# Vulnerabilities published in 2026 - [CVE-2026-20936](https://insights.sbomify.com/CVE-2026-20936/): Windows NDIS Information Disclosure Vulnerability (medium 4.3) - [CVE-2026-20935](https://insights.sbomify.com/CVE-2026-20935/): Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability (medium 6.2) - [CVE-2026-20934](https://insights.sbomify.com/CVE-2026-20934/): Windows SMB Server Elevation of Privilege Vulnerability (high 7.5) - [CVE-2026-20932](https://insights.sbomify.com/CVE-2026-20932/): Windows File Explorer Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-20931](https://insights.sbomify.com/CVE-2026-20931/): Windows Telephony Service Elevation of Privilege Vulnerability (high 8.0) - [CVE-2026-20930](https://insights.sbomify.com/CVE-2026-20930/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-2093](https://insights.sbomify.com/CVE-2026-2093/): Flowring｜Docpedia - SQL Injection (high 8.7) - [CVE-2026-20929](https://insights.sbomify.com/CVE-2026-20929/): Windows HTTP.sys Elevation of Privilege Vulnerability (high 7.5) - [CVE-2026-20928](https://insights.sbomify.com/CVE-2026-20928/): Windows Recovery Environment Security Feature Bypass Vulnerability (medium 4.6) - [CVE-2026-20927](https://insights.sbomify.com/CVE-2026-20927/): Windows SMB Server Denial of Service Vulnerability (medium 5.3) - [CVE-2026-20926](https://insights.sbomify.com/CVE-2026-20926/): Windows SMB Server Elevation of Privilege Vulnerability (high 7.5) - [CVE-2026-20925](https://insights.sbomify.com/CVE-2026-20925/): NTLM Hash Disclosure Spoofing Vulnerability (medium 6.5) - [CVE-2026-20924](https://insights.sbomify.com/CVE-2026-20924/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20923](https://insights.sbomify.com/CVE-2026-20923/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20922](https://insights.sbomify.com/CVE-2026-20922/): Windows NTFS Remote Code Execution Vulnerability (high 7.8) - [CVE-2026-20921](https://insights.sbomify.com/CVE-2026-20921/): Windows SMB Server Elevation of Privilege Vulnerability (high 7.5) - [CVE-2026-20920](https://insights.sbomify.com/CVE-2026-20920/): Win32k Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-2092](https://insights.sbomify.com/CVE-2026-2092/): Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions (high 7.7) - [CVE-2026-20919](https://insights.sbomify.com/CVE-2026-20919/): Windows SMB Server Elevation of Privilege Vulnerability (high 7.5) - [CVE-2026-20918](https://insights.sbomify.com/CVE-2026-20918/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20917](https://insights.sbomify.com/CVE-2026-20917/): Information disclosure in Intel(R) Processors (medium 4.0) - [CVE-2026-20916](https://insights.sbomify.com/CVE-2026-20916/): BIG-IQ iControl REST vulnerability (high 7.2) - [CVE-2026-20915](https://insights.sbomify.com/CVE-2026-20915/): Stored cross-site scripting in Pending Changes sidebar (high 8.5) - [CVE-2026-20914](https://insights.sbomify.com/CVE-2026-20914/): Null dereference in Intel(R) QAT software drivers for Windows (medium 6.8) - [CVE-2026-20913](https://insights.sbomify.com/CVE-2026-20913/): Privilege escalation in Intel(R) Neural Compressor software (medium 4.8) - [CVE-2026-20912](https://insights.sbomify.com/CVE-2026-20912/): Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure (critical 9.1) - [CVE-2026-20911](https://insights.sbomify.com/CVE-2026-20911/): Memory corruption in LibRaw (critical 9.8) - [CVE-2026-20910](https://insights.sbomify.com/CVE-2026-20910/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0) - [CVE-2026-20909](https://insights.sbomify.com/CVE-2026-20909/): Gitea tracked-time list endpoint has insufficient permission checks (medium 5.3) - [CVE-2026-20908](https://insights.sbomify.com/CVE-2026-20908/): Race condition in Intel(R) NPU Driver for Windows (medium 5.8) - [CVE-2026-20906](https://insights.sbomify.com/CVE-2026-20906/): Security feature bypass in Intel(R) Neural Compressor software (medium 5.4) - [CVE-2026-20905](https://insights.sbomify.com/CVE-2026-20905/): Denial of service in Intel(R) QAT software drivers for Windows (medium 6.9) - [CVE-2026-20904](https://insights.sbomify.com/CVE-2026-20904/): Gitea: Broken access control in OpenID visibility toggle enables cross-user visibility changes (medium 6.5) - [CVE-2026-20903](https://insights.sbomify.com/CVE-2026-20903/): Security feature bypass in Intel(R) AI Containers (medium 