# CVEs published 2026-07-14 1,007 CVEs were published on July 14, 2026: 73 critical, 590 high. 8 are now in CISA KEV. Days are UTC. - [CVE-2026-15753](https://cve.now/CVE-2026-15753.md): zhinianboke xianyu-auto-reply review approve trusting http permission methods on the server side (CVSS 5.3, zhinianboke xianyu-auto-reply) - [CVE-2026-5269](https://cve.now/CVE-2026-5269.md): Navigator NCS and MCP System Accounts with Default Passwords (CVSS 9.8, CIENA Navigator NCS · CIENA MCP +1) - [CVE-2026-5270](https://cve.now/CVE-2026-5270.md): Authentication Bypass in Navigator and Blue Planet Products (CVSS 9.8, CIENA Navigator NCS · CIENA MCP +5) - [CVE-2026-15752](https://cve.now/CVE-2026-15752.md): zhinianboke xianyu-auto-reply Backend User Endpoint users authorization (CVSS 6.9, zhinianboke xianyu-auto-reply) - [CVE-2026-15751](https://cve.now/CVE-2026-15751.md): mastergo-design mastergo-magic-mcp mcp\_\_getComponentGenerator component-workflow.md execute path traversal (CVSS 4.8, mastergo-design mastergo-magic-mcp) - [CVE-2026-54684](https://cve.now/CVE-2026-54684.md): jadx: XAPK archive entries with absolute paths can plant drop-in plugins and achieve code execution on the next jadx run (CVSS 7.0, skylot jadx) - [CVE-2026-42447](https://cve.now/CVE-2026-42447.md): jadx: HTML Injection in Summary panel (CVSS 3.6, skylot jadx) - [CVE-2026-42049](https://cve.now/CVE-2026-42049.md): jadx: RCE Via Groovy Code Injection in Gradle Export (CVSS 8.4, skylot jadx) - [CVE-2026-59733](https://cve.now/CVE-2026-59733.md): rclone \`serve restic --private-repos\` authorization bypass: \`..\` in the URL path lets an authenticated user read, overwrite and delete other users' repositories (CVSS 8.8, rclone · github.com/rclone/rclone) - [CVE-2026-54572](https://cve.now/CVE-2026-54572.md): rclone: Unvalidated symlink target in local \`--links\` — arbitrary file write from an untrusted remote (CVSS 7.5, rclone · github.com/rclone/rclone) - [CVE-2026-21840](https://cve.now/CVE-2026-21840.md): HCL BigFix Platform is affected by a user enumeration vulnerability (CVSS 3.1, HCLSoftware HCL BigFix Platform) - [CVE-2026-59732](https://cve.now/CVE-2026-59732.md): rclone archive extract allows S3 destination prefix escape via crafted archive paths (CVSS 5.0, rclone · github.com/rclone/rclone) - [CVE-2026-50130](https://cve.now/CVE-2026-50130.md): Pi-hole: Local privilege escalation from \`pihole\` user to root via \`/etc/pihole/logrotate\` (CVSS 8.8, pi-hole) - [CVE-2026-48295](https://cve.now/CVE-2026-48295.md): CAI Content Credentials | Insufficiently Protected Credentials (CWE-522) (CVSS 7.5, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-48290](https://cve.now/CVE-2026-48290.md): CAI Content Credentials | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 8.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-48357](https://cve.now/CVE-2026-48357.md): CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-48296](https://cve.now/CVE-2026-48296.md): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-48287](https://cve.now/CVE-2026-48287.md): CAI Content Credentials | Untrusted Search Path (CWE-426) (CVSS 7.4, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-48312](https://cve.now/CVE-2026-48312.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 6.8, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-48351](https://cve.now/CVE-2026-48351.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 7.5, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-48302](https://cve.now/CVE-2026-48302.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-48354](https://cve.now/CVE-2026-48354.md): CAI Content Credentials | Integer Overflow or Wraparound (CWE-190) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-48298](https://cve.now/CVE-2026-48298.md): CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191) (CVSS 6.2, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-48352](https://cve.now/CVE-2026-48352.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 7.5, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-48353](https://cve.now/CVE-2026-48353.md): CAI Content Credentials | Improper Input Validation (CWE-20) (CVSS 5.5, Adobe Content Credentials Rust SDK · Adobe Content Crede… +1) - [CVE-2026-45363](https://cve.now/CVE-2026-45363.md): \`jwt\` (Ruby gem) - empty-key HMAC bypass (CVSS 9.1, ruby-jwt · jwt) - [CVE-2026-15750](https://cve.now/CVE-2026-15750.md): mastergo-design mastergo-magic-mcp mcp\_\_getComponentLink get-component-link.ts z.string server-side request forgery (CVSS 5.3, mastergo-design mastergo-magic-mcp) - [CVE-2026-48807](https://cve.now/CVE-2026-48807.md): Twig: Sandbox \`\_\_toString()\` policy bypass via \`Traversable\` in \`join\` and \`replace\` filters (CVSS 7.1, twigphp Twig · twig/twig) - [CVE-2026-48806](https://cve.now/CVE-2026-48806.md): Twig: Sandbox \`\_\_toString()\` policy bypass via dynamic mapping keys (CVSS 7.1, twigphp Twig · twig/twig) - [CVE-2026-48808](https://cve.now/CVE-2026-48808.md): Twig: Sandbox property allowlist bypass via the \`column\` filter under \`SourcePolicyInterface\` (CVSS 6.0, twigphp Twig · twig/twig) - [CVE-2026-48805](https://cve.now/CVE-2026-48805.md): Twig: Sandbox state regression in deprecated internal wrappers in \`src/Resources/core.php\` (CVSS 5.3, twigphp Twig · twig/twig) - [CVE-2026-49981](https://cve.now/CVE-2026-49981.md): Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached \`Template\` (CVSS 6.0, twigphp Twig · twig/twig) - [CVE-2026-46637](https://cve.now/CVE-2026-46637.md): Twig: HTML-output filters in twig/\* extras incorrectly declared \`is\_safe =\> \['all'\]\` (CVSS 5.1, twigphp Twig · twig cssinliner-extra +3) - [CVE-2026-46638](https://cve.now/CVE-2026-46638.md): Twig: \`{% sandbox %}{% include %}\` skips checkSecurity() on cached templates (incomplete fix for CVE-2024-45411) (CVSS 6.0, twigphp Twig · twig/twig) - [CVE-2026-46640](https://cve.now/CVE-2026-46640.md): Twig: Arbitrary PHP code execution via \`\_self.(\)\` macro-reference compilation (CVSS 8.7, twigphp Twig · twig/twig) - [CVE-2026-46629](https://cve.now/CVE-2026-46629.md): Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments (CVSS 5.3, twigphp Twig · twig/intl-extra) - [CVE-2026-47730](https://cve.now/CVE-2026-47730.md): Twig: XSS in profiler HtmlDumper via unescaped template and profile names (CVSS 5.1, twigphp Twig · twig/twig) - [CVE-2026-46628](https://cve.now/CVE-2026-46628.md): Twig: The \`spaceless\` filter implicitly marks its output as safe (CVSS 5.1, twigphp Twig · twig/twig) - [CVE-2026-46634](https://cve.now/CVE-2026-46634.md): Twig: \`template\_from\_string()\` escapes a SourcePolicy-driven sandbox via synthesized template name (CVSS 7.7, twigphp Twig · twig/twig) - [CVE-2026-48336](https://cve.now/CVE-2026-48336.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator Desktop) - [CVE-2026-48335](https://cve.now/CVE-2026-48335.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator Desktop) - [CVE-2026-48337](https://cve.now/CVE-2026-48337.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator Desktop) - [CVE-2026-48334](https://cve.now/CVE-2026-48334.md): Illustrator | Improper Input Validation (CWE-20) (CVSS 9.3, Adobe Illustrator Desktop) - [CVE-2026-48275](https://cve.now/CVE-2026-48275.md): Illustrator | Untrusted Search Path (CWE-426) (CVSS 8.6, Adobe Illustrator Desktop) - [CVE-2026-46627](https://cve.now/CVE-2026-46627.md): Twig: Sandbox resource exhaustion via unbounded \`for\` / \`range()\` (CVSS 7.1, twigphp Twig) - [CVE-2026-46633](https://cve.now/CVE-2026-46633.md): Twig: PHP code injection via \`{% use %}\` template name (CVSS 8.7, twigphp Twig · twig/twig) - [CVE-2026-46639](https://cve.now/CVE-2026-46639.md): Twig: Sandbox property and method bypass via object-destructuring assignment (CVSS 7.1, twigphp Twig · twig/twig) - [CVE-2026-46635](https://cve.now/CVE-2026-46635.md): Twig: Sandbox property allowlist bypass via the \`column\` filter (array\_column on objects) (CVSS 5.3, twigphp Twig · twig/twig) - [CVE-2026-47732](https://cve.now/CVE-2026-47732.md): Twig Sandbox: multiple \`\_\_toString()\` policy bypasses via unguarded string coercion points (CVSS 7.1, twigphp Twig · twig/twig) - [CVE-2026-48320](https://cve.now/CVE-2026-48320.md): ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 8.5, Adobe ColdFusion) - [CVE-2026-48324](https://cve.now/CVE-2026-48324.md): ColdFusion | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 9.1, Adobe ColdFusion) - [CVE-2026-48332](https://cve.now/CVE-2026-48332.md): ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 7.7, Adobe ColdFusion) - [CVE-2026-48318](https://cve.now/CVE-2026-48318.md): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 9.9, Adobe ColdFusion) - [CVE-2026-48327](https://cve.now/CVE-2026-48327.md): ColdFusion | Incorrect Authorization (CWE-863) (CVSS 9.0, Adobe ColdFusion) - [CVE-2026-48338](https://cve.now/CVE-2026-48338.md): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 6.8, Adobe ColdFusion) - [CVE-2026-48329](https://cve.now/CVE-2026-48329.md): ColdFusion | Insufficient Session Expiration (CWE-613) (CVSS 2.7, Adobe ColdFusion) - [CVE-2026-48319](https://cve.now/CVE-2026-48319.md): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 9.1, Adobe ColdFusion) - [CVE-2026-48321](https://cve.now/CVE-2026-48321.md): ColdFusion | Incorrect Authorization (CWE-863) (CVSS 9.3, Adobe ColdFusion) - [CVE-2026-48322](https://cve.now/CVE-2026-48322.md): ColdFusion | Improper Control of Generation of Code ('Code Injection') (CWE-94) (CVSS 9.9, Adobe ColdFusion) - [CVE-2026-48284](https://cve.now/CVE-2026-48284.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 9.6, Adobe ColdFusion) - [CVE-2026-48328](https://cve.now/CVE-2026-48328.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 7.7, Adobe ColdFusion) - [CVE-2026-48325](https://cve.now/CVE-2026-48325.md): ColdFusion | Missing Authentication for Critical Function (CWE-306) (CVSS 9.3, Adobe ColdFusion) - [CVE-2026-15749](https://cve.now/CVE-2026-15749.md): mastergo-design mastergo-magic-mcp mcp\_\_C2d get-c2d.ts execute path traversal (CVSS 4.8, mastergo-design mastergo-magic-mcp) - [CVE-2026-48125](https://cve.now/CVE-2026-48125.md): UAParser.js: Unbounded \`Sec-CH-UA-Model\` parsing can trigger ReDoS in \`withClientHints()\` (CVSS 5.3, faisalman ua-parser-js · ua-parser-js) - [CVE-2026-49476](https://cve.now/CVE-2026-49476.md): Soup Sieve: Memory Exhaustion via Large Comma-Separated Selector Lists in soupsieve (CVSS 7.5, facelessuser soupsieve · soupsieve) - [CVE-2026-49477](https://cve.now/CVE-2026-49477.md): Soup Sieve: Regular Expression Denial of Service (ReDoS) in soupsieve Selector Parser (CVSS 7.5, facelessuser soupsieve · soupsieve) - [CVE-2026-46644](https://cve.now/CVE-2026-46644.md): symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence (CVSS 6.9, symfony polyfill · symfony polyfill-intl-idn +2) - [CVE-2026-49855](https://cve.now/CVE-2026-49855.md): tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb) (CVSS 7.5, tornadoweb tornado · tornado) - [CVE-2026-49854](https://cve.now/CVE-2026-49854.md): Tornado: Out-of-bounds memory access in C extension (CVSS 5.3, tornadoweb tornado · tornado) - [CVE-2026-49853](https://cve.now/CVE-2026-49853.md): Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient (CVSS 7.7, tornadoweb tornado · tornado) - [CVE-2026-48816](https://cve.now/CVE-2026-48816.md): sigstore-js: Insufficient Verification of Data Authenticity (CVSS 6.5, sigstore-js · @sigstore/verify) - [CVE-2026-48758](https://cve.now/CVE-2026-48758.md): sigstore-js: DSSE payloadType type-binding failure (CVSS 5.4, sigstore-js · @sigstore/core) - [CVE-2026-48340](https://cve.now/CVE-2026-48340.md): Bridge | Untrusted Pointer Dereference (CWE-822) (CVSS 7.8, Adobe Bridge) - [CVE-2026-48343](https://cve.now/CVE-2026-48343.md): Bridge | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Bridge) - [CVE-2026-48339](https://cve.now/CVE-2026-48339.md): Bridge | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Bridge) - [CVE-2026-48311](https://cve.now/CVE-2026-48311.md): Bridge | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Bridge) - [CVE-2026-48342](https://cve.now/CVE-2026-48342.md): Bridge | Integer Overflow or Wraparound (CWE-190) (CVSS 7.8, Adobe Bridge) - [CVE-2026-48341](https://cve.now/CVE-2026-48341.md): Bridge | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Bridge) - [CVE-2026-48815](https://cve.now/CVE-2026-48815.md): sigstore-js: \`certificateOIDs\` verification constraints are silently dropped and never enforced (CVSS 7.5, sigstore-js · sigstore) - [CVE-2026-48272](https://cve.now/CVE-2026-48272.md): Creative Cloud Desktop | Uncontrolled Search Path Element (CWE-427) (CVSS 7.8, Adobe Creative Cloud Desktop) - [CVE-2026-48344](https://cve.now/CVE-2026-48344.md): GoCart | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) (CVSS 7.8, Adobe Creative Cloud Desktop) - [CVE-2026-15738](https://cve.now/CVE-2026-15738.md): Cross-namespace traffic interception via incorrect route precedence ordering in AWS Load Balancer Controller (CVSS 5.8, Amazon aws-load-balancer-controller) - [CVE-2026-61520](https://cve.now/CVE-2026-61520.md): Simple Machines Forum SSRF via image proxy (CVSS 6.3, SimpleMachines SMF) - [CVE-2026-24272](https://cve.now/CVE-2026-24272.md): NVIDIA TensorRT contains a vulnerability where an attacker might cause an overflow to a heap-based buffer. (CVSS 7.8, NVIDIA TensorRT) - [CVE-2026-24268](https://cve.now/CVE-2026-24268.md): NVIDIA TensorRT contains a vulnerability where an attacker might cause a heap-based buffer overflow. (CVSS 7.8, NVIDIA TensorRT) - [CVE-2026-24238](https://cve.now/CVE-2026-24238.md): NVIDIA TensorRT for contains a vulnerability where an attacker might cause an improper validation of array index. (CVSS 7.8, NVIDIA TensorRT) - [CVE-2026-24227](https://cve.now/CVE-2026-24227.md): NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. (CVSS 5.3, NVIDIA TensorRT) - [CVE-2026-15778](https://cve.now/CVE-2026-15778.md): Insufficient validation of untrusted input in Navigation