# Vulnerabilities published in 2026


- [CVE-2026-42915](https://insights.sbomify.com/CVE-2026-42915/): Microsoft Windows VMSwitch Denial of Service Vulnerability (medium 5.5)
- [CVE-2026-42914](https://insights.sbomify.com/CVE-2026-42914/): Windows Kerberos Denial of Service Vulnerability (medium 5.3)
- [CVE-2026-42913](https://insights.sbomify.com/CVE-2026-42913/): Remote Desktop Client Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-42912](https://insights.sbomify.com/CVE-2026-42912/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-42911](https://insights.sbomify.com/CVE-2026-42911/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-42910](https://insights.sbomify.com/CVE-2026-42910/): Windows Hotpatch Monitoring Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42909](https://insights.sbomify.com/CVE-2026-42909/): Remote Desktop Client Remote Code Execution Vulnerability (high 7.5)
- [CVE-2026-42908](https://insights.sbomify.com/CVE-2026-42908/): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (high 7.5)
- [CVE-2026-42907](https://insights.sbomify.com/CVE-2026-42907/): Windows Shell Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-42906](https://insights.sbomify.com/CVE-2026-42906/): Windows Shell Information Disclosure Vulnerability (medium 5.5)
- [CVE-2026-42905](https://insights.sbomify.com/CVE-2026-42905/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42904](https://insights.sbomify.com/CVE-2026-42904/): Windows TCP/IP Elevation of Privilege Vulnerability (critical 9.6)
- [CVE-2026-42903](https://insights.sbomify.com/CVE-2026-42903/): Windows Kerberos Denial of Service Vulnerability (medium 6.5)
- [CVE-2026-42902](https://insights.sbomify.com/CVE-2026-42902/): Microsoft PowerToys Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42901](https://insights.sbomify.com/CVE-2026-42901/): Microsoft Entra ID Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-42900](https://insights.sbomify.com/CVE-2026-42900/): Microsoft Windows App Store Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2026-4290](https://insights.sbomify.com/CVE-2026-4290/): WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators (critical 9.1)
- [CVE-2026-42899](https://insights.sbomify.com/CVE-2026-42899/): ASP.NET Core Denial of Service Vulnerability (high 7.5)
- [CVE-2026-42898](https://insights.sbomify.com/CVE-2026-42898/): Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2026-42897](https://insights.sbomify.com/CVE-2026-42897/): Microsoft Exchange Server Cross-Site Scripting (high 8.1, exploited in the wild)
- [CVE-2026-42896](https://insights.sbomify.com/CVE-2026-42896/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42895](https://insights.sbomify.com/CVE-2026-42895/): Microsoft Copilot Tampering Vulnerability (medium 6.5)
- [CVE-2026-42893](https://insights.sbomify.com/CVE-2026-42893/): Microsoft Outlook for iOS Tampering Vulnerability (high 7.4)
- [CVE-2026-42891](https://insights.sbomify.com/CVE-2026-42891/): Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability (medium 6.5)
- [CVE-2026-42890](https://insights.sbomify.com/CVE-2026-42890/): actual Allows Electron to Run As Node (medium 4.8)
- [CVE-2026-4289](https://insights.sbomify.com/CVE-2026-4289/): Tiandy Easy7 Integrated Management Platform getRecByTemplateId sql injection (medium 6.9)
- [CVE-2026-42889](https://insights.sbomify.com/CVE-2026-42889/): Relay Server WebSocket authentication bypass when token is omitted (critical 9.1)
- [CVE-2026-42888](https://insights.sbomify.com/CVE-2026-42888/): Audiobookshelf: Path Traversal vulnerability in the audiobookshelf project (medium 6.9)
- [CVE-2026-42887](https://insights.sbomify.com/CVE-2026-42887/): Audiobookshelf: Stored Cross-Site Scripting in Login Page Custom Message (medium 4.5)
- [CVE-2026-42886](https://insights.sbomify.com/CVE-2026-42886/): Audiobookshelf: Memory amplification DoS via oversized compressed details entry in backup upload (medium 4.9)
- [CVE-2026-42885](https://insights.sbomify.com/CVE-2026-42885/): Audiobookshelf: Path prefix bypass in filesystem existence check leaks out-of-scope file existence (medium 4.3)
- [CVE-2026-42884](https://insights.sbomify.com/CVE-2026-42884/): Audiobookshelf: Collection endpoints bypass library access controls exposing restricted library data (medium 4.3)
- [CVE-2026-42883](https://insights.sbomify.com/CVE-2026-42883/): Audiobookshelf: Cross-library file exfiltration via unscoped bulk download endpoint (medium 6.5)
- [CVE-2026-42882](https://insights.sbomify.com/CVE-2026-42882/): oxyno-zeta/s3-proxy: Security Issues in Resource Path Matching (critical 9.4)