5.4) - [CVE-2026-20902](https://insights.sbomify.com/CVE-2026-20902/): Copeland XWEB and XWEB Pro OS Command Injection (high 8.0) - [CVE-2026-20901](https://insights.sbomify.com/CVE-2026-20901/): Other in Intel(R) Xeon(R) processors (medium 4.0) - [CVE-2026-2090](https://insights.sbomify.com/CVE-2026-2090/): SourceCodester Online Class Record System search.php sql injection (medium 6.9) - [CVE-2026-20898](https://insights.sbomify.com/CVE-2026-20898/): Privilege escalation in in Alias Checking Trusted Module for some Intel(R) Xeon(R) processors may allow an escalation of privilege. Startup code and SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (high), integrity (high) and availability (none) impacts. (high 8.5) - [CVE-2026-20897](https://insights.sbomify.com/CVE-2026-20897/): Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR) (critical 9.1) - [CVE-2026-20896](https://insights.sbomify.com/CVE-2026-20896/): Gitea Docker image trusts spoofable reverse-proxy headers by default (critical 9.8) - [CVE-2026-20895](https://insights.sbomify.com/CVE-2026-20895/): EV2GO ev2go.io Insufficient Session Expiration (medium 6.9) - [CVE-2026-20894](https://insights.sbomify.com/CVE-2026-20894/): Cross-site scripting in Multiple Network Cameras TRIFORA 3 series (medium 4.8) - [CVE-2026-20893](https://insights.sbomify.com/CVE-2026-20893/): Privilege escalation in Fujitsu Security Solution AuthConductor Client Basic V2 (high 8.5) - [CVE-2026-20892](https://insights.sbomify.com/CVE-2026-20892/): Code injection in MR-GM5A-L1 (high 8.6) - [CVE-2026-20891](https://insights.sbomify.com/CVE-2026-20891/): Auth bypass in Intel(R) PROSet/Wireless WiFi Software for Windows (medium 6.3) - [CVE-2026-20890](https://insights.sbomify.com/CVE-2026-20890/): Privilege escalation in Intel(R) PROSet/Wireless WiFi Software for Windows (high 7.1) - [CVE-2026-2089](https://insights.sbomify.com/CVE-2026-2089/): SourceCodester Online Class Record System controller.php sql injection (medium 6.9) - [CVE-2026-20889](https://insights.sbomify.com/CVE-2026-20889/): Memory corruption in LibRaw (critical 9.8) - [CVE-2026-20888](https://insights.sbomify.com/CVE-2026-20888/): Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass) (medium 4.3) - [CVE-2026-20887](https://insights.sbomify.com/CVE-2026-20887/): Missing authorization in Intel Vision software (high 8.8) - [CVE-2026-20886](https://insights.sbomify.com/CVE-2026-20886/): Memory corruption in Intel(R) PROSet/Wireless WiFi Software for Windows (medium 6.9) - [CVE-2026-20885](https://insights.sbomify.com/CVE-2026-20885/): Auth bypass in Intel(R) platforms (high 7.0) - [CVE-2026-20884](https://insights.sbomify.com/CVE-2026-20884/): Integer overflow in LibRaw (high 8.1) - [CVE-2026-20883](https://insights.sbomify.com/CVE-2026-20883/): Gitea Stopwatch API Missing Authorization Check Leads to Post-Revocation Information Disclosure (medium 6.5) - [CVE-2026-20882](https://insights.sbomify.com/CVE-2026-20882/): Mobiliti e-mobi.hu Improper Restriction of Excessive Authentication Attempts (high 8.7) - [CVE-2026-20881](https://insights.sbomify.com/CVE-2026-20881/): Denial of service in Intel(R) QAT software drivers for Windows (medium 6.8) - [CVE-2026-2088](https://insights.sbomify.com/CVE-2026-2088/): PHPGurukul Beauty Parlour Management System accepted-appointment.php sql injection (medium 6.9) - [CVE-2026-20879](https://insights.sbomify.com/CVE-2026-20879/): Memory corruption in Intel(R) Data Center Graphics Driver for VMware ESXi software (high 8.3) - [CVE-2026-20878](https://insights.sbomify.com/CVE-2026-20878/): Null dereference in Intel(R) PROSet/Wireless WiFi Software for Windows (high 7.1) - [CVE-2026-20877](https://insights.sbomify.com/CVE-2026-20877/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20876](https://insights.sbomify.com/CVE-2026-20876/): Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability (medium 6.7) - [CVE-2026-20875](https://insights.sbomify.com/CVE-2026-20875/): Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability (high 7.5) - [CVE-2026-20874](https://insights.sbomify.com/CVE-2026-20874/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20873](https://insights.sbomify.com/CVE-2026-20873/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20872](https://insights.sbomify.com/CVE-2026-20872/): NTLM Hash Disclosure Spoofing Vulnerability (medium 6.5) - [CVE-2026-20871](https://insights.sbomify.com/CVE-2026-20871/): Desktop Window