in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromi (CVSS 6.5, Google Chrome) - [CVE-2026-15777](https://cve.now/CVE-2026-15777.md): Use after free in UI in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific (CVSS 7.5, Google Chrome) - [CVE-2026-15776](https://cve.now/CVE-2026-15776.md): Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a san (CVSS 8.8, Google Chrome) - [CVE-2026-15775](https://cve.now/CVE-2026-15775.md): Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a cra (CVSS 6.5, Google Chrome) - [CVE-2026-15774](https://cve.now/CVE-2026-15774.md): Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potent (CVSS 8.3, Google Chrome) - [CVE-2026-15773](https://cve.now/CVE-2026-15773.md): Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape (CVSS 9.6, Google Chrome) - [CVE-2026-15772](https://cve.now/CVE-2026-15772.md): Use after free in GPU in Google Chrome on Android prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process (CVSS 8.3, Google Chrome) - [CVE-2026-15771](https://cve.now/CVE-2026-15771.md): Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had co (CVSS 5.3, Google Chrome) - [CVE-2026-15770](https://cve.now/CVE-2026-15770.md): Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from (CVSS 6.5, Google Chrome) - [CVE-2026-15769](https://cve.now/CVE-2026-15769.md): Insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attac (CVSS 8.3, Google Chrome) - [CVE-2026-15768](https://cve.now/CVE-2026-15768.md): Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin p (CVSS 6.5, Google Chrome) - [CVE-2026-15767](https://cve.now/CVE-2026-15767.md): Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code insid (CVSS 8.8, Google Chrome) - [CVE-2026-15766](https://cve.now/CVE-2026-15766.md): Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information fro (CVSS 6.5, Google Chrome) - [CVE-2026-15765](https://cve.now/CVE-2026-15765.md): Use after free in Ozone in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specific UI ges (CVSS 7.5, Google Chrome) - [CVE-2026-15764](https://cve.now/CVE-2026-15764.md): Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.125 allowed a remote attacker who convinced a user to engage in specif (CVSS 7.5, Google Chrome) - [CVE-2026-24271](https://cve.now/CVE-2026-24271.md): NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resourc (CVSS 6.2, NVIDIA TensorRT-LLM) - [CVE-2026-47475](https://cve.now/CVE-2026-47475.md): NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API where an attacker could trigger a reachable assertion in (CVSS 6.2, NVIDIA TensorRT-LLM) - [CVE-2026-47470](https://cve.now/CVE-2026-47470.md): NVIDIA TensorRT-LLM for any platform contains a vulnerability in the gRPC server chat API endpoint, where an attacker could cause CWE-20 by (CVSS 6.2, NVIDIA TensorRT-LLM) - [CVE-2026-48367](https://cve.now/CVE-2026-48367.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects) - [CVE-2026-48274](https://cve.now/CVE-2026-48274.md): After Effects | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe After Effects) - [CVE-2026-53486](https://cve.now/CVE-2026-53486.md): decompress: Archive extraction can create files and links outside the target directory (CVSS 9.1, XhmikosR decompress · @xhmikosr/decompress +1) - [CVE-2026-24226](https://cve.now/CVE-2026-24226.md): NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause improper control of code generation. (CVSS 6.3, NVIDIA TensorRT-LLM) - [CVE-2026-24259](https://cve.now/CVE-2026-24259.md): NVIDIA TensorRT-LLM for Linux contains a vulnerability where an attacker could cause missing authentication for a critical function. (CVSS 6.4, NVIDIA TensorRT-LLM) - [CVE-2026-24220](https://cve.now/CVE-2026-24220.md): NVIDIA TensorRT-LLM for any platform contains a vulnerability in visual gen server, where an attacker could cause an unsafe deserialization (CVSS 6.4, NVIDIA TensorRT-LLM) - [CVE-2026-24234](https://cve.now/CVE-2026-24234.md): NVIDIA TensorRT-LLM for Linux contains a vulnerability in the multimodal media fetching functions, where a network-accessible attacker could (CVSS 6.8, NVIDIA TensorRT-LLM) - [CVE-2026-24229](https://cve.now/CVE-2026-24229.md): NVIDIA TensorRT-LLM for Linux contains a vulnerability in the disaggregated orchestrator component, where an attacker could read, write, or (CVSS 7.3, NVIDIA TensorRT-LLM) - [CVE-2026-48269](https://cve.now/CVE-2026-48269.md): Premiere Pro | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Premiere) - [CVE-2026-48369](https://cve.now/CVE-2026-48369.md): Premiere Pro | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Premiere) - [CVE-2026-48270](https://cve.now/CVE-2026-48270.md): Premiere Pro | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Premiere) - [CVE-2026-48308](https://cve.now/CVE-2026-48308.md): Premiere Pro | Improper Input Validation (CWE-20) (CVSS 5.9, Adobe Premiere) - [CVE-2026-15643](https://cve.now/CVE-2026-15643.md): AWS HealthLake MCP Server SSRF via Pagination URL (CVSS 9.2, awslabs.healthlake-mcp-server) - [CVE-2026-48801](https://cve.now/CVE-2026-48801.md): linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop (CVSS 8.7, markdown-it linkify-it · linkify-it) - [CVE-2026-47473](https://cve.now/CVE-2026-47473.md): NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a write-what-where condition. (CVSS 7.4, NVIDIA TensorRT-LLM) - [CVE-2026-49978](https://cve.now/CVE-2026-49978.md): DOMPurify IN\_PLACE Sanitization Bypass via Attached Shadow Root Inside \.content (CVSS 6.3, cure53 DOMPurify · dompurify) - [CVE-2026-47471](https://cve.now/CVE-2026-47471.md): NVIDIA TensorRT-LLM for any platform contains a vulnerability in tensor deserialization, where an attacker could cause a heap based buffer o (CVSS 7.5, NVIDIA TensorRT-LLM) - [CVE-2026-49459](https://cve.now/CVE-2026-49459.md): DOMPurify: IN\_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM (CVSS 6.1, cure53 DOMPurify · dompurify) - [CVE-2026-47472](https://cve.now/CVE-2026-47472.md): NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer where an attacker with local same-user access could ca (CVSS 7.8, NVIDIA TensorRT-LLM) - [CVE-2026-24233](https://cve.now/CVE-2026-24233.md): NVIDIA TensorRT-LLM for Linux contains a vulnerability in the restricted unpickler used for model weight deserialization, where a local, una (CVSS 8.4, NVIDIA TensorRT-LLM) - [CVE-2026-47971](https://cve.now/CVE-2026-47971.md): Media Encoder | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Media Encoder) - [CVE-2026-48366](https://cve.now/CVE-2026-48366.md): Media Encoder | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Media Encoder) - [CVE-2026-47976](https://cve.now/CVE-2026-47976.md): Media Encoder | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Media Encoder) - [CVE-2026-47979](https://cve.now/CVE-2026-47979.md): Media Encoder | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Media Encoder) - [CVE-2026-48370](https://cve.now/CVE-2026-48370.md): Media Encoder | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Media Encoder) - [CVE-2026-49458](https://cve.now/CVE-2026-49458.md): DOMPurify: Cross-realm IN\_PLACE sanitization leaves executable markup intact via realm-bound \`instanceof\` checks (CVSS 6.1, cure53 DOMPurify · dompurify) - [CVE-2026-59889](https://cve.now/CVE-2026-59889.md): jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization (CVSS 6.5, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1) - [CVE-2026-47423](https://cve.now/CVE-2026-47423.md): DOMPurify XSS via \`selectedcontent\` re-clone (CVSS 8.2, cure53 DOMPurify · dompurify) - [CVE-2026-47736](https://cve.now/CVE-2026-47736.md): Puma PROXY Protocol v1 Parser Allows Remote Memory Exhaustion (CVSS 7.5, puma) - [CVE-2026-48346](https://cve.now/CVE-2026-48346.md): Animate | Untrusted Search Path (CWE-426) (CVSS 7.9, Adobe Animate) - [CVE-2026-48345](https://cve.now/CVE-2026-48345.md): Animate | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (CVSS 8.2, Adobe Animate) - [CVE-2026-48347](https://cve.now/CVE-2026-48347.md): Animate | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (CVSS 7.7, Adobe Animate) - [CVE-2026-48349](https://cve.now/CVE-2026-48349.md): Animate | Incorrect Authorization (CWE-863) (CVSS 8.1, Adobe Animate) - [CVE-2026-48348](https://cve.now/CVE-2026-48348.md): Animate | Incorrect Authorization (CWE-863) (CVSS 7.7, Adobe Animate) - [CVE-2026-48350](https://cve.now/CVE-2026-48350.md): Animate | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 8.6, Adobe Animate) - [CVE-2026-15714](https://cve.now/CVE-2026-15714.md): Libsoup: soupmultipartinputstream: libsoup: out-of-bounds read in soup\_multipart\_input\_stream\_read\_headers via an oversized multipart boundary string (CVSS 6.5, Red Hat Enterprise Linux) - [CVE-2026-47482](https://cve.now/CVE-2026-47482.md): NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause missing release of memory after effective life (CVSS 7.5, NVIDIA Triton Inference Server) - [CVE-2026-47481](https://cve.now/CVE-2026-47481.md): NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an authentication bypass through an alternativ (CVSS 6.5, NVIDIA Triton Inference Server) - [CVE-2026-47480](https://cve.now/CVE-2026-47480.md): NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause an uncaught exception. (CVSS 7.5, NVIDIA Triton Inference Server) - [CVE-2026-47479](https://cve.now/CVE-2026-47479.md): NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. (CVSS 7.5, NVIDIA Triton Inference Server) - [CVE-2026-47478](https://cve.now/CVE-2026-47478.md): NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause the use of an expired file descriptor. (CVSS 7.5, NVIDIA Triton Inference Server) - [CVE-2026-15713](https://cve.now/CVE-2026-15713.md): Libsoup: soupcache: libsoup: http/2 frame window exhaustion remote denial of service via memory leak (CVSS 5.9, Red Hat Enterprise Linux) - [CVE-2026-15711](https://cve.now/CVE-2026-15711.md): Libsoup: soupwebsocketconnection: libsoup: websocket remote denial of service via oversized control frame protocol violation (CVSS 7.5, Red Hat Enterprise Linux) - [CVE-2026-47737](https://cve.now/CVE-2026-47737.md): Puma PROXY Protocol v1 Accepts Repeated Protocol Headers on Persistent Connections (CVSS 7.5, puma) - [CVE-2026-47477](https://cve.now/CVE-2026-47477.md): NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause a stack-based buffer overflow. (CVSS 7.5, NVIDIA Triton Inference Server) - [CVE-2026-47984](https://cve.now/CVE-2026-47984.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 8.2, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-47997](https://cve.now/CVE-2026-47997.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.9, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-47988](https://cve.now/CVE-2026-47988.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 8.6, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-47999](https://cve.now/CVE-2026-47999.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.8, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-48358](https://cve.now/CVE-2026-48358.md): Adobe Commerce | Improper Encoding or Escaping of Output (CWE-116) (CVSS 9.1, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-48356](https://cve.now/CVE-2026-48356.md): Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) (CVSS 9.3, KEV, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-47998](https://cve.now/CVE-2026-47998.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 5.9, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-48000](https://cve.now/CVE-2026-48000.md): Adobe Commerce | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (CVSS 6.1, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-47995](https://cve.now/CVE-2026-47995.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.1, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-48001](https://cve.now/CVE-2026-48001.md): Adobe Commerce | Information Exposure (CWE-200) (CVSS 3.7, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-48371](https://cve.now/CVE-2026-48371.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-47996](https://cve.now/CVE-2026-47996.md): Adobe Commerce | Incorrect Authorization (CWE-863) (CVSS 6.8, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-47994](https://cve.now/CVE-2026-47994.md): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 8.7, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-47992](https://cve.now/CVE-2026-47992.md): Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 7.2, Adobe Commerce · Adobe Magento Open Source) - [CVE-2026-47476](https://cve.now/CVE-2026-47476.md): NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker can cause uncontrolled resource consumption. (CVSS 7.5, NVIDIA Triton Inference Server) - [CVE-2026-15410](https://cve.now/CVE-2026-15410.md): Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Man (CVSS 7.2, KEV, SonicWall SMA1000) - [CVE-2026-48069](https://cve.now/CVE-2026-48069.md): @grpc/grps-js: An incoming malformed compressed message can cause a client or server crash (CVSS 7.5, grpc-node · @grpc/grpc-js) - [CVE-2026-15709](https://cve.now/CVE-2026-15709.md): Soupwebsocketextensiondeflate: libsoup: libsoup: websocket permessage-deflate unbounded decompression remote denial of service (CVSS 7.5, Red Hat Enterprise Linux) - [CVE-2026-50659](https://cve.now/CVE-2026-50659.md): .NET Spoofing Vulnerability (CVSS 6.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +15) - [CVE-2026-50651](https://cve.now/CVE-2026-50651.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14) - [CVE-2026-48068](https://cve.now/CVE-2026-48068.md): @grpc/grps-js: A malformed request can cause a server crash (CVSS 7.5, grpc-node · @grpc/grpc-js) - [CVE-2026-15409](https://cve.now/CVE-2026-15409.md): A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. (CVSS 10.0, KEV, SonicWall SMA1000) - [CVE-2026-53633](https://cve.now/CVE-2026-53633.md): Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE (CVSS 9.8, vitest-dev vitest · @vitest/browser +1) - [CVE-2026-13001](https://cve.now/CVE-2026-13001.md): Podlove Podcast Publisher \<= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove\_image\_cache\_url Parameter (CVSS 9.8, eteubert Podlove Podcast Publisher) - [CVE-2026-47428](https://cve.now/CVE-2026-47428.md): Vitest browser mode serves unsanitized otelCarrier query parameter as inline script (CVSS 9.6, vitest-dev vitest · @vitest/browser) - [CVE-2026-50650](https://cve.now/CVE-2026-50650.md): .NET Framework Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +7) - [CVE-2026-50649](https://cve.now/CVE-2026-50649.md): .NET Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +4) - [CVE-2026-50648](https://cve.now/CVE-2026-50648.