# Vulnerabilities published in 2026


- [CVE-2026-50379](https://insights.sbomify.com/CVE-2026-50379/): Windows Media Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-50378](https://insights.sbomify.com/CVE-2026-50378/): Windows Key Guard Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50377](https://insights.sbomify.com/CVE-2026-50377/): Windows Kernel Elevation of Privilege Vulnerability (medium 5.5)
- [CVE-2026-50376](https://insights.sbomify.com/CVE-2026-50376/): Windows Remote Desktop Client Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-50375](https://insights.sbomify.com/CVE-2026-50375/): DirectX Graphics Kernel Elevation of Privilege Vulnerability (medium 6.3)
- [CVE-2026-50374](https://insights.sbomify.com/CVE-2026-50374/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (medium 6.3)
- [CVE-2026-50373](https://insights.sbomify.com/CVE-2026-50373/): Windows Search Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50372](https://insights.sbomify.com/CVE-2026-50372/): Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50371](https://insights.sbomify.com/CVE-2026-50371/): Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50370](https://insights.sbomify.com/CVE-2026-50370/): DHCP Server Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2026-5037](https://insights.sbomify.com/CVE-2026-5037/): mxml mxmlIndexNew mxml-index.c index_sort stack-based overflow (medium 4.8)
- [CVE-2026-50369](https://insights.sbomify.com/CVE-2026-50369/): Windows Remote Desktop Services Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-50368](https://insights.sbomify.com/CVE-2026-50368/): Windows Active Directory Federation Services Denial of Service Vulnerability (high 7.5)
- [CVE-2026-50367](https://insights.sbomify.com/CVE-2026-50367/): Windows Sensor Data Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50366](https://insights.sbomify.com/CVE-2026-50366/): Windows Active Directory Domain Services Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-50365](https://insights.sbomify.com/CVE-2026-50365/): Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability (high 8.0)
- [CVE-2026-50364](https://insights.sbomify.com/CVE-2026-50364/): Windows Backup Service Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2026-50363](https://insights.sbomify.com/CVE-2026-50363/): Windows Push Notifications Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50362](https://insights.sbomify.com/CVE-2026-50362/): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50361](https://insights.sbomify.com/CVE-2026-50361/): Microsoft Brokering File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50360](https://insights.sbomify.com/CVE-2026-50360/): Windows SMB Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2026-5036](https://insights.sbomify.com/CVE-2026-5036/): Tenda 4G06 Endpoint DhcpListClient fromDhcpListClient stack-based overflow (high 8.7)
- [CVE-2026-50359](https://insights.sbomify.com/CVE-2026-50359/): Microsoft XML Core Services Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50358](https://insights.sbomify.com/CVE-2026-50358/): Windows Media Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50357](https://insights.sbomify.com/CVE-2026-50357/): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50356](https://insights.sbomify.com/CVE-2026-50356/): Microsoft Windows App Store Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50355](https://insights.sbomify.com/CVE-2026-50355/): Windows Active Directory Federation Services Denial of Service Vulnerability (high 7.5)
- [CVE-2026-50354](https://insights.sbomify.com/CVE-2026-50354/): Windows Kernel Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2026-50353](https://insights.sbomify.com/CVE-2026-50353/): DirectX Graphics Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50352](https://insights.sbomify.com/CVE-2026-50352/): Windows Cryptographic Services Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-50351](https://insights.sbomify.com/CVE-2026-50351/): Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50350](https://insights.sbomify.com/CVE-2026-50350/): Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-5035](https://insights.sbomify.com/CVE-2026-5035/): code-projects Accounting System Parameter view_work.php sql injection (medium 6.9)
- [CVE-2026-50349](https://insights.sbomify.com/CVE-2026-50349/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50348](https://insights.sbomify.com/CVE-2026-50348/): Windows Runtime Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50347](https://insights.sbomify.com/CVE-2026-50347/): Windows Data.dll Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50346](https://insights.sbomify.com/CVE-2026-50346/): Netlogon RPC Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50345](https://insights.sbomify.com/CVE-2026-50345/): Windows Runtime Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50344](https://insights.sbomify.com/CVE-2026-50344/): Windows OLE Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50343](https://insights.sbomify.com/CVE-2026-50343/): Microsoft Install Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50342](https://insights.sbomify.com/CVE-2026-50342/): Windows MIDI Service Module Elevation of Privileges Vulnerability (high 8.8)
- [CVE-2026-50341](https://insights.sbomify.com/CVE-2026-50341/): Windows NTFS Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-50340](https://insights.sbomify.com/CVE-2026-50340/): Windows Runtime Elevation of Privilege Vulnerability (high 8.5)
- [CVE-2026-5034](https://insights.sbomify.com/CVE-2026-5034/): code-projects Accounting System Parameter edit_costumer.php sql injection (medium 6.9)
- [CVE-2026-50339](https://insights.sbomify.com/CVE-2026-50339/): Windows Push Notification Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-50338](https://insights.sbomify.com/CVE-2026-50338/): Azure Spring Apps Elevation of Privilege Vulnerability (high 8.2)
