# Vulnerabilities published in 2026


- [CVE-2026-50698](https://insights.sbomify.com/CVE-2026-50698/): Frappe Framework 17.0.0-dev - Stored XSS in Audit Trail template rendering (medium 4.6)
- [CVE-2026-50697](https://insights.sbomify.com/CVE-2026-50697/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50696](https://insights.sbomify.com/CVE-2026-50696/): Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability (high 7.5)
- [CVE-2026-50695](https://insights.sbomify.com/CVE-2026-50695/): Windows Active Directory Federation Services Denial of Service Vulnerability (high 7.5)
- [CVE-2026-50694](https://insights.sbomify.com/CVE-2026-50694/): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-50692](https://insights.sbomify.com/CVE-2026-50692/): Desktop Window Manager Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-50690](https://insights.sbomify.com/CVE-2026-50690/): Windows SMB Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-5069](https://insights.sbomify.com/CVE-2026-5069/): Missing authorization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (medium 5.4)
- [CVE-2026-50689](https://insights.sbomify.com/CVE-2026-50689/): Windows Clipboard Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50688](https://insights.sbomify.com/CVE-2026-50688/): Windows Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50687](https://insights.sbomify.com/CVE-2026-50687/): Windows Win32k Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-50686](https://insights.sbomify.com/CVE-2026-50686/): Windows OLE Remote Code Execution Vulnerability (high 8.1)
- [CVE-2026-50685](https://insights.sbomify.com/CVE-2026-50685/): Windows DHCP Server Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-50684](https://insights.sbomify.com/CVE-2026-50684/): Active Directory Federation Server Spoofing Vulnerability (medium 4.8)
- [CVE-2026-50683](https://insights.sbomify.com/CVE-2026-50683/): Windows DHCP Client Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2026-50682](https://insights.sbomify.com/CVE-2026-50682/): Active Directory Denial of Service Vulnerability (high 7.1)
- [CVE-2026-50681](https://insights.sbomify.com/CVE-2026-50681/): Windows Secure Channel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-50680](https://insights.sbomify.com/CVE-2026-50680/): Windows Hyper-V Elevation of Privilege Vulnerability (high 8.2)
- [CVE-2026-5068](https://insights.sbomify.com/CVE-2026-5068/): bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data (high 7.6)
- [CVE-2026-50679](https://insights.sbomify.com/CVE-2026-50679/): Windows Search Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50678](https://insights.sbomify.com/CVE-2026-50678/): Microsoft Excel Information Disclosure Vulnerability (medium 6.6)
- [CVE-2026-50677](https://insights.sbomify.com/CVE-2026-50677/): Windows Media Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50676](https://insights.sbomify.com/CVE-2026-50676/): Windows Media Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50675](https://insights.sbomify.com/CVE-2026-50675/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50674](https://insights.sbomify.com/CVE-2026-50674/): Windows USB Print Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50673](https://insights.sbomify.com/CVE-2026-50673/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50672](https://insights.sbomify.com/CVE-2026-50672/): Windows NTFS Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50670](https://insights.sbomify.com/CVE-2026-50670/): Windows Win32k Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-5067](https://insights.sbomify.com/CVE-2026-5067/): Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key (critical 9.8)
- [CVE-2026-50669](https://insights.sbomify.com/CVE-2026-50669/): Windows Telephony Server Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50668](https://insights.sbomify.com/CVE-2026-50668/): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-50667](https://insights.sbomify.com/CVE-2026-50667/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50666](https://insights.sbomify.com/CVE-2026-50666/): Windows Remote Access Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-50665](https://insights.sbomify.com/CVE-2026-50665/): Microsoft Office Information Disclosure Vulnerability (high 7.8)
- [CVE-2026-50663](https://insights.sbomify.com/CVE-2026-50663/): Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-50661](https://insights.sbomify.com/CVE-2026-50661/): Windows BitLocker Security Feature Bypass Vulnerability (medium 6.1)