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4) - [CVE-2026-50646](https://cve.now/CVE-2026-50646.md): .NET Framework Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime +7) - [CVE-2026-50528](https://cve.now/CVE-2026-50528.md): .NET Security Feature Bypass Vulnerability (CVSS 8.2, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14) - [CVE-2026-50527](https://cve.now/CVE-2026-50527.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4) - [CVE-2026-50526](https://cve.now/CVE-2026-50526.md): .NET Tampering Vulnerability (CVSS 7.0, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3) - [CVE-2026-50525](https://cve.now/CVE-2026-50525.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4) - [CVE-2026-50524](https://cve.now/CVE-2026-50524.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +14) - [CVE-2026-47429](https://cve.now/CVE-2026-47429.md): Vitest: Arbitrary file can be read and executed when Vitest UI server is listening (CVSS 9.8, vitest-dev vitest · vitest) - [CVE-2026-48038](https://cve.now/CVE-2026-48038.md): joi: Uncaught RangeError on deeply nested input through recursive \`link()\` schemas (CVSS 5.3, hapijs joi · joi) - [CVE-2026-48761](https://cve.now/CVE-2026-48761.md): Symfony: HtmlSanitizer UrlAttributeSanitizer Misses URL Attributes on \, \, \, \ and the URL Inside \ content (CVSS 5.3, symfony · symfony/html-sanitizer +1) - [CVE-2026-48310](https://cve.now/CVE-2026-48310.md): Adobe Experience Manager | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 8.6, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48259](https://cve.now/CVE-2026-48259.md): Adobe Experience Manager | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 9.6, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48359](https://cve.now/CVE-2026-48359.md): Adobe Experience Manager | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (CVSS 9.6, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48263](https://cve.now/CVE-2026-48263.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48260](https://cve.now/CVE-2026-48260.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48355](https://cve.now/CVE-2026-48355.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48261](https://cve.now/CVE-2026-48261.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48253](https://cve.now/CVE-2026-48253.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48262](https://cve.now/CVE-2026-48262.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48252](https://cve.now/CVE-2026-48252.md): Adobe Experience Manager | Missing Authentication for Critical Function (CWE-306) (CVSS 8.6, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48255](https://cve.now/CVE-2026-48255.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48257](https://cve.now/CVE-2026-48257.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48254](https://cve.now/CVE-2026-48254.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager as a Cloud Service · Adobe Expe… +1) - [CVE-2026-48747](https://cve.now/CVE-2026-48747.md): Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade (CVSS 6.3, symfony · symfony/mailomat-mailer +1) - [CVE-2026-48489](https://cve.now/CVE-2026-48489.md): Symfony: Security Firewall Bypass via failure\_forward Subrequest: Unauthenticated Access to access\_control-Protected GET Routes (CVSS 8.7, symfony · symfony/security-http +1) - [CVE-2026-48760](https://cve.now/CVE-2026-48760.md): Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense (CVSS 5.3, symfony · symfony/html-sanitizer +1) - [CVE-2026-48736](https://cve.now/CVE-2026-48736.md): Symfony: IpUtils::PRIVATE\_SUBNETS Omits IPv6 Transition Forms (6to4, NAT64, Teredo, IPv4-compatible): SSRF Bypass in NoPrivateNetworkHttpClient (CVSS 6.9, symfony · symfony/http-client +2) - [CVE-2026-48784](https://cve.now/CVE-2026-48784.md): Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained \`../\` or \`./\` → Generated URL Collapses Off-Route Under RFC 3986 Normalization (CVSS 5.1, symfony · symfony/routing +1) - [CVE-2026-45068](https://cve.now/CVE-2026-45068.md): Symfony: Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address (CVSS 8.7, symfony · symfony/mailer +1) - [CVE-2026-47212](https://cve.now/CVE-2026-47212.md): Symfony: Twilio Notifier Webhook Parser Never Verifies the X-Twilio-Signature HMAC: Unauthenticated Webhook Event Injection (CVSS 6.9, symfony · symfony/symfony +1) - [CVE-2026-45071](https://cve.now/CVE-2026-45071.md): Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true (CVSS 8.7, symfony · symfony/dom-crawler +1) - [CVE-2026-45755](https://cve.now/CVE-2026-45755.md): Symfony: Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC — Unauthenticated Webhook Event Injection (CVSS 6.9, symfony · /mailtrap-mailer mailtrap-mailer +2) - [CVE-2026-45754](https://cve.now/CVE-2026-45754.md): Symfony: Mailjet Mailer Webhook Parser Never Verifies the Configured Secret — Unauthenticated Webhook Event Injection (CVSS 6.9, symfony · symfony/lox24-notifier +2) - [CVE-2026-45305](https://cve.now/CVE-2026-45305.md): Symfony: YAML Parser ReDoS via Catastrophic Backtracking in Parser::cleanup() Regex (CVSS 8.7, symfony · symfony/yaml +1) - [CVE-2026-45304](https://cve.now/CVE-2026-45304.md): Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs") (CVSS 8.7, symfony · symfony/yaml +1) - [CVE-2026-45069](https://cve.now/CVE-2026-45069.md): Symfony: OidcTokenHandler Accepts JWTs Missing aud/iss/exp Claims (CVSS 8.8, symfony · symfony/security-http +1) - [CVE-2026-47305](https://cve.now/CVE-2026-47305.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio) - [CVE-2026-47304](https://cve.now/CVE-2026-47304.md): .NET Security Feature Bypass Vulnerability (CVSS 8.1, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +4) - [CVE-2026-47303](https://cve.now/CVE-2026-47303.md): ASP.NET Core Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3) - [CVE-2026-47302](https://cve.now/CVE-2026-47302.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +16) - [CVE-2026-47301](https://cve.now/CVE-2026-47301.md): Configuration Manager Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Configuration Manager) - [CVE-2026-45133](https://cve.now/CVE-2026-45133.md): Symfony: \[Yaml\] Harden the parser when handling untrusted input (CVSS 8.2, symfony · symfony/yaml +1) - [CVE-2026-45075](https://cve.now/CVE-2026-45075.md): Symfony: HEAD Request Bypasses methods: \['GET'\] Filter in #\[IsGranted\] / #\[IsSignatureValid\] / #\[IsCsrfTokenValid\] (CVSS 8.3, symfony · symfony/http-kernel +2) - [CVE-2026-47767](https://cve.now/CVE-2026-47767.md): Symfony: SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP\_ENV/APP\_DEBUG via parse\_str/SAPI Argv Mismatch (CVSS 8.3, symfony · symfony/runtime +1) - [CVE-2026-45064](https://cve.now/CVE-2026-45064.md): Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing (CVSS 2.3, symfony · symfony/html-sanitizer +1) - [CVE-2026-45063](https://cve.now/CVE-2026-45063.md): Symfony: Identity Spoofing via Unanchored DN Regex in X509Authenticator (CVSS 9.1, symfony · symfony/security-http +1) - [CVE-2026-45070](https://cve.now/CVE-2026-45070.md): Symfony: Email Header Injection via Non-Token Characters in Mime Parameter Names (CVSS 6.3, symfony · symfony/mime +1) - [CVE-2026-45073](https://cve.now/CVE-2026-45073.md): Symfony: SQL Injection in PdoAdapter::doClear() via Unsanitized $prefix (CVSS 6.3, symfony · cache symfony +2) - [CVE-2026-45753](https://cve.now/CVE-2026-45753.md): Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS) (CVSS 2.1, symfony · symfony/html-sanitizer +1) - [CVE-2026-15720](https://cve.now/CVE-2026-15720.md): Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler (CVSS 8.6, open5gs) - [CVE-2026-47300](https://cve.now/CVE-2026-47300.md): ASP.NET Core Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +3) - [CVE-2026-15712](https://cve.now/CVE-2026-15712.md): Soupclientmessageiohttp2: libsoup3: libsoup: http/2 goaway frame parsing heap buffer over-read via invalid nul-termination assumption (CVSS 5.9, Red Hat Enterprise Linux) - [CVE-2026-15058](https://cve.now/CVE-2026-15058.md): Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to d (CVSS 3.1, Devolutions Server) - [CVE-2026-45072](https://cve.now/CVE-2026-45072.md): Symfony: Stored XSS in WebProfiler CodeExtension::fileExcerpt() — Unescaped Non-PHP File Rendering (CVSS 2.0, symfony · symfony/symfony +2) - [CVE-2026-15642](https://cve.now/CVE-2026-15642.md): Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026. (CVSS 3.3, Devolutions Server) - [CVE-2026-15641](https://cve.now/CVE-2026-15641.md): Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileg (CVSS 7.1, Devolutions Server) - [CVE-2026-15637](https://cve.now/CVE-2026-15637.md): Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authent (CVSS 7.5, Devolutions Server) - [CVE-2026-5040](https://cve.now/CVE-2026-5040.md): Weak Password Hashing Mechanism in TP-Link Deco M5 (CVSS 7.1, TP-Link Systems Deco M5 Deco M5) - [CVE-2026-45756](https://cve.now/CVE-2026-45756.md): Symfony: JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits — ReDoS (CVSS 8.2, symfony · symfony/json-path +1) - [CVE-2026-45066](https://cve.now/CVE-2026-45066.md): Symfony: HtmlSanitizer allowLinkHosts() / allowMediaHosts() Bypass via URL-Parser Differentials and \ Misclassification (CVSS 2.3, symfony · symfony/html-sanitizer +1) - [CVE-2026-45074](https://cve.now/CVE-2026-45074.md): Symfony: Cas2Handler Derives CAS service URL from Client Host Header → Cross-Service Ticket Replay (CVSS 7.6, symfony · symfony/security-http +1) - [CVE-2026-47967](https://cve.now/CVE-2026-47967.md): Audition | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Audition) - [CVE-2026-48309](https://cve.now/CVE-2026-48309.md): Audition | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Audition) - [CVE-2026-47969](https://cve.now/CVE-2026-47969.md): Audition | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Audition) - [CVE-2026-48365](https://cve.now/CVE-2026-48365.md): Audition | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Audition) - [CVE-2026-47968](https://cve.now/CVE-2026-47968.md): Audition | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Audition) - [CVE-2026-48368](https://cve.now/CVE-2026-48368.md): Audition | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Audition) - [CVE-2026-62659](https://cve.now/CVE-2026-62659.md): Authenticated users can make unauthorized changes on NETGEAR WAX333 Access Points (CVSS 4.3, NETGEAR WAX333) - [CVE-2026-45077](https://cve.now/CVE-2026-45077.md): Symfony: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener (CVSS 8.3, symfony · symfony/monolog-bridge +1) - [CVE-2026-15757](https://cve.now/CVE-2026-15757.md): Insufficient input validation vulnerability in NETGEAR DGND3700v1 modem router (CVSS 6.3, NETGEAR DGND3700v1) - [CVE-2026-62656](https://cve.now/CVE-2026-62656.md): Post-authenticated command injection vulnerability found in certain NETGEAR RAX models (CVSS 5.4, NETGEAR RAXE450 · NETGEAR RAXE500) - [CVE-2026-62655](https://cve.now/CVE-2026-62655.md): A DoS vulnerability due to stack overflow exists in certain NETGEAR Orbi models (CVSS 5.7, NETGEAR RBR860 · NETGEAR RBRE950 +6) - [CVE-2026-62657](https://cve.now/CVE-2026-62657.md): Certificate validation vulnerability in NETGEAR Gaming Router and certain Nighthawk models (CVSS 4.9, NETGEAR MR70 · NETGEAR MS70 +2) - [CVE-2026-62658](https://cve.now/CVE-2026-62658.md): Post-authentication Command Injection Vulnerability in certain Nighthawk RAX series models (CVSS 4.7, NETGEAR RAX43 · NETGEAR RAX45 +3) - [CVE-2026-15715](https://cve.now/CVE-2026-15715.md): SourceCodester Class and Exam Timetabling System exam.php cross site scripting (CVSS 5.3, SourceCodester Class and Exam Timetabling System) - [CVE-2026-45065](https://cve.now/CVE-2026-45065.md): Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection (CVSS 2.3, symfony · symfony/routing +1) - [CVE-2026-45067](https://cve.now/CVE-2026-45067.md): Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\\Component\\Mime\\Address (CVSS 6.3, symfony · symfony/mime +1) - [CVE-2026-4018](https://cve.now/CVE-2026-4018.md): TOCTOU race condition in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety (CVSS 6.4, BlackBerry QNX Software Development Platform · BlackBerr… +1) - [CVE-2026-4017](https://cve.now/CVE-2026-4017.md): Buffer overflow in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety (CVSS 7.4, BlackBerry QNX Software Development Platform · BlackBerr… +1) - [CVE-2026-0515](https://cve.now/CVE-2026-0515.md): Insufficient parameter validation in the QNX Neutrino kernel impacts versions of the QNX Software Development Platform and QNX OS for Safety (CVSS 6.2, BlackBerry QNX Software Development Platform · BlackBerr… +1) - [CVE-2026-58529](https://cve.now/CVE-2026-58529.md): Windows Active Directory Federation Services (ADFS) Information Disclosure Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2026-55121](https://cve.now/CVE-2026-55121.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +2) - [CVE-2026-56181](https://cve.now/CVE-2026-56181.md): Windows Network Address Translation (NAT) Spoofing Vulnerability (CVSS 8.3, Microsoft Windows) - [CVE-2026-58638](https://cve.now/CVE-2026-58638.md): Windows Boot Loader Security Feature Bypass Vulnerability (CVSS 6.0, Microsoft Windows) - [CVE-2026-58637](https://cve.now/CVE-2026-58637.md): Windows Client-Side Caching Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-58634](https://cve.now/CVE-2026-58634.md): Desktop Window Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58633](https://cve.now/CVE-2026-58633.md): Desktop Window Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58632](https://cve.now/CVE-2026-58632.md): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58629](https://cve.now/CVE-2026-58629.