-2026-5706/): Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements (high 8.9)
- [CVE-2026-57054](https://insights.sbomify.com/CVE-2026-57054/): Junos OS: MX Series: Web filtering doesn't block specifically formatted URLs (medium 6.9)
- [CVE-2026-57053](https://insights.sbomify.com/CVE-2026-57053/): Memory corruption in libidn (medium 4.0)
- [CVE-2026-5705](https://insights.sbomify.com/CVE-2026-5705/): code-projects Online Hotel Booking Booking Endpoint booknow.php cross site scripting (medium 5.3)
- [CVE-2026-57042](https://insights.sbomify.com/CVE-2026-57042/): Privilege escalation in Android (medium 6.7)
- [CVE-2026-5704](https://insights.sbomify.com/CVE-2026-5704/): Tar: tar: hidden file injection via crafted archives (medium 5.0)
- [CVE-2026-57035](https://insights.sbomify.com/CVE-2026-57035/): Memory corruption in Android (medium 6.7)
- [CVE-2026-57032](https://insights.sbomify.com/CVE-2026-57032/): Junos OS: EX Series: Subscribing to an unsupported telemetry sensor path causes fxpc process crash (high 7.1)
- [CVE-2026-57031](https://insights.sbomify.com/CVE-2026-57031/): Junos OS: MX Series: For subscribers configured on static interfaces, input filters are not in effect (medium 5.3)
- [CVE-2026-57030](https://insights.sbomify.com/CVE-2026-57030/): Junos OS: SRX Series: Flow sessions are not getting cleared leading to a DoS (high 8.2)
- [CVE-2026-5703](https://insights.sbomify.com/CVE-2026-5703/): Path Traversal in Satel Iberia SenNet Datalogger Serie 200 (high 7.1)
- [CVE-2026-57029](https://insights.sbomify.com/CVE-2026-57029/): Junos OS Evolved: QFX Series: When sFlow collector reachability changes evo-pfemand process can crash (medium 6.0)
- [CVE-2026-57028](https://insights.sbomify.com/CVE-2026-57028/): Junos OS Evolved: A port which has been inadvertently exposed can be reached by an attacker (medium 6.9)
- [CVE-2026-57027](https://insights.sbomify.com/CVE-2026-57027/): Junos OS: EX4100 Series, EX4400: With sFlow configured in a VC scenario multicast traffic leads to an FPC crash (high 7.1)
- [CVE-2026-57026](https://insights.sbomify.com/CVE-2026-57026/): Junos OS: MX Series with SPC3, SRX Series: Processing of a specifically malformed SIP invite causes a flowd crash (high 8.7)
- [CVE-2026-57025](https://insights.sbomify.com/CVE-2026-57025/): Denial of service in Junos OS (medium 6.8)
- [CVE-2026-57024](https://insights.sbomify.com/CVE-2026-57024/): Junos OS: MX with SPC3, SRX Series: Repeated VPN negotiation failures will eventually cause iked to crash continuously (medium 6.9)
- [CVE-2026-57023](https://insights.sbomify.com/CVE-2026-57023/): Junos OS: MX with SPC3, SRX Series: A specifically malformed TCP packet causes a flowd crash (high 8.7)
- [CVE-2026-57022](https://insights.sbomify.com/CVE-2026-57022/): Denial of service in Junos OS (high 8.2)
- [CVE-2026-57021](https://insights.sbomify.com/CVE-2026-57021/): Junos OS: SRX Series: If VPN compliance-check is configured an attacker can cause http-gk process crash (medium 6.9)
- [CVE-2026-57020](https://insights.sbomify.com/CVE-2026-57020/): Junos OS: QFX10000 Series: IPv6 multicast traffic received on non-IRB interfaces causes a multicast flood (high 7.1)
- [CVE-2026-5702](https://insights.sbomify.com/CVE-2026-5702/): Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application (medium 4.8)
- [CVE-2026-57019](https://insights.sbomify.com/CVE-2026-57019/): Junos OS: MX Series: Specific traffic causes an FPC to reset (high 7.1)
- [CVE-2026-57014](https://insights.sbomify.com/CVE-2026-57014/): Memory corruption in Android (high 7.8)
- [CVE-2026-57012](https://insights.sbomify.com/CVE-2026-57012/): Missing authorization in Android (high 8.4)
- [CVE-2026-57008](https://insights.sbomify.com/CVE-2026-57008/): Information disclosure in Android (high 7.5)
- [CVE-2026-57006](https://insights.sbomify.com/CVE-2026-57006/): Information disclosure in Android (medium 4.4)
- [CVE-2026-5700](https://insights.sbomify.com/CVE-2026-5700/): Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application (medium 4.8)
- [CVE-2026-56997](https://insights.sbomify.com/CVE-2026-56997/): Memory corruption in Android (high 8.8)