- [CVE-2026-50337](https://insights.sbomify.com/CVE-2026-50337/): Windows Notification Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50336](https://insights.sbomify.com/CVE-2026-50336/): Windows Media Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50335](https://insights.sbomify.com/CVE-2026-50335/): Windows Operating Systems Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50334](https://insights.sbomify.com/CVE-2026-50334/): Windows Push Notification Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-50333](https://insights.sbomify.com/CVE-2026-50333/): Windows Spaceport.sys Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50332](https://insights.sbomify.com/CVE-2026-50332/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50331](https://insights.sbomify.com/CVE-2026-50331/): Windows Application Model Core API Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50330](https://insights.sbomify.com/CVE-2026-50330/): Windows Remote Desktop Client Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2026-5033](https://insights.sbomify.com/CVE-2026-5033/): code-projects Accounting System Parameter view_costumer.php sql injection (medium 6.9)
- [CVE-2026-50329](https://insights.sbomify.com/CVE-2026-50329/): Microsoft DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50328](https://insights.sbomify.com/CVE-2026-50328/): Windows Server Update Service (WSUS) Tampering Vulnerability (high 7.5)
- [CVE-2026-50327](https://insights.sbomify.com/CVE-2026-50327/): Windows Media Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50326](https://insights.sbomify.com/CVE-2026-50326/): Windows Unified Consent System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50325](https://insights.sbomify.com/CVE-2026-50325/): Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50324](https://insights.sbomify.com/CVE-2026-50324/): Windows Active Directory Federation Services Denial of Service Vulnerability (medium 5.9)
- [CVE-2026-50323](https://insights.sbomify.com/CVE-2026-50323/): Windows Runtime Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50322](https://insights.sbomify.com/CVE-2026-50322/): Windows Runtime Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50321](https://insights.sbomify.com/CVE-2026-50321/): Windows USB Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-5032](https://insights.sbomify.com/CVE-2026-5032/): W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header (high 7.5)
- [CVE-2026-50318](https://insights.sbomify.com/CVE-2026-50318/): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50317](https://insights.sbomify.com/CVE-2026-50317/): Windows Operating Systems Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50316](https://insights.sbomify.com/CVE-2026-50316/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-50315](https://insights.sbomify.com/CVE-2026-50315/): Windows Image Acquisition Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50314](https://insights.sbomify.com/CVE-2026-50314/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50313](https://insights.sbomify.com/CVE-2026-50313/): Windows NTFS Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50312](https://insights.sbomify.com/CVE-2026-50312/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (medium 4.7)
- [CVE-2026-50311](https://insights.sbomify.com/CVE-2026-50311/): Windows Server Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50310](https://insights.sbomify.com/CVE-2026-50310/): Windows Human Interface Device Information Disclosure Vulnerability (medium 4.7)
- [CVE-2026-5031](https://insights.sbomify.com/CVE-2026-5031/): BichitroGan ISP Billing Software Endpoint users-view resource injection (medium 5.3)
- [CVE-2026-50309](https://insights.sbomify.com/CVE-2026-50309/): Windows NTFS Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50308](https://insights.sbomify.com/CVE-2026-50308/): Windows NTFS Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50307](https://insights.sbomify.com/CVE-2026-50307/): Windows TCP/IP Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50306](https://insights.sbomify.com/CVE-2026-50306/): Windows TCP/IP Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50305](https://insights.sbomify.com/CVE-2026-50305/): Microsoft Brokering File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50304](https://insights.sbomify.com/CVE-2026-50304/): Windows Active Directory Federation Services Denial of Service Vulnerability (high 7.5)
- [CVE-2026-50303](https://insights.sbomify.com/CVE-2026-50303/): Windows Key Guard Security Feature Bypass Vulnerability (medium 5.5)
- [CVE-2026-50302](https://insights.sbomify.com/CVE-2026-50302/): Windows Cryptographic Services Security Feature Bypass Vulnerability (medium 4.2)
- [CVE-2026-50301](https://insights.sbomify.com/CVE-2026-50301/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-50300](https://insights.sbomify.com/CVE-2026-50300/): Windows DWM Core Library Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-5030](https://insights.sbomify.com/CVE-2026-5030/): Totolink NR1800X Telnet Service cstecgi.cgi NTPSyncWithHost command injection (medium 5.3)
- [CVE-2026-50299](https://insights.sbomify.com/CVE-2026-50299/): Windows Storage Spaces Direct Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2026-50298](https://insights.sbomify.com/CVE-2026-50298/): Windows Spaceport.sys Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2026-50297](https://insights.sbomify.com/CVE-2026-50297/): Win32k Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50296](https://insights.sbomify.com/CVE-2026-50296/): DirectX Graphics Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-50295](https://insights.sbomify.com/CVE-2026-50295/): Windows Zero Trust DNS Security Feature Bypass Vulnerability (medium 5.5)
- [CVE-2026-50294](https://insights.sbomify.com/CVE-2026-50294/): Windows Kernel Information Disclosure Vulnerability (medium 6.2)
- [CVE-2026-50293](https://insights.sbomify.com/CVE-2026-50293/): Windows Internal Task Bar Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-50292](https://insights.sbomify.com/CVE-2026-50292/): Command injection in libinput (high 7.4)
- [CVE-2026-50291](https://insights.sbomify.com/CVE-2026-50291/): OpenImageIO: Segmentation Fault in BmpInput::read_native_scanline (bmpinput.cpp:399) (medium 5.5)
- [CVE-2026-50290](https://insights.sbomify.com/CVE-2026-50290/): @asymmetric-effort/specifyjs: CSS expression sanitization is bypassable in renderToString (medium 5.3)
- [CVE-2026-5029](https://insights.sbomify.com/CVE-2026-5029/): RCE in Code Runner MCP Server (high 8.7)
- [CVE-2026-50289](https://insights.sbomify.com/CVE-2026-50289/): systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux (high 8.7)
- [CVE-2026-50288](https://insights.sbomify.com/CVE-2026-50288/): @asymmetric-effort/specifyjs: URL parse failure silently allows request (high 8.7)
- [CVE-2026-50287](https://insights.sbomify.com/CVE-2026-50287/): Missing Authentication for Critical Function in @agenticmail/mcp (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/578/