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-58628](https://cve.now/CVE-2026-58628.md): Windows Wireless Network Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58627](https://cve.now/CVE-2026-58627.md): Windows DHCP Server Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-58626](https://cve.now/CVE-2026-58626.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-58619](https://cve.now/CVE-2026-58619.md): Windows Sensor Data Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-58617](https://cve.now/CVE-2026-58617.md): M365 Copilot for iOS Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft 365 Copilot for iOS) - [CVE-2026-58613](https://cve.now/CVE-2026-58613.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58594](https://cve.now/CVE-2026-58594.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-58541](https://cve.now/CVE-2026-58541.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58543](https://cve.now/CVE-2026-58543.md): Universal Print Management Service Elevation of Privilege Vulnerability (CVSS 6.3, Microsoft Windows) - [CVE-2026-58542](https://cve.now/CVE-2026-58542.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58544](https://cve.now/CVE-2026-58544.md): Windows Management Services Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-58545](https://cve.now/CVE-2026-58545.md): Windows Kernel Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-58547](https://cve.now/CVE-2026-58547.md): Windows Universal Plug and Play (UPnP) Device Host Elevation of Privilege Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-58536](https://cve.now/CVE-2026-58536.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58534](https://cve.now/CVE-2026-58534.md): Windows Input Method Editor (IME) Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-58537](https://cve.now/CVE-2026-58537.md): Microsoft NAT Helper Components (ipnathlp.dll) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58532](https://cve.now/CVE-2026-58532.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58531](https://cve.now/CVE-2026-58531.md): Windows SMB Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-58540](https://cve.now/CVE-2026-58540.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58539](https://cve.now/CVE-2026-58539.md): Windows Remote Desktop Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-58546](https://cve.now/CVE-2026-58546.md): Windows Remote Desktop Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-58535](https://cve.now/CVE-2026-58535.md): Windows Remote Desktop Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-58533](https://cve.now/CVE-2026-58533.md): Windows Remote Desktop Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-58538](https://cve.now/CVE-2026-58538.md): Windows Bluetooth Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58530](https://cve.now/CVE-2026-58530.md): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58528](https://cve.now/CVE-2026-58528.md): Windows USB Audio Class Driver Information Disclosure Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2026-58527](https://cve.now/CVE-2026-58527.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58277](https://cve.now/CVE-2026-58277.md): Microsoft SharePoint Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-57982](https://cve.now/CVE-2026-57982.md): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-57973](https://cve.now/CVE-2026-57973.md): Windows Subsystem for Linux (WSL2) Kernel Tampering Vulnerability (CVSS 6.3, Microsoft Windows Subsystem for Linux) - [CVE-2026-57968](https://cve.now/CVE-2026-57968.md): Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Subsystem for Linux) - [CVE-2026-57108](https://cve.now/CVE-2026-57108.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +9) - [CVE-2026-57102](https://cve.now/CVE-2026-57102.md): Visual Studio Code Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft Visual Studio Code) - [CVE-2026-57101](https://cve.now/CVE-2026-57101.md): Visual Studio Code Security Feature Bypass Vulnerability (CVSS 7.1, Microsoft Visual Studio Code) - [CVE-2026-57096](https://cve.now/CVE-2026-57096.md): Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-57093](https://cve.now/CVE-2026-57093.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-57088](https://cve.now/CVE-2026-57088.md): Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-57087](https://cve.now/CVE-2026-57087.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-57092](https://cve.now/CVE-2026-57092.md): Microsoft Windows VMSwitch Elevation of Privilege Vulnerability (CVSS 9.9, Microsoft Windows) - [CVE-2026-57085](https://cve.now/CVE-2026-57085.md): Windows Print Spooler Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-57089](https://cve.now/CVE-2026-57089.md): Windows SMB Server Network Transport Driver (srvnet.sys) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-57091](https://cve.now/CVE-2026-57091.md): Windows File History Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-57094](https://cve.now/CVE-2026-57094.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-57090](https://cve.now/CVE-2026-57090.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-57095](https://cve.now/CVE-2026-57095.md): Win32k Elevation of Privilege Vulnerability (CVSS 6.2, Microsoft Windows) - [CVE-2026-56650](https://cve.now/CVE-2026-56650.md): Windows Network File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-57084](https://cve.now/CVE-2026-57084.md): Windows File Explorer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Office 365 for Mac · Microsoft Office for Andr… +1) - [CVE-2026-57083](https://cve.now/CVE-2026-57083.md): Windows Media Photo Codec Information Disclosure Vulnerability (CVSS 5.5, Microsoft Office 365 for Mac · Microsoft Office for Andr… +1) - [CVE-2026-56649](https://cve.now/CVE-2026-56649.md): Windows Network File System Remote Code Execution Vulnerability (CVSS 5.9, Microsoft Windows) - [CVE-2026-56648](https://cve.now/CVE-2026-56648.md): Windows NFS Server Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-56647](https://cve.now/CVE-2026-56647.md): Windows Remote Access Service Infrastructure Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-56194](https://cve.now/CVE-2026-56194.md): Windows NFS Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-54124](https://cve.now/CVE-2026-54124.md): Windows Terminal Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-56644](https://cve.now/CVE-2026-56644.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-56643](https://cve.now/CVE-2026-56643.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-56642](https://cve.now/CVE-2026-56642.md): Microsoft Fabric Data Warehouse Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Service Fabric) - [CVE-2026-56178](https://cve.now/CVE-2026-56178.md): Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability (CVSS 5.5, Microsoft Defender for Endpoint for Mac) - [CVE-2026-56197](https://cve.now/CVE-2026-56197.md): Windows Admin Center (WAC) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Admin Center) - [CVE-2026-56196](https://cve.now/CVE-2026-56196.md): Windows Admin Center (WAC) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Admin Center) - [CVE-2026-56195](https://cve.now/CVE-2026-56195.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-56192](https://cve.now/CVE-2026-56192.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +2) - [CVE-2026-50665](https://cve.now/CVE-2026-50665.md): Microsoft Office Information Disclosure Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-56189](https://cve.now/CVE-2026-56189.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-56188](https://cve.now/CVE-2026-56188.md): Windows Server Network driver Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2026-56186](https://cve.now/CVE-2026-56186.md): Windows Secure Channel Information Disclosure Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2026-56187](https://cve.now/CVE-2026-56187.md): Windows MIDI Service Module Elevation of Privileges Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-56184](https://cve.now/CVE-2026-56184.md): Win32k Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-56190](https://cve.now/CVE-2026-56190.md): Remote Desktop Protocol Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2026-56183](https://cve.now/CVE-2026-56183.md): Windows MIDI Service Module Elevation of Privileges Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-56182](https://cve.now/CVE-2026-56182.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-56175](https://cve.now/CVE-2026-56175.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-56176](https://cve.now/CVE-2026-56176.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Office 365 for Mac · Microsoft Office for Andr… +2) - [CVE-2026-56173](https://cve.now/CVE-2026-56173.md): Windows WebView Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-56168](https://cve.now/CVE-2026-56168.md): Windows SMB Server Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-50359](https://cve.now/CVE-2026-50359.md): Microsoft XML Core Services Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-56159](https://cve.now/CVE-2026-56159.md): DHCP Server Service Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2026-56157](https://cve.now/CVE-2026-56157.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 5.4, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-56156](https://cve.now/CVE-2026-56156.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office 365… +1) - [CVE-2026-55949](https://cve.now/CVE-2026-55949.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55947](https://cve.now/CVE-2026-55947.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55944](https://cve.now/CVE-2026-55944.md): Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Dynamics NAV) - [CVE-2026-55898](https://cve.now/CVE-2026-55898.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 6.1, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-54131](https://cve.now/CVE-2026-54131.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-55145](https://cve.now/CVE-2026-55145.md): Outlook Copilot Tampering Vulnerability (CVSS 6.3, Microsoft Copilot) - [CVE-2026-54116](https://cve.now/CVE-2026-54116.md): Microsoft SQL Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft SQL Server) - [CVE-2026-50468](https://cve.now/CVE-2026-50468.md): Microsoft SQL Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft SQL Server) - [CVE-2026-55135](https://cve.now/CVE-2026-55135.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-55052](https://cve.now/CVE-2026-55052.md): Microsoft SharePoint Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-55120](https://cve.now/CVE-2026-55120.md): Microsoft PowerPoint Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1) - [CVE-2026-55123](https://cve.now/CVE-2026-55123.md): Microsoft PowerPoint Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1) - [CVE-2026-55133](https://cve.now/CVE-2026-55133.md): Microsoft OneNote Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office 365… +1) - [CVE-2026-55043](https://cve.now/CVE-2026-55043.md): Microsoft PowerPoint Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1) - [CVE-2026-55139](https://cve.now/CVE-2026-55139.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-55042](https://cve.now/CVE-2026-55042.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-55130](https://cve.now/CVE-2026-55130.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55128](https://cve.now/CVE-2026-55128.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55140](https://cve.now/CVE-2026-55140.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-55142](https://cve.now/CVE-2026-55142.md): Microsoft Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55040](https://cve.now/CVE-2026-55040.md): Microsoft SharePoint Server Security Feature Bypass Vulnerability (CVSS 9.1, KEV, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-55056](https://cve.now/CVE-2026-55056.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-55134](https://cve.now/CVE-2026-55134.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55051](https://cve.now/CVE-2026-55051.md): Microsoft SharePoint Server Information Disclosure Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-55126](https://cve.now/CVE-2026-55126.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.3, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-55131](https://cve.now/CVE-2026-55131.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55057](https://cve.now/CVE-2026-55057.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-55122](https://cve.now/CVE-2026-55122.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 7.1, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55053](https://cve.now/CVE-2026-55053.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55137](https://cve.now/CVE-2026-55137.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55132](https://cve.now/CVE-2026-55132.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55038](https://cve.now/CVE-2026-55038.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55058](https://cve.now/CVE-2026-55058.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55037](https://cve.now/CVE-2026-55037.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55054](https://cve.now/CVE-2026-55054.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 6.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55055](https://cve.now/CVE-2026-55055.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55044](https://cve.now/CVE-2026-55044.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55036](https://cve.now/CVE-2026-55036.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55035](https://cve.now/CVE-2026-55035.