- [CVE-2026-5066](https://insights.sbomify.com/CVE-2026-5066/): net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function (medium 6.3)
- [CVE-2026-50659](https://insights.sbomify.com/CVE-2026-50659/): .NET Spoofing Vulnerability (medium 6.5)
- [CVE-2026-50658](https://insights.sbomify.com/CVE-2026-50658/): Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50657](https://insights.sbomify.com/CVE-2026-50657/): Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-50656](https://insights.sbomify.com/CVE-2026-50656/): Microsoft Defender Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50655](https://insights.sbomify.com/CVE-2026-50655/): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50653](https://insights.sbomify.com/CVE-2026-50653/): Azure Active Directory Denial of Service Vulnerability (high 7.5)
- [CVE-2026-50652](https://insights.sbomify.com/CVE-2026-50652/): Azure Active Directory Denial of Service Vulnerability (high 7.5)
- [CVE-2026-50651](https://insights.sbomify.com/CVE-2026-50651/): .NET Denial of Service Vulnerability (high 7.5)
- [CVE-2026-50650](https://insights.sbomify.com/CVE-2026-50650/): .NET Framework Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-5065](https://insights.sbomify.com/CVE-2026-5065/): IBM Controller is affected by vulnerabilities (high 8.8)
- [CVE-2026-50649](https://insights.sbomify.com/CVE-2026-50649/): .NET Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50648](https://insights.sbomify.com/CVE-2026-50648/): .NET Framework Denial of Service Vulnerability (high 7.5)
- [CVE-2026-50647](https://insights.sbomify.com/CVE-2026-50647/): Active Directory Federation Server Denial of Service Vulnerability (high 7.5)
- [CVE-2026-50646](https://insights.sbomify.com/CVE-2026-50646/): .NET Framework Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50645](https://insights.sbomify.com/CVE-2026-50645/): Apache CXF: No restriction on attachment headers per message (high 7.5)
- [CVE-2026-50644](https://insights.sbomify.com/CVE-2026-50644/): SQL Injection in SOPlanning Audit Retention Configuration (high 8.6)
- [CVE-2026-50643](https://insights.sbomify.com/CVE-2026-50643/): Out‑of‑Bounds Read in 8cc (medium 5.1)
- [CVE-2026-50642](https://insights.sbomify.com/CVE-2026-50642/): Terminal Escape Injection in diff‑so‑fancy (medium 4.8)
- [CVE-2026-50641](https://insights.sbomify.com/CVE-2026-50641/): Plaintext password storage in Streamsoft Business Intelligence (high 7.1)
- [CVE-2026-5064](https://insights.sbomify.com/CVE-2026-5064/): HP One Agent Software – Security Update (high 8.5)
- [CVE-2026-50639](https://insights.sbomify.com/CVE-2026-50639/): Metrics::Any::Adapter::SignalFx versions before 0.04 for Perl does not protect against metric injections (medium 6.5)
- [CVE-2026-50638](https://insights.sbomify.com/CVE-2026-50638/): Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections (critical 9.1)
- [CVE-2026-50637](https://insights.sbomify.com/CVE-2026-50637/): Metrics::Any::Adapter::Statsd versions before 0.04 for Perl does not protect against metric injections (high 8.2)
- [CVE-2026-50636](https://insights.sbomify.com/CVE-2026-50636/): LimeSurvey RemoteControl invite_participants/remind_participants SQL Injection (high 8.7)
- [CVE-2026-50635](https://insights.sbomify.com/CVE-2026-50635/): LimeSurvey Password Reset Host Header Injection Discloses Reset Token (high 8.7)
- [CVE-2026-50634](https://insights.sbomify.com/CVE-2026-50634/): Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry (medium 6.5)
- [CVE-2026-50633](https://insights.sbomify.com/CVE-2026-50633/): Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl (high 8.1)
- [CVE-2026-50632](https://insights.sbomify.com/CVE-2026-50632/): Apache CXF: JNDI Injection Vulnerability in JMSConfigFactory (high 8.1)
- [CVE-2026-50631](https://insights.sbomify.com/CVE-2026-50631/): Apache CXF: OAuth2: TOCTOU Race Condition in Refresh Token Processing (high 7.4)
- [CVE-2026-50630](https://insights.sbomify.com/CVE-2026-50630/): Apache CXF: OAuth2: HTTP Response Splitting via WWW-Authenticate Realm Injection (medium 6.5)
- [CVE-2026-5063](https://insights.sbomify.com/CVE-2026-5063/): NEX-Forms <= 9.1.11 - Unauthenticated Stored Cross-Site Scripting via POST Parameter Key Names (high 7.2)
- [CVE-2026-50629](https://insights.sbomify.com/CVE-2026-50629/): Apache CXF: OAuth2: Log Injection via Unsanitized Client Identifier (medium 5.3)