- [CVE-2026-42881](https://insights.sbomify.com/CVE-2026-42881/): STIGQter: Arbitrary File Write leading to Local Code Execution via Export HTML (high 8.4)
- [CVE-2026-42880](https://insights.sbomify.com/CVE-2026-42880/): ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction (critical 9.6)
- [CVE-2026-4288](https://insights.sbomify.com/CVE-2026-4288/): Tiandy Easy7 Integrated Management Platform Endpoint getDevDetailedInfo sql injection (medium 6.9)
- [CVE-2026-42879](https://insights.sbomify.com/CVE-2026-42879/): FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images (medium 6.3)
- [CVE-2026-42878](https://insights.sbomify.com/CVE-2026-42878/): FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts (medium 5.3)
- [CVE-2026-42877](https://insights.sbomify.com/CVE-2026-42877/): FacturaScripts: Stored XSS via product reference in sales/purchases (medium 5.4)
- [CVE-2026-42876](https://insights.sbomify.com/CVE-2026-42876/): External Secrets Operator: Privilege escalation with secret overwriting (medium 4.9)
- [CVE-2026-42875](https://insights.sbomify.com/CVE-2026-42875/): External Secrets Operator: Namespace Isolation Bypass in CAProvider ConfigMap Resolution for SecretStore (medium 5.3)
- [CVE-2026-42874](https://insights.sbomify.com/CVE-2026-42874/): Microdot: HTTP response splitting in Response.set_cookie() (low 3.7)
- [CVE-2026-42873](https://insights.sbomify.com/CVE-2026-42873/): WeGIA: Error Handling Upload DocDependente (not scored)
- [CVE-2026-42872](https://insights.sbomify.com/CVE-2026-42872/): WeGIA: Reflected XSS in listar_arquivos_etapa.php (medium 6.1)
- [CVE-2026-42871](https://insights.sbomify.com/CVE-2026-42871/): WeGIA: Error Handling familiar_docfamiliar (medium 6.9)
- [CVE-2026-42870](https://insights.sbomify.com/CVE-2026-42870/): WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao' (medium 6.4)
- [CVE-2026-4287](https://insights.sbomify.com/CVE-2026-4287/): Tiandy Easy7 Integrated Management Platform Endpoint queryResources sql injection (medium 6.9)
- [CVE-2026-42869](https://insights.sbomify.com/CVE-2026-42869/): Hardcoded credentials in CoPilot (critical 10.0)
- [CVE-2026-42867](https://insights.sbomify.com/CVE-2026-42867/): Langflow: Path Traversal in Knowledge Bases API via Creation Endpoint (medium 6.5)
- [CVE-2026-42866](https://insights.sbomify.com/CVE-2026-42866/): Tookie: Arbitrary file write via path traversal in -u username / -U userfile output filename (medium 6.7)
- [CVE-2026-42865](https://insights.sbomify.com/CVE-2026-42865/): Inbox Zero: Cross-account cleaner email stream exposure (low 2.3)
- [CVE-2026-42864](https://insights.sbomify.com/CVE-2026-42864/): FireFighter: Unauthenticated SSRF in Raid jira_bot endpoint allows IAM credential theft (critical 9.9)
- [CVE-2026-42863](https://insights.sbomify.com/CVE-2026-42863/): Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow Reassignment (high 7.6)
- [CVE-2026-42862](https://insights.sbomify.com/CVE-2026-42862/): Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource Reassignment (high 7.6)
- [CVE-2026-42861](https://insights.sbomify.com/CVE-2026-42861/): Flowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource Reassignment (high 7.6)
- [CVE-2026-42860](https://insights.sbomify.com/CVE-2026-42860/): Open edx Enterprise Service: SSRF via SAML metadata URL in sync_provider_data endpoint (high 8.5)
- [CVE-2026-4286](https://insights.sbomify.com/CVE-2026-4286/): Playbooks Plugin fails to validate team transfers, allowing unauthorized removal of member access via playbook update (low 3.1)
- [CVE-2026-42859](https://insights.sbomify.com/CVE-2026-42859/): Neat VNC: Buffer overflow due to oversized RSA public keys (high 8.1)
- [CVE-2026-42858](https://insights.sbomify.com/CVE-2026-42858/): Open edX Platform: Server-Side Request Forgery (SSRF) in SAML Provider Data Sync Endpoint (high 8.5)
- [CVE-2026-42857](https://insights.sbomify.com/CVE-2026-42857/): Open edX Platform: Stored CSS Injection in Email Notifications via Incomplete HTML Sanitization (medium 4.6)
- [CVE-2026-42856](https://insights.sbomify.com/CVE-2026-42856/): Network-AI: Missing authentication on MCP HTTP endpoint allows unauthenticated privileged tool calls (high 8.7)
- [CVE-2026-42855](https://insights.sbomify.com/CVE-2026-42855/): arduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attack (high 7.5)
- [CVE-2026-42854](https://insights.sbomify.com/CVE-2026-42854/): arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE (critical 9.8)
- [CVE-2026-42853](https://insights.sbomify.com/CVE-2026-42853/): @apostrophecms/cli: Command Injection in apos create via Unsanitized Password Input (medium 6.5)
- [CVE-2026-42851](https://insights.sbomify.com/CVE-2026-42851/): @kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE (high 7.8)