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +2) - [CVE-2026-55129](https://cve.now/CVE-2026-55129.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-55141](https://cve.now/CVE-2026-55141.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55136](https://cve.now/CVE-2026-55136.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55127](https://cve.now/CVE-2026-55127.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55124](https://cve.now/CVE-2026-55124.md): Microsoft Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55138](https://cve.now/CVE-2026-55138.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55041](https://cve.now/CVE-2026-55041.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55033](https://cve.now/CVE-2026-55033.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55032](https://cve.now/CVE-2026-55032.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55049](https://cve.now/CVE-2026-55049.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-55050](https://cve.now/CVE-2026-55050.md): Microsoft Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +3) - [CVE-2026-55045](https://cve.now/CVE-2026-55045.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 8.4, Microsoft 365 Apps for Enterprise · Microsoft Office +2) - [CVE-2026-55039](https://cve.now/CVE-2026-55039.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55047](https://cve.now/CVE-2026-55047.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +2) - [CVE-2026-55028](https://cve.now/CVE-2026-55028.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +2) - [CVE-2026-55029](https://cve.now/CVE-2026-55029.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55027](https://cve.now/CVE-2026-55027.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +2) - [CVE-2026-55034](https://cve.now/CVE-2026-55034.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.3, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-55048](https://cve.now/CVE-2026-55048.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55026](https://cve.now/CVE-2026-55026.md): Microsoft Office Information Disclosure Vulnerability (CVSS 6.2, Microsoft 365 Apps for Enterprise · Microsoft Office +2) - [CVE-2026-55031](https://cve.now/CVE-2026-55031.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55125](https://cve.now/CVE-2026-55125.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +2) - [CVE-2026-55030](https://cve.now/CVE-2026-55030.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-55025](https://cve.now/CVE-2026-55025.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55023](https://cve.now/CVE-2026-55023.md): Microsoft Office Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Office +2) - [CVE-2026-55022](https://cve.now/CVE-2026-55022.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-55021](https://cve.now/CVE-2026-55021.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 7.3, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-55020](https://cve.now/CVE-2026-55020.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-55046](https://cve.now/CVE-2026-55046.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55018](https://cve.now/CVE-2026-55018.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-55019](https://cve.now/CVE-2026-55019.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-50408](https://cve.now/CVE-2026-50408.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55024](https://cve.now/CVE-2026-55024.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55016](https://cve.now/CVE-2026-55016.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 4.6, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-55017](https://cve.now/CVE-2026-55017.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-50467](https://cve.now/CVE-2026-50467.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-50314](https://cve.now/CVE-2026-50314.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-50301](https://cve.now/CVE-2026-50301.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-48580](https://cve.now/CVE-2026-48580.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 5.5, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-47642](https://cve.now/CVE-2026-47642.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-47290](https://cve.now/CVE-2026-47290.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-55010](https://cve.now/CVE-2026-55010.md): Minecraft Bedrock Dedicated Server Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Minecraft Bedrock Dedicated Server) - [CVE-2026-54126](https://cve.now/CVE-2026-54126.md): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-54128](https://cve.now/CVE-2026-54128.md): Windows DHCP Client Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Windows) - [CVE-2026-50692](https://cve.now/CVE-2026-50692.md): Desktop Window Manager Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50690](https://cve.now/CVE-2026-50690.md): Windows SMB Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-54125](https://cve.now/CVE-2026-54125.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50689](https://cve.now/CVE-2026-50689.md): Windows Clipboard Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50686](https://cve.now/CVE-2026-50686.md): Windows OLE Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2026-50687](https://cve.now/CVE-2026-50687.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50683](https://cve.now/CVE-2026-50683.md): Windows DHCP Client Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Windows) - [CVE-2026-50685](https://cve.now/CVE-2026-50685.md): Windows DHCP Server Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50682](https://cve.now/CVE-2026-50682.md): Active Directory Denial of Service Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2026-54121](https://cve.now/CVE-2026-54121.md): Active Directory Certificate Services Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50681](https://cve.now/CVE-2026-50681.md): Windows Secure Channel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50680](https://cve.now/CVE-2026-50680.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Windows) - [CVE-2026-50688](https://cve.now/CVE-2026-50688.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50679](https://cve.now/CVE-2026-50679.md): Windows Search Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50684](https://cve.now/CVE-2026-50684.md): Active Directory Federation Server Spoofing Vulnerability (CVSS 4.8, Microsoft Windows) - [CVE-2026-54115](https://cve.now/CVE-2026-54115.md): Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50677](https://cve.now/CVE-2026-50677.md): Windows Media Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50676](https://cve.now/CVE-2026-50676.md): Windows Media Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50674](https://cve.now/CVE-2026-50674.md): Windows USB Print Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50673](https://cve.now/CVE-2026-50673.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50672](https://cve.now/CVE-2026-50672.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50670](https://cve.now/CVE-2026-50670.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50669](https://cve.now/CVE-2026-50669.md): Windows Telephony Server Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50668](https://cve.now/CVE-2026-50668.md): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2026-50667](https://cve.now/CVE-2026-50667.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50666](https://cve.now/CVE-2026-50666.md): Windows Remote Access Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50661](https://cve.now/CVE-2026-50661.md): Windows BitLocker Security Feature Bypass Vulnerability (CVSS 6.1, Microsoft Windows) - [CVE-2026-50658](https://cve.now/CVE-2026-50658.md): Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Defender for Endpoint for Mac) - [CVE-2026-50657](https://cve.now/CVE-2026-50657.md): Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability (CVSS 4.7, Microsoft Defender for Endpoint for Mac) - [CVE-2026-50655](https://cve.now/CVE-2026-50655.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50647](https://cve.now/CVE-2026-50647.md): Active Directory Federation Server Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framew… +2) - [CVE-2026-50518](https://cve.now/CVE-2026-50518.md): Windows DHCP Server Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2026-50510](https://cve.now/CVE-2026-50510.md): GitHub Copilot Remote Code Execution Vulnerability (CVSS 7.8, Microsoft GitHub Copilot Plugin for JetBrains IDEs) - [CVE-2026-50509](https://cve.now/CVE-2026-50509.md): Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-47295](https://cve.now/CVE-2026-47295.md): Microsoft SQL Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SQL Server 2016 Service Pack · Microsoft SQL Serv…) - [CVE-2026-50504](https://cve.now/CVE-2026-50504.md): Windows Remote Desktop Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-50496](https://cve.now/CVE-2026-50496.md): Windows Network Policy Server SNMP Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50497](https://cve.now/CVE-2026-50497.md): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-50503](https://cve.now/CVE-2026-50503.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50501](https://cve.now/CVE-2026-50501.md): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50492](https://cve.now/CVE-2026-50492.md): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2026-50491](https://cve.now/CVE-2026-50491.md): Code Integrity DLL (ci.dll) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50505](https://cve.now/CVE-2026-50505.md): Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50498](https://cve.now/CVE-2026-50498.md): Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50490](https://cve.now/CVE-2026-50490.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50494](https://cve.now/CVE-2026-50494.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50489](https://cve.now/CVE-2026-50489.md): Win32k Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50499](https://cve.now/CVE-2026-50499.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50500](https://cve.now/CVE-2026-50500.md): Windows Netlogon Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50488](https://cve.now/CVE-2026-50488.md): Clipboard User Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50487](https://cve.now/CVE-2026-50487.md): Windows DNS Client Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2026-50486](https://cve.now/CVE-2026-50486.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50485](https://cve.now/CVE-2026-50485.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 4.5, Microsoft Windows) - [CVE-2026-50502](https://cve.now/CVE-2026-50502.md): Windows Event Logging Service Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows) - [CVE-2026-50493](https://cve.now/CVE-2026-50493.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50484](https://cve.now/CVE-2026-50484.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50483](https://cve.now/CVE-2026-50483.md): Windows Graphics Component Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50495](https://cve.now/CVE-2026-50495.md): DNS Client Tampering Vulnerability (CVSS 6.1, Microsoft Windows) - [CVE-2026-50482](https://cve.now/CVE-2026-50482.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows) - [CVE-2026-50480](https://cve.now/CVE-2026-50480.md): Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50479](https://cve.now/CVE-2026-50479.md): Windows USB Hub Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50478](https://cve.now/CVE-2026-50478.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50477](https://cve.now/CVE-2026-50477.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50459](https://cve.now/CVE-2026-50459.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50470](https://cve.now/CVE-2026-50470.md): Windows Network Policy Server SNMP Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50406](https://cve.now/CVE-2026-50406.md): Windows Backup Engine Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50424](https://cve.now/CVE-2026-50424.md): Windows Domain Controller Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50450](https://cve.now/CVE-2026-50450.md): Windows Network Connections Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50429](https://cve.now/CVE-2026-50429.md): Windows Kernel Information Disclosure Vulnerability (CVSS 8.2, Microsoft Windows) - [CVE-2026-50476](https://cve.now/CVE-2026-50476.md): Windows Network Connections Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50475](https://cve.now/CVE-2026-50475.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50458](https://cve.now/CVE-2026-50458.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50415](https://cve.now/CVE-2026-50415.md): Windows Media Information Disclosure Vulnerability (CVSS 5.3, Microsoft Windows) - [CVE-2026-50394](https://cve.now/CVE-2026-50394.md): Windows Media Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50444](https://cve.now/CVE-2026-50444.md): Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50411](https://cve.now/CVE-2026-50411.md): Windows Active Directory Federation Services Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framew… +2) - [CVE-2026-50474](https://cve.now/CVE-2026-50474.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50362](https://cve.now/CVE-2026-50362.md): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50420](https://cve.now/CVE-2026-50420.md): HTTP.sys Information Disclosure Vulnerability (CVSS 6.2, Microsoft Windows) - [CVE-2026-50438](https://cve.now/CVE-2026-50438.md): Microsoft PC Manager Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft PC Manager) - [CVE-2026-50447](https://cve.now/CVE-2026-50447.md): Windows Message Queuing Service (MSMQ) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2026-15747](https://cve.now/CVE-2026-15747.md): Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle (CVSS 9.1, SRI Mojolicious) - [CVE-2026-50417](https://cve.now/CVE-2026-50417.