- [CVE-2026-50628](https://insights.sbomify.com/CVE-2026-50628/): Apache CXF: OAuth2: Inverted IP Binding Check Defeats Security Control (critical 9.8)
- [CVE-2026-50627](https://insights.sbomify.com/CVE-2026-50627/): Apache CXF: OAuth2: Missing JWT Audience and Issuer Validation in Access Token Validator (critical 9.1)
- [CVE-2026-50623](https://insights.sbomify.com/CVE-2026-50623/): Apache CXF: Authentication Bypass in OAuth2 TokenIntrospectionService (medium 4.8)
- [CVE-2026-50622](https://insights.sbomify.com/CVE-2026-50622/): Apache Atlas: Missing Authorization on Admin Endpoints (high 8.8)
- [CVE-2026-5062](https://insights.sbomify.com/CVE-2026-5062/): PrettyLinks <= 3.6.20 - Authenticated (Administrator+) SQL Injection via 's' Parameter (medium 4.9)
- [CVE-2026-50619](https://insights.sbomify.com/CVE-2026-50619/): Unauthenticated remote code execution vulnerability (critical 9.3)
- [CVE-2026-50612](https://insights.sbomify.com/CVE-2026-50612/): Import Symlink Following Remote Code Execution Vulnerability in QuMagie (critical 9.4)
- [CVE-2026-50610](https://insights.sbomify.com/CVE-2026-50610/): Improper Access control Vulnerability in NitroSense and PredatorSense Software (high 7.4)
- [CVE-2026-5061](https://insights.sbomify.com/CVE-2026-5061/): Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack (medium 4.7)
- [CVE-2026-50609](https://insights.sbomify.com/CVE-2026-50609/): Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSense Software (high 7.4)
- [CVE-2026-50608](https://insights.sbomify.com/CVE-2026-50608/): Authentication Vulnerability in NitroSense and PredatorSense Software (low 1.2)
- [CVE-2026-50607](https://insights.sbomify.com/CVE-2026-50607/): WebSocket Exposure Vulnerability in NitroSense and PredatorSense Software (low 2.7)
- [CVE-2026-50606](https://insights.sbomify.com/CVE-2026-50606/): Hard-coded Encryption Key Vulnerability in Acer System Monitoring for NitroSense and PredatorSense Software (low 1.2)
- [CVE-2026-50605](https://insights.sbomify.com/CVE-2026-50605/): Privilege Escalation Vulnerability in NitroSense and PredatorSense Software (high 7.4)
- [CVE-2026-50604](https://insights.sbomify.com/CVE-2026-50604/): Unauthenticated Access Vulnerability in NitroSense and PredatorSense Software (medium 4.9)
- [CVE-2026-50603](https://insights.sbomify.com/CVE-2026-50603/): Hard-coded encryption key vulnerability in Acer Agent Service for NitroSense and PredatorSense (medium 4.9)
- [CVE-2026-50602](https://insights.sbomify.com/CVE-2026-50602/): Planet9 Incorrect Permission Assignment Vulnerability Information (high 8.5)
- [CVE-2026-50601](https://insights.sbomify.com/CVE-2026-50601/): Planet9 Hardcoded Credentials Vulnerability Information (medium 6.6)
- [CVE-2026-5060](https://insights.sbomify.com/CVE-2026-5060/): Missing authorization in MasterStudy LMS WordPress Plugin – for Online Courses and Education (medium 6.5)
- [CVE-2026-50593](https://insights.sbomify.com/CVE-2026-50593/): Integer overflow in Graphite (high 7.3)
- [CVE-2026-50592](https://insights.sbomify.com/CVE-2026-50592/): Cross-site scripting in Znuny (medium 6.4)
- [CVE-2026-50591](https://insights.sbomify.com/CVE-2026-50591/): Cross-site scripting in Znuny (medium 5.4)
- [CVE-2026-50590](https://insights.sbomify.com/CVE-2026-50590/): Misconfiguration in Incydr (medium 4.5)
- [CVE-2026-5059](https://insights.sbomify.com/CVE-2026-5059/): aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-50589](https://insights.sbomify.com/CVE-2026-50589/): OpenStack Ironic: Crafted JSON String to Certain Endpoints on the API or JSON-RPC Service May Result in Service Crash (medium 5.3)
- [CVE-2026-5058](https://insights.sbomify.com/CVE-2026-5058/): aws-mcp-server Command Injection Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2026-50578](https://insights.sbomify.com/CVE-2026-50578/): ePA 3.x Integration: TLS Certificate Verification Universally Disabled (high 7.5)
- [CVE-2026-50577](https://insights.sbomify.com/CVE-2026-50577/): ePA 3.x Integration: AES-GCM Nonce Reuse via Frozen VAU Request Counter (high 7.4)
- [CVE-2026-50576](https://insights.sbomify.com/CVE-2026-50576/): ePA 3.x Integration: HTTP Header Injection in VAU Inner Requests (medium 6.8)
- [CVE-2026-50575](https://insights.sbomify.com/CVE-2026-50575/): BetterDesk has a replay behavior vulnerability when devices are deleted (high 7.7)
- [CVE-2026-50574](https://insights.sbomify.com/CVE-2026-50574/): yt-dlp: Arbitrary code execution via manifest downloads with aria2c (high 8.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/575/