- [CVE-2026-56992](https://insights.sbomify.com/CVE-2026-56992/): Privilege escalation in Android (medium 6.7)
- [CVE-2026-5699](https://insights.sbomify.com/CVE-2026-5699/): Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application (medium 4.8)
- [CVE-2026-56989](https://insights.sbomify.com/CVE-2026-56989/): Memory corruption in Android (medium 6.7)
- [CVE-2026-56988](https://insights.sbomify.com/CVE-2026-56988/): Use after free in Android (medium 6.4)
- [CVE-2026-56986](https://insights.sbomify.com/CVE-2026-56986/): Memory corruption in Android (high 8.4)
- [CVE-2026-56985](https://insights.sbomify.com/CVE-2026-56985/): Memory corruption in Android (high 8.4)
- [CVE-2026-56982](https://insights.sbomify.com/CVE-2026-56982/): Missing authorization in Android (high 7.8)
- [CVE-2026-5698](https://insights.sbomify.com/CVE-2026-5698/): Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application (medium 4.8)
- [CVE-2026-56979](https://insights.sbomify.com/CVE-2026-56979/): Security feature bypass in Android (medium 6.7)
- [CVE-2026-56978](https://insights.sbomify.com/CVE-2026-56978/): Memory corruption in Android (high 8.4)
- [CVE-2026-56975](https://insights.sbomify.com/CVE-2026-56975/): Denial of service in Android (medium 6.5)
- [CVE-2026-56974](https://insights.sbomify.com/CVE-2026-56974/): Memory corruption in Android (high 8.8)
- [CVE-2026-56973](https://insights.sbomify.com/CVE-2026-56973/): Privilege escalation in Android (medium 6.7)
- [CVE-2026-56972](https://insights.sbomify.com/CVE-2026-56972/): Memory corruption in Android (medium 6.7)
- [CVE-2026-56970](https://insights.sbomify.com/CVE-2026-56970/): Missing authorization in Android (high 8.4)
- [CVE-2026-5697](https://insights.sbomify.com/CVE-2026-5697/): Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application (medium 4.8)
- [CVE-2026-56968](https://insights.sbomify.com/CVE-2026-56968/): Information disclosure in GNU SASL (low 3.7)
- [CVE-2026-56967](https://insights.sbomify.com/CVE-2026-56967/): Memory corruption in Android (high 8.0)
- [CVE-2026-56964](https://insights.sbomify.com/CVE-2026-56964/): Use after free in Android (medium 6.4)
- [CVE-2026-56960](https://insights.sbomify.com/CVE-2026-56960/): Use after free in Android (critical 9.8)
- [CVE-2026-5696](https://insights.sbomify.com/CVE-2026-5696/): Multiple vulnerabilities in the Microweber administration panel (medium 5.9)
- [CVE-2026-56958](https://insights.sbomify.com/CVE-2026-56958/): Memory corruption in Android (medium 5.5)
- [CVE-2026-56952](https://insights.sbomify.com/CVE-2026-56952/): Missing authorization in Android (medium 6.7)
- [CVE-2026-56950](https://insights.sbomify.com/CVE-2026-56950/): Information disclosure in Android (medium 4.4)
- [CVE-2026-5695](https://insights.sbomify.com/CVE-2026-5695/): Multiple vulnerabilities in the Microweber administration panel (high 8.4)
- [CVE-2026-56945](https://insights.sbomify.com/CVE-2026-56945/): Memory corruption in Android (high 7.8)
- [CVE-2026-56942](https://insights.sbomify.com/CVE-2026-56942/): Memory corruption in Android (high 8.8)
- [CVE-2026-56941](https://insights.sbomify.com/CVE-2026-56941/): Use after free in Android (high 8.4)
- [CVE-2026-5694](https://insights.sbomify.com/CVE-2026-5694/): Quick Interest Slider <= 3.1.5 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2026-56936](https://insights.sbomify.com/CVE-2026-56936/): Memory corruption in Android (medium 6.8)
- [CVE-2026-56932](https://insights.sbomify.com/CVE-2026-56932/): Memory corruption in Android (medium 6.7)
- [CVE-2026-5693](https://insights.sbomify.com/CVE-2026-5693/): Smart Appointment & Booking <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Booking Cancellation (medium 5.3)
- [CVE-2026-56923](https://insights.sbomify.com/CVE-2026-56923/): Race condition in Android (medium 6.4)
- [CVE-2026-56922](https://insights.sbomify.com/CVE-2026-56922/): Privilege escalation in Android (medium 6.7)
- [CVE-2026-56920](https://insights.sbomify.com/CVE-2026-56920/): Memory corruption in Android (high 8.8)
- [CVE-2026-5692](https://insights.sbomify.com/CVE-2026-5692/): Totolink A7100RU cstecgi.cgi setGameSpeedCfg os command injection (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/530/