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50453](https://cve.now/CVE-2026-50453.md): Windows USB Audio Class Driver Information Disclosure Vulnerability (CVSS 6.1, Microsoft Windows) - [CVE-2026-50431](https://cve.now/CVE-2026-50431.md): Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50461](https://cve.now/CVE-2026-50461.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50399](https://cve.now/CVE-2026-50399.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50432](https://cve.now/CVE-2026-50432.md): Window Virtual Filtering Platform (VFP) Denial of Service Vulnerability (CVSS 5.3, Microsoft Windows) - [CVE-2026-50456](https://cve.now/CVE-2026-50456.md): Windows File Explorer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50389](https://cve.now/CVE-2026-50389.md): Windows File Explorer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50442](https://cve.now/CVE-2026-50442.md): Windows File Explorer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50473](https://cve.now/CVE-2026-50473.md): Windows File Explorer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50457](https://cve.now/CVE-2026-50457.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50462](https://cve.now/CVE-2026-50462.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50439](https://cve.now/CVE-2026-50439.md): Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2026-50465](https://cve.now/CVE-2026-50465.md): Windows DNS Client Tampering Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2026-50441](https://cve.now/CVE-2026-50441.md): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50409](https://cve.now/CVE-2026-50409.md): Windows Overlay Filter Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50435](https://cve.now/CVE-2026-50435.md): Windows Overlay Filter Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50402](https://cve.now/CVE-2026-50402.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50466](https://cve.now/CVE-2026-50466.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50455](https://cve.now/CVE-2026-50455.md): Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50451](https://cve.now/CVE-2026-50451.md): Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2026-50383](https://cve.now/CVE-2026-50383.md): Windows Print Spooler Information Disclosure Vulnerability (CVSS 6.1, Microsoft Windows) - [CVE-2026-50367](https://cve.now/CVE-2026-50367.md): Windows Sensor Data Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50374](https://cve.now/CVE-2026-50374.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 6.3, Microsoft Windows) - [CVE-2026-50421](https://cve.now/CVE-2026-50421.md): Windows Connected User Experiences and Telemetry Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50422](https://cve.now/CVE-2026-50422.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50427](https://cve.now/CVE-2026-50427.md): Content Delivery Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50413](https://cve.now/CVE-2026-50413.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50385](https://cve.now/CVE-2026-50385.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50426](https://cve.now/CVE-2026-50426.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2026-50365](https://cve.now/CVE-2026-50365.md): Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability (CVSS 8.0, Microsoft Windows) - [CVE-2026-50454](https://cve.now/CVE-2026-50454.md): Windows User Interface Core Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50469](https://cve.now/CVE-2026-50469.md): Windows Projected File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50369](https://cve.now/CVE-2026-50369.md): Windows Remote Desktop Services Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50471](https://cve.now/CVE-2026-50471.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50437](https://cve.now/CVE-2026-50437.md): Windows DWM Core Library Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50436](https://cve.now/CVE-2026-50436.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50382](https://cve.now/CVE-2026-50382.md): DirectX Graphics Kernel Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50352](https://cve.now/CVE-2026-50352.md): Windows Cryptographic Services Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50344](https://cve.now/CVE-2026-50344.md): Windows OLE Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50445](https://cve.now/CVE-2026-50445.md): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-50334](https://cve.now/CVE-2026-50334.md): Windows Push Notification Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50387](https://cve.now/CVE-2026-50387.md): Windows GDI Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Office 365 for Mac · Microsoft Office for Andr… +2) - [CVE-2026-50448](https://cve.now/CVE-2026-50448.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50405](https://cve.now/CVE-2026-50405.md): Windows Filtering Platform Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50397](https://cve.now/CVE-2026-50397.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50376](https://cve.now/CVE-2026-50376.md): Windows Remote Desktop Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-50346](https://cve.now/CVE-2026-50346.md): Netlogon RPC Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50401](https://cve.now/CVE-2026-50401.md): Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50378](https://cve.now/CVE-2026-50378.md): Windows Key Guard Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50423](https://cve.now/CVE-2026-50423.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50418](https://cve.now/CVE-2026-50418.md): Windows System Secure Feature Bypass Vulnerability (CVSS 5.1, Microsoft Windows) - [CVE-2026-50391](https://cve.now/CVE-2026-50391.md): Windows Group Policy Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50433](https://cve.now/CVE-2026-50433.md): Windows Media Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50403](https://cve.now/CVE-2026-50403.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50460](https://cve.now/CVE-2026-50460.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2026-50463](https://cve.now/CVE-2026-50463.md): Windows Kernel Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50379](https://cve.now/CVE-2026-50379.md): Windows Media Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50414](https://cve.now/CVE-2026-50414.md): Windows Media Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50398](https://cve.now/CVE-2026-50398.md): Windows Media Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50336](https://cve.now/CVE-2026-50336.md): Windows Media Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50371](https://cve.now/CVE-2026-50371.md): Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50449](https://cve.now/CVE-2026-50449.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50410](https://cve.now/CVE-2026-50410.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50388](https://cve.now/CVE-2026-50388.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50353](https://cve.now/CVE-2026-50353.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50373](https://cve.now/CVE-2026-50373.md): Windows Search Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50428](https://cve.now/CVE-2026-50428.md): Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2026-50355](https://cve.now/CVE-2026-50355.md): Windows Active Directory Federation Services Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framew… +2) - [CVE-2026-50358](https://cve.now/CVE-2026-50358.md): Windows Media Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50416](https://cve.now/CVE-2026-50416.md): Win32k Information Disclosure Vulnerability (CVSS 3.3, Microsoft Windows) - [CVE-2026-50366](https://cve.now/CVE-2026-50366.md): Windows Active Directory Domain Services Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-50404](https://cve.now/CVE-2026-50404.md): Windows Media Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50340](https://cve.now/CVE-2026-50340.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 8.5, Microsoft Windows) - [CVE-2026-50317](https://cve.now/CVE-2026-50317.md): Windows Operating Systems Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50361](https://cve.now/CVE-2026-50361.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50375](https://cve.now/CVE-2026-50375.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 6.3, Microsoft Windows) - [CVE-2026-50335](https://cve.now/CVE-2026-50335.md): Windows Operating Systems Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50322](https://cve.now/CVE-2026-50322.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50345](https://cve.now/CVE-2026-50345.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50348](https://cve.now/CVE-2026-50348.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50452](https://cve.now/CVE-2026-50452.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50390](https://cve.now/CVE-2026-50390.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50377](https://cve.now/CVE-2026-50377.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50357](https://cve.now/CVE-2026-50357.md): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50330](https://cve.now/CVE-2026-50330.md): Windows Remote Desktop Client Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50312](https://cve.now/CVE-2026-50312.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 4.7, Microsoft Windows) - [CVE-2026-50324](https://cve.now/CVE-2026-50324.md): Windows Active Directory Federation Services Denial of Service Vulnerability (CVSS 5.9, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framew… +2) - [CVE-2026-50310](https://cve.now/CVE-2026-50310.md): Windows Human Interface Device Information Disclosure Vulnerability (CVSS 4.7, Microsoft Windows) - [CVE-2026-50430](https://cve.now/CVE-2026-50430.md): Windows Push Notification Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50339](https://cve.now/CVE-2026-50339.md): Windows Push Notification Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50434](https://cve.now/CVE-2026-50434.md): Windows Push Notification Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50315](https://cve.now/CVE-2026-50315.md): Windows Image Acquisition Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50425](https://cve.now/CVE-2026-50425.md): Windows Internal System User Profile Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50321](https://cve.now/CVE-2026-50321.md): Windows USB Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50347](https://cve.now/CVE-2026-50347.md): Windows Data.dll Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50370](https://cve.now/CVE-2026-50370.md): DHCP Server Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50396](https://cve.now/CVE-2026-50396.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50343](https://cve.now/CVE-2026-50343.md): Microsoft Install Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50331](https://cve.now/CVE-2026-50331.md): Windows Application Model Core API Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50407](https://cve.now/CVE-2026-50407.md): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50341](https://cve.now/CVE-2026-50341.md): Windows NTFS Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50327](https://cve.now/CVE-2026-50327.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50380](https://cve.now/CVE-2026-50380.md): Windows GDI+ Remote Code Execution Vulnerability (CVSS 9.6, Microsoft Windows) - [CVE-2026-50440](https://cve.now/CVE-2026-50440.md): Windows Audio Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50313](https://cve.now/CVE-2026-50313.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50326](https://cve.now/CVE-2026-50326.md): Windows Unified Consent System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50307](https://cve.now/CVE-2026-50307.md): Windows TCP/IP Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50368](https://cve.now/CVE-2026-50368.md): Windows Active Directory Federation Services Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framew… +2) - [CVE-2026-50419](https://cve.now/CVE-2026-50419.md): Windows Kernel Information Disclosure Vulnerability (CVSS 3.3, Microsoft Windows) - [CVE-2026-50309](https://cve.now/CVE-2026-50309.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50400](https://cve.now/CVE-2026-50400.md): Windows App Package Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50386](https://cve.now/CVE-2026-50386.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50337](https://cve.now/CVE-2026-50337.md): Windows Notification Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50412](https://cve.now/CVE-2026-50412.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50393](https://cve.now/CVE-2026-50393.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50360](https://cve.now/CVE-2026-50360.md): Windows SMB Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-50306](https://cve.now/CVE-2026-50306.md): Windows TCP/IP Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50328](https://cve.now/CVE-2026-50328.md): Windows Server Update Service (WSUS) Tampering Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50304](https://cve.now/CVE-2026-50304.md): Windows Active Directory Federation Services Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framew… +2) - [CVE-2026-50392](https://cve.now/CVE-2026-50392.md): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50363](https://cve.now/CVE-2026-50363.md): Windows Push Notifications Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50329](https://cve.now/CVE-2026-50329.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50305](https://cve.now/CVE-2026-50305.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50372](https://cve.now/CVE-2026-50372.md): Windows Redirected Drive Buffering System Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50332](https://cve.now/CVE-2026-50332.