- [CVE-2026-42850](https://insights.sbomify.com/CVE-2026-42850/): Kitty has a shell command injection (high 7.4)
- [CVE-2026-4285](https://insights.sbomify.com/CVE-2026-4285/): taoofagi easegen-admin Pdf2MdUtil.java recognizeMarkdown path traversal (medium 5.1)
- [CVE-2026-42849](https://insights.sbomify.com/CVE-2026-42849/): authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover (critical 9.3)
- [CVE-2026-42847](https://insights.sbomify.com/CVE-2026-42847/): ClipBucket: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (high 7.1)
- [CVE-2026-42846](https://insights.sbomify.com/CVE-2026-42846/): ClipBucket: Remote Play URL Command Injection (critical 9.8)
- [CVE-2026-42845](https://insights.sbomify.com/CVE-2026-42845/): Grav: Anonymous Page Content Overwrite via Form File Upload filename Override (high 7.7)
- [CVE-2026-42844](https://insights.sbomify.com/CVE-2026-42844/): Grav: Low-privileged API users can create super-admin accounts via blueprint-upload (high 8.7)
- [CVE-2026-42843](https://insights.sbomify.com/CVE-2026-42843/): grav-plugin-api: Grav API Privilege Escalation to Super Admin (high 8.8)
- [CVE-2026-42842](https://insights.sbomify.com/CVE-2026-42842/): grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel (medium 5.4)
- [CVE-2026-42841](https://insights.sbomify.com/CVE-2026-42841/): Grav: Stored XSS via Markdown media attribute() action in Grav CMS (medium 6.9)
- [CVE-2026-42840](https://insights.sbomify.com/CVE-2026-42840/): ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals (medium 5.1)
- [CVE-2026-4284](https://insights.sbomify.com/CVE-2026-4284/): taoofagi easegen-admin PPT File PPTUtil.java downloadFile server-side request forgery (medium 5.1)
- [CVE-2026-42839](https://insights.sbomify.com/CVE-2026-42839/): ERPNext 16.16.0 - Stored XSS in POS cart item rendering (medium 4.8)
- [CVE-2026-42838](https://insights.sbomify.com/CVE-2026-42838/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 5.4)
- [CVE-2026-42837](https://insights.sbomify.com/CVE-2026-42837/): Windows Projected File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42836](https://insights.sbomify.com/CVE-2026-42836/): Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-42835](https://insights.sbomify.com/CVE-2026-42835/): Microsoft Teams for Android Information Disclosure Vulnerability (high 8.1)
- [CVE-2026-42834](https://insights.sbomify.com/CVE-2026-42834/): Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42833](https://insights.sbomify.com/CVE-2026-42833/): Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability (critical 9.1)
- [CVE-2026-42832](https://insights.sbomify.com/CVE-2026-42832/): Microsoft Office Spoofing Vulnerability (high 7.7)
- [CVE-2026-42831](https://insights.sbomify.com/CVE-2026-42831/): Microsoft Office Remote Code Execution Vulnerability (high 7.8)
- [CVE-2026-42830](https://insights.sbomify.com/CVE-2026-42830/): Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability (medium 6.5)
- [CVE-2026-4283](https://insights.sbomify.com/CVE-2026-4283/): WP DSGVO Tools (GDPR) <= 3.1.38 - Missing Authorization to Unauthenticated Account Destruction of Non-Admin Users (critical 9.1)
- [CVE-2026-42829](https://insights.sbomify.com/CVE-2026-42829/): Windows Administrator Protection Secure Feature Bypass Vulnerability (high 7.8)
- [CVE-2026-42828](https://insights.sbomify.com/CVE-2026-42828/): Windows Projected File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2026-42827](https://insights.sbomify.com/CVE-2026-42827/): M365 Copilot Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-42826](https://insights.sbomify.com/CVE-2026-42826/): Azure DevOps Information Disclosure Vulnerability (critical 10.0)
- [CVE-2026-42825](https://insights.sbomify.com/CVE-2026-42825/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2026-42824](https://insights.sbomify.com/CVE-2026-42824/): M365 Copilot Information Disclosure Vulnerability (medium 6.5)
- [CVE-2026-42823](https://insights.sbomify.com/CVE-2026-42823/): Azure Logic Apps Elevation of Privilege Vulnerability (critical 9.9)
- [CVE-2026-42822](https://insights.sbomify.com/CVE-2026-42822/): Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability (critical 10.0)
- [CVE-2026-4282](https://insights.sbomify.com/CVE-2026-4282/): Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw (high 7.4)
- [CVE-2026-42812](https://insights.sbomify.com/CVE-2026-42812/): Apache Polaris: No protection on `write.metadata.path` (critical 9.4)
- [CVE-2026-42811](https://insights.sbomify.com/CVE-2026-42811/): Apache Polaris has an Improper Input Validation issue (critical 9.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/646/