Manager Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20870](https://insights.sbomify.com/CVE-2026-20870/): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-2087](https://insights.sbomify.com/CVE-2026-2087/): SourceCodester Online Class Record System login.php sql injection (medium 6.9) - [CVE-2026-20869](https://insights.sbomify.com/CVE-2026-20869/): Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-20868](https://insights.sbomify.com/CVE-2026-20868/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8) - [CVE-2026-20867](https://insights.sbomify.com/CVE-2026-20867/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20866](https://insights.sbomify.com/CVE-2026-20866/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20865](https://insights.sbomify.com/CVE-2026-20865/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20864](https://insights.sbomify.com/CVE-2026-20864/): Windows Connected Devices Platform Service Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20863](https://insights.sbomify.com/CVE-2026-20863/): Win32k Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-20862](https://insights.sbomify.com/CVE-2026-20862/): Windows Management Services Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-20861](https://insights.sbomify.com/CVE-2026-20861/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20860](https://insights.sbomify.com/CVE-2026-20860/): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-2086](https://insights.sbomify.com/CVE-2026-2086/): UTT HiPER 810G Management formFireWall strcpy buffer overflow (high 8.7) - [CVE-2026-20859](https://insights.sbomify.com/CVE-2026-20859/): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20858](https://insights.sbomify.com/CVE-2026-20858/): Windows Management Services Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20857](https://insights.sbomify.com/CVE-2026-20857/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20856](https://insights.sbomify.com/CVE-2026-20856/): Windows Server Update Service (WSUS) Remote Code Execution Vulnerability (high 8.1) - [CVE-2026-20854](https://insights.sbomify.com/CVE-2026-20854/): Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability (high 7.5) - [CVE-2026-20853](https://insights.sbomify.com/CVE-2026-20853/): Windows WalletService Elevation of Privilege Vulnerability (high 7.4) - [CVE-2026-20852](https://insights.sbomify.com/CVE-2026-20852/): Windows Hello Tampering Vulnerability (high 7.7) - [CVE-2026-20851](https://insights.sbomify.com/CVE-2026-20851/): Capability Access Management Service (camsvc) Information Disclosure Vulnerability (medium 6.2) - [CVE-2026-2085](https://insights.sbomify.com/CVE-2026-2085/): D-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub_419F20 command injection (high 8.6) - [CVE-2026-20849](https://insights.sbomify.com/CVE-2026-20849/): Windows Kerberos Elevation of Privilege Vulnerability (high 7.5) - [CVE-2026-20848](https://insights.sbomify.com/CVE-2026-20848/): Windows SMB Server Elevation of Privilege Vulnerability (high 7.5) - [CVE-2026-20847](https://insights.sbomify.com/CVE-2026-20847/): Microsoft Windows File Explorer Spoofing Vulnerability (medium 6.5) - [CVE-2026-20846](https://insights.sbomify.com/CVE-2026-20846/): GDI+ Denial of Service Vulnerability (high 7.5) - [CVE-2026-20844](https://insights.sbomify.com/CVE-2026-20844/): Windows Clipboard Server Elevation of Privilege Vulnerability (high 7.4) - [CVE-2026-20843](https://insights.sbomify.com/CVE-2026-20843/): Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability (high 7.8) - [CVE-2026-20842](https://insights.sbomify.com/CVE-2026-20842/): Microsoft DWM Core Library Elevation of Privilege Vulnerability (high 7.0) - [CVE-2026-20841](https://insights.sbomify.com/CVE-2026-20841/): Windows Notepad App Remote Code Execution Vulnerability (high 7.8) - [CVE-2026-20840](https://insights.sbomify.com/CVE-2026-20840/): Windows NTFS Remote Code Execution Vulnerability (high 7.8) - [CVE-2026-2084](https://insights.sbomify.com/CVE-2026-2084/): D-Link DIR-823X set_language os command injection (high 8.6) - [CVE-2026-20839](https://insights.sbomify.com/CVE-2026-20839/): Windows Client-Side Caching (CSC) Service Information Disclosure Vulnerability (medium 5.5) - [CVE-2026-20838](https://insights.sbomify.com/CVE-2026-20838/): Windows Kernel Information Disclosure Vulnerability (medium 5.5) --- From sbomify Insights: https://insights.sbomify.com/years/2026/page/811/