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50302](https://cve.now/CVE-2026-50302.md): Windows Cryptographic Services Security Feature Bypass Vulnerability (CVSS 4.2, Microsoft Windows) - [CVE-2026-50364](https://cve.now/CVE-2026-50364.md): Windows Backup Service Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows) - [CVE-2026-50303](https://cve.now/CVE-2026-50303.md): Windows Key Guard Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50300](https://cve.now/CVE-2026-50300.md): Windows DWM Core Library Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50381](https://cve.now/CVE-2026-50381.md): Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50350](https://cve.now/CVE-2026-50350.md): Windows Trusted Runtime Interface Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50295](https://cve.now/CVE-2026-50295.md): Windows Zero Trust DNS Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50384](https://cve.now/CVE-2026-50384.md): Windows Clip Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50356](https://cve.now/CVE-2026-50356.md): Microsoft Windows App Store Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50325](https://cve.now/CVE-2026-50325.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50297](https://cve.now/CVE-2026-50297.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50296](https://cve.now/CVE-2026-50296.md): DirectX Graphics Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50354](https://cve.now/CVE-2026-50354.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2026-50316](https://cve.now/CVE-2026-50316.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50293](https://cve.now/CVE-2026-50293.md): Windows Internal Task Bar Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49808](https://cve.now/CVE-2026-49808.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50298](https://cve.now/CVE-2026-50298.md): Windows Spaceport.sys Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2026-50342](https://cve.now/CVE-2026-50342.md): Windows MIDI Service Module Elevation of Privileges Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-49807](https://cve.now/CVE-2026-49807.md): Windows DirectX Information Disclosure Vulnerability (CVSS 6.2, Microsoft Windows) - [CVE-2026-50351](https://cve.now/CVE-2026-50351.md): Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50318](https://cve.now/CVE-2026-50318.md): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50323](https://cve.now/CVE-2026-50323.md): Windows Runtime Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-49803](https://cve.now/CVE-2026-49803.md): Windows AppX Deployment Extensions Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-49805](https://cve.now/CVE-2026-49805.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-49806](https://cve.now/CVE-2026-49806.md): Windows USB Print Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-49802](https://cve.now/CVE-2026-49802.md): Windows USB Print Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-49801](https://cve.now/CVE-2026-49801.md): Windows SMB Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50333](https://cve.now/CVE-2026-50333.md): Windows Spaceport.sys Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50294](https://cve.now/CVE-2026-50294.md): Windows Kernel Information Disclosure Vulnerability (CVSS 6.2, Microsoft Windows) - [CVE-2026-49804](https://cve.now/CVE-2026-49804.md): Windows USB Video Driver Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows) - [CVE-2026-50311](https://cve.now/CVE-2026-50311.md): Windows Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50308](https://cve.now/CVE-2026-50308.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49799](https://cve.now/CVE-2026-49799.md): Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-49800](https://cve.now/CVE-2026-49800.md): Windows Web Proxy Auto-Discovery Protocol (WPAD) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50299](https://cve.now/CVE-2026-50299.md): Windows Storage Spaces Direct Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2026-49798](https://cve.now/CVE-2026-49798.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 9.3, Microsoft Windows) - [CVE-2026-49797](https://cve.now/CVE-2026-49797.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49795](https://cve.now/CVE-2026-49795.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-49796](https://cve.now/CVE-2026-49796.md): Windows GDI+ Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49794](https://cve.now/CVE-2026-49794.md): Windows USB Audio Class Driver Information Disclosure Vulnerability (CVSS 4.6, Microsoft Windows) - [CVE-2026-49793](https://cve.now/CVE-2026-49793.md): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49792](https://cve.now/CVE-2026-49792.md): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49791](https://cve.now/CVE-2026-49791.md): Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2026-49790](https://cve.now/CVE-2026-49790.md): Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows) - [CVE-2026-49789](https://cve.now/CVE-2026-49789.md): Windows NTFS Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows) - [CVE-2026-49788](https://cve.now/CVE-2026-49788.md): HTTP/2 Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-49787](https://cve.now/CVE-2026-49787.md): HTTP.sys Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-49783](https://cve.now/CVE-2026-49783.md): Secure Boot Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49183](https://cve.now/CVE-2026-49183.md): Windows Clipboard Server Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-49184](https://cve.now/CVE-2026-49184.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Windows) - [CVE-2026-49181](https://cve.now/CVE-2026-49181.md): Windows DHCP Client Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-49180](https://cve.now/CVE-2026-49180.md): Universal Plug and Play (upnp.dll) Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-49178](https://cve.now/CVE-2026-49178.md): Windows Active Directory Domain Services Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-45646](https://cve.now/CVE-2026-45646.md): OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft AspNet.OData · Microsoft AspNetCore.OData) - [CVE-2026-48581](https://cve.now/CVE-2026-48581.md): Surface Broker SDMA Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Surface Go · Microsoft Surface Hub +5) - [CVE-2026-48564](https://cve.now/CVE-2026-48564.md): DHCP Server Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-47632](https://cve.now/CVE-2026-47632.md): Azure Connected Machine Agent Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Azure Connected Machine Agent) - [CVE-2026-44800](https://cve.now/CVE-2026-44800.md): Windows Push Notifications Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-40378](https://cve.now/CVE-2026-40378.md): Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-44806](https://cve.now/CVE-2026-44806.md): Windows Secure Channel Denial of Service Vulnerability (CVSS 5.3, Microsoft Windows) - [CVE-2026-34348](https://cve.now/CVE-2026-34348.md): Windows Event Logging Service Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-40400](https://cve.now/CVE-2026-40400.md): Windows PowerShell Remote Code Execution Vulnerability (CVSS 8.0, Microsoft PowerShell · Microsoft Windows) - [CVE-2026-41087](https://cve.now/CVE-2026-41087.md): Windows File Explorer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-40422](https://cve.now/CVE-2026-40422.md): Windows File Explorer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-34328](https://cve.now/CVE-2026-34328.md): Windows Audio Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-33842](https://cve.now/CVE-2026-33842.md): Windows File Explorer Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-50653](https://cve.now/CVE-2026-50653.md): Azure Active Directory Denial of Service Vulnerability (CVSS 7.5, Microsoft Azure Active Directory · Microsoft .NET Framework) - [CVE-2026-50652](https://cve.now/CVE-2026-50652.md): Azure Active Directory Denial of Service Vulnerability (CVSS 7.5, Microsoft Azure Active Directory · Microsoft .NET Framework) - [CVE-2026-58647](https://cve.now/CVE-2026-58647.md): Microsoft PowerBI Report Server Spoofing Vulnerability (CVSS 8.0, Microsoft Power BI Report Server) - [CVE-2026-58644](https://cve.now/CVE-2026-58644.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 9.8, KEV, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-58640](https://cve.now/CVE-2026-58640.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows) - [CVE-2026-58636](https://cve.now/CVE-2026-58636.md): Microsoft PC Manager Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft PC Manager) - [CVE-2026-58635](https://cve.now/CVE-2026-58635.md): Windows Narrator Braille Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58631](https://cve.now/CVE-2026-58631.md): Windows Admin Center (WAC) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows Admin Center) - [CVE-2026-58618](https://cve.now/CVE-2026-58618.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-58614](https://cve.now/CVE-2026-58614.md): Windows Kernel Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-58610](https://cve.now/CVE-2026-58610.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58609](https://cve.now/CVE-2026-58609.md): Windows Graphics Component Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58608](https://cve.now/CVE-2026-58608.md): Windows Print Spooler Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-58602](https://cve.now/CVE-2026-58602.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-58601](https://cve.now/CVE-2026-58601.md): Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability (CVSS 7.8, Microsoft Windows) - [CVE-2026-50522](https://cve.now/CVE-2026-50522.md): Microsoft SharePoint Remote Code Execution Vulnerability (CVSS 9.8, KEV, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-58595](https://cve.now/CVE-2026-58595.md): Microsoft Bing App for IOS Spoofing Vulnerability (CVSS 8.1, Microsoft Bing Search for iOS) - [CVE-2026-58526](https://cve.now/CVE-2026-58526.md): Windows Storage Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-58279](https://cve.now/CVE-2026-58279.md): Azure CycleCloud Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Azure CycleCloud) - [CVE-2026-55014](https://cve.now/CVE-2026-55014.md): Windows Remote Help Defense Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Remote Help) - [CVE-2026-57979](https://cve.now/CVE-2026-57979.md): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-57976](https://cve.now/CVE-2026-57976.md): Windows Active Directory Domain Services Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-57969](https://cve.now/CVE-2026-57969.md): Azure CycleCloud Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Azure CycleCloud) - [CVE-2026-57107](https://cve.now/CVE-2026-57107.md): Windows Admin Center Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Admin Center) - [CVE-2026-57097](https://cve.now/CVE-2026-57097.md): Microsoft XML Security Feature Bypass Vulnerability (CVSS 6.4, Microsoft Windows) - [CVE-2026-56185](https://cve.now/CVE-2026-56185.md): Windows Admin Center Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Admin Center) - [CVE-2026-56193](https://cve.now/CVE-2026-56193.md): Microsoft Office Information Disclosure Vulnerability (CVSS 7.1, Microsoft 365 Apps for Enterprise · Microsoft Office) - [CVE-2026-54127](https://cve.now/CVE-2026-54127.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows) - [CVE-2026-50694](https://cve.now/CVE-2026-50694.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2026-56170](https://cve.now/CVE-2026-56170.md): ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime +13) - [CVE-2026-56169](https://cve.now/CVE-2026-56169.md): Windows Admin Center Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows Admin Center) - [CVE-2026-56164](https://cve.now/CVE-2026-56164.md): Microsoft SharePoint Server Elevation of Privilege Vulnerability (CVSS 5.3, KEV, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-56155](https://cve.now/CVE-2026-56155.md): Active Directory Federation Services Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows) - [CVE-2026-55948](https://cve.now/CVE-2026-55948.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-55899](https://cve.now/CVE-2026-55899.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-54988](https://cve.now/CVE-2026-54988.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 6.1, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-50678](https://cve.now/CVE-2026-50678.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 6.6, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-50675](https://cve.now/CVE-2026-50675.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1) - [CVE-2026-54108](https://cve.now/CVE-2026-54108.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 6.5, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…) - [CVE-2026-50520](https://cve.now/CVE-2026-50520.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Visual Studio Code) - [CVE-2026-55144](https://cve.now/CVE-2026-55144.md): Windows Cryptography API: Next Generation (CNG) Tampering Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2026-55002](https://cve.now/CVE-2026-55002.md): Microsoft SQL Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SQL Server 2016 Service Pack · Microsoft SQL Serv…) - [CVE-2026-54118](https://cve.now/CVE-2026-54118.md): Microsoft SQL Server Remote Code Execution Vulnerability (CVSS 9.8, Microsoft SQL Server 2016 Service Pack · Microsoft SQL Serv…) - [CVE-2026-54117](https://cve.now/CVE-2026-54117.md): Microsoft SQL Server Remote Code Execution Vulnerability (CVSS 9.8, Microsoft SQL Server) - [CVE-2026-55012](https://cve.now/CVE-2026-55012.md): Microsoft Defender Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Malware Protection Engine) - [CVE-2026-55011](https://cve.now/CVE-2026-55011.md): Microsoft Defender Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Malware Protection Engine) - [CVE-2026-50338](https://cve.now/CVE-2026-50338.md): Azure Spring Apps Elevation of Privilege Vulnerability (CVSS 8.2, Microsoft Azure Spring Apps) - [CVE-2026-55009](https://cve.now/CVE-2026-55009.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1) - [CVE-2026-55008](https://cve.now/CVE-2026-55008.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 9.6, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1) - [CVE-2026-55006](https://cve.now/CVE-2026-55006.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1) - [CVE-2026-55005](https://cve.now/CVE-2026-55005.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1) - [CVE-2026-54122](https://cve.now/CVE-2026-54122.md): Windows GDI+ Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Windows) - [CVE-2026-54995](https://cve.now/CVE-2026-54995.md): Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2026-55003](https://cve.now/CVE-2026-55003.md): Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2026-54999](https://cve.now/CVE-2026-54999.md): Windows TCP/IP Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-54997](https://cve.now/CVE-2026-54997.md): Windows SMB Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-54119](https://cve.now/CVE-2026-54119.md): Windows Active Directory Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-54996](https://cve.now/CVE-2026-54996.md): Windows USB Print Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-54114](https://cve.now/CVE-2026-54114.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-54982](https://cve.now/CVE-2026-54982.md): Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-54109](https://cve.now/CVE-2026-54109.md): Windows Resilient File System (ReFS) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-54992](https://cve.now/CVE-2026-54992.md): Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Windows) - [CVE-2026-55004](https://cve.now/CVE-2026-55004.md): Windows Print Configuration Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-54112](https://cve.now/CVE-2026-54112.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-55001](https://cve.now/CVE-2026-55001.md): Active Directory Domain Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-54993](https://cve.now/CVE-2026-54993.md): Microsoft Windows Media Foundation Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-54986](https://cve.now/CVE-2026-54986.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-54107](https://cve.now/CVE-2026-54107.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2026-54132](https://cve.now/CVE-2026-54132.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2026-54991](https://cve.now/CVE-2026-54991.md): Windows USB Print Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-54111](https://cve.now/CVE-2026-54111.md): Universal Print Management Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-55000](https://cve.now/CVE-2026-55000.md): Windows USB Print Driver Elevation of Privilege Vulnerability (CVSS 6.4, Microsoft Windows) - [CVE-2026-50697](https://cve.now/CVE-2026-50697.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-54990](https://cve.now/CVE-2026-54990.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2026-50696](https://cve.now/CVE-2026-50696.md): Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-54987](https://cve.now/CVE-2026-54987.md): Windows Overlay Filter Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-54989](https://cve.now/CVE-2026-54989.md): Quality Windows Audio/Video Experience (QWAVE) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-54129](https://cve.now/CVE-2026-54129.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-50695](https://cve.now/CVE-2026-50695.md): Windows Active Directory Federation Services Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-54983](https://cve.now/CVE-2026-54983.md): Windows Active Directory Federation Services Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-50663](https://cve.now/CVE-2026-50663.md): Game: Age of Empires II: Definitive Edition Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Age of Empires II: Definitive Edition Game) - [CVE-2026-45496](https://cve.now/CVE-2026-45496.md): Visual Studio Code Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Visual Studio Code) - [CVE-2026-47282](https://cve.now/CVE-2026-47282.md): GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability (CVSS 6.5, Microsoft Visual Studio Code) - [CVE-2026-50506](https://cve.now/CVE-2026-50506.md): OData for ASP.NET and ASP.NET Core Denial of Service Vulnerability (CVSS 7.5, Microsoft AspNet.OData · Microsoft AspNetCore.OData) - [CVE-2026-49784](https://cve.now/CVE-2026-49784.md): Microsoft Windows App Store Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-49177](https://cve.now/CVE-2026-49177.md): Windows TCP/IP Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-49174](https://cve.now/CVE-2026-49174.md): DNS Client Tampering Vulnerability (CVSS 6.1, Microsoft Windows) - [CVE-2026-49173](https://cve.now/CVE-2026-49173.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49172](https://cve.now/CVE-2026-49172.md): Windows FTP Service Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2026-49175](https://cve.now/CVE-2026-49175.md): Windows DNS Client Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49176](https://cve.now/CVE-2026-49176.md): Windows WalletService Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49171](https://cve.now/CVE-2026-49171.md): Windows Speech Runtime Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2026-49170](https://cve.now/CVE-2026-49170.md): Windows StateRepository API Server file Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49169](https://cve.now/CVE-2026-49169.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows Server) - [CVE-2026-49168](https://cve.now/CVE-2026-49168.md): Storage Spaces Direct Elevation of Privilege Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2026-49167](https://cve.now/CVE-2026-49167.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 4.7, Microsoft Windows) - [CVE-2026-49166](https://cve.now/CVE-2026-49166.md): Windows Print Configuration Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-49165](https://cve.now/CVE-2026-49165.md): Microsoft Windows App Store Information Disclosure Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2026-49164](https://cve.now/CVE-2026-49164.md): Windows Active Directory Domain Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2026-49162](https://cve.now/CVE-2026-49162.md): Microsoft Brokering File System Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-48571](https://cve.now/CVE-2026-48571.md): Windows App Package Installer Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-48572](https://cve.now/CVE-2026-48572.md): Windows App Package Installer Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2026-42990](https://cve.now/CVE-2026-42990.md): SQL Server ODBC driver Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2026-42975](https://cve.now/CVE-2026-42975.md): Windows Bluetooth Port Driver Remote Code Execution (CVSS 8.0, Microsoft Windows) - [CVE-2026-42900](https://cve.now/CVE-2026-42900.md): Microsoft Windows App Store Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2026-34346](https://cve.now/CVE-2026-34346.md): Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-34349](https://cve.now/CVE-2026-34349.md): Windows Media Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2026-47296](https://cve.now/CVE-2026-47296.md): Microsoft SQL Server Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft SQL Server 2016 Service Pack · Microsoft SQL Serv…) - [CVE-2026-42982](https://cve.now/CVE-2026-42982.md): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2026-48561](https://cve.now/CVE-2026-48561.md): Microsoft Edge Copilot Remote Code Execution Vulnerability (CVSS 9.6, Microsoft Edge Copilot for Android · Microsoft Edge Copilot…) - [CVE-2026-15429](https://cve.now/CVE-2026-15429.md): Privilege Escalation via Improper Input Sanitization in TP-Link Archer VX1800v (CVSS 5.1, TP-Link Systems Archer VX1800v) - [CVE-2026-15428](https://cve.now/CVE-2026-15428.md): OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v (CVSS 8.5, TP-Link Systems Archer VX1800v) - [CVE-2026-15427](https://cve.now/CVE-2026-15427.md): OS Command Injection in TR-069 (CWMP) Management Interface in TP-Link Archer VX1800v (CVSS 8.6, TP-Link Systems Archer VX1800v) - [CVE-2026-15703](https://cve.now/CVE-2026-15703.md): SourceCodester Simple and Nice Shopping Cart Script userproductdeletequery.php sql injection (CVSS 6.9, SourceCodester Simple and Nice Shopping Cart Script) - [CVE-2026-59891](https://cve.now/CVE-2026-59891.md): Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry (CVSS 9.6, sigstore-js · @sigstore/oci) - [CVE-2026-14646](https://cve.now/CVE-2026-14646.md): Nexus Repository 3 - Server-Side Request Forgery (SSRF) via HTTP Redirect (CVSS 4.9, Sonatype Nexus Repository) - [CVE-2026-15702](https://cve.now/CVE-2026-15702.md): tamagui config.ts updateConfig prototype pollution (CVSS 5.3, tamagui) - [CVE-2026-59888](https://cve.now/CVE-2026-59888.md): jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy (CVSS 6.5, FasterXML jackson-databind · com.fasterxml.jackson.core:… +1) - [CVE-2026-59884](https://cve.now/CVE-2026-59884.md): pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs (CVSS 7.5, pyasn1) - [CVE-2026-59885](https://cve.now/CVE-2026-59885.md): pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service (CVSS 7.5, pyasn1) - [CVE-2026-59886](https://cve.now/CVE-2026-59886.md): pyasn1: Uncontrolled resource consumption when converting decoded REAL values (CVSS 7.5, pyasn1) - [CVE-2026-14645](https://cve.now/CVE-2026-14645.md): Nexus Repository 3 - Server-Side Request Forgery (SSRF) via Webhook: Global Capability (CVSS 5.1, Sonatype Nexus Repository) - [CVE-2026-15701](https://cve.now/CVE-2026-15701.md): Totolink NR1800X lighttpd formLogout.htm Form\_Logout stack-based overflow (CVSS 9.3, Totolink NR1800X) - [CVE-2026-54058](https://cve.now/CVE-2026-54058.md): Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files) (CVSS 8.3, python-pillow Pillow · pillow) - [CVE-2026-59197](https://cve.now/CVE-2026-59197.md): Pillow: Heap out-of-bounds write in Pillow \`ImageFilter.RankFilter\` via integer overflow in \`ImagingExpand\` (CVSS 8.2, python-pillow Pillow · pillow) - [CVE-2026-54432](https://cve.now/CVE-2026-54432.md): Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). (CVSS 4.7, Roundcube Webmail) - [CVE-2026-54433](https://cve.now/CVE-2026-54433.md): In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message (CVSS 7.2, Roundcube Webmail) - [CVE-2026-15700](https://cve.now/CVE-2026-15700.md): DedeCMS Album Publishing Feature zip.class.php ExtractFile path traversal (CVSS 5.1, DedeCMS) - [CVE-2026-59200](https://cve.now/CVE-2026-59200.md): Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode() (CVSS 7.5, python-pillow Pillow · pillow) - [CVE-2026-59198](https://cve.now/CVE-2026-59198.md): Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images (CVSS 6.5, python-pillow Pillow · pillow) - [CVE-2026-62644](https://cve.now/CVE-2026-62644.md): In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via (CVSS 6.4, Roundcube Webmail) - [CVE-2026-14504](https://cve.now/CVE-2026-14504.md): Nexus Repository 3 - Authorization Bypass in Component Upload API (CVSS 8.2, Sonatype Nexus Repository) - [CVE-2026-62643](https://cve.now/CVE-2026-62643.md): In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages ma (CVSS 7.2, Roundcube Webmail) - [CVE-2026-12523](https://cve.now/CVE-2026-12523.md): Resource exhaustion in quiche HTTP/3 and QPACK layers (CVSS 7.5, Cloudflare quiche) - [CVE-2026-62642](https://cve.now/CVE-2026-62642.md): In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of (CVSS 4.3, Roundcube Webmail) - [CVE-2026-59205](https://cve.now/CVE-2026-59205.md): Pillow: Controlled heap out-of-bounds write in \`ImageCmsTransform.apply()\` via output mode mismatch (CVSS 7.5, python-pillow Pillow · pillow) - [CVE-2026-62641](https://cve.now/CVE-2026-62641.md): In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF si (CVSS 4.3, Roundcube Webmail) - [CVE-2026-7494](https://cve.now/CVE-2026-7494.md): Nexus Repository - SSRF in SSL Certificate Retrieval (CVSS 5.3, Sonatype Nexus Repository) - [CVE-2026-15699](https://cve.now/CVE-2026-15699.md): spencermountain compromise Public Root API extend.js nlp.extend prototype pollution (CVSS 5.3, spencermountain compromise) - [CVE-2026-60119](https://cve.now/CVE-2026-60119.md): Hi.Events \< 1.11.0 XSS via Event Title JSON.stringify Injection (CVSS 5.1, HiEventsDev Hi.Events) - [CVE-2026-59203](https://cve.now/CVE-2026-59203.md): Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service (CVSS 5.3, python-pillow Pillow · pillow) - [CVE-2026-60118](https://cve.now/CVE-2026-60118.md): Hi.Events \< 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint (CVSS 6.9, HiEventsDev Hi.Events) - [CVE-2026-59199](https://cve.now/CVE-2026-59199.md): Pillow: Heap out-of-bounds write \`Image.paste()\` / \`Image.crop()\` via signed coordinate overflow (CVSS 7.5, python-pillow Pillow · pillow) - [CVE-2026-59204](https://cve.now/CVE-2026-59204.md): Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service (CVSS 8.7, python-pillow Pillow · pillow) - [CVE-2026-60082](https://cve.now/CVE-2026-60082.md): DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row (CVSS 9.1, HMBRAND DBI) - [CVE-2026-60081](https://cve.now/CVE-2026-60081.md): DBI::ProfileData versions before 1.651 for Perl do not limit the path index (CVSS 7.5, HMBRAND DBI::ProfileData) - [CVE-2026-15392](https://cve.now/CVE-2026-15392.md): DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location (CVSS 7.7, HMBRAND DBD::File) - [CVE-2026-55651](https://cve.now/CVE-2026-55651.md): Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure (CVSS 7.1, alextselegidis easyappointments · alextselegidis/easyappoin…) - [CVE-2026-15698](https://cve.now/CVE-2026-15698.md): kofrasa mingo Update API updateMany prototype pollution (CVSS 5.3, kofrasa mingo) - [CVE-2026-11403](https://cve.now/CVE-2026-11403.md): Nexus Repository Manager - Insufficient Entropy in Format-Specific API Key Generation (CVSS 8.7, Sonatype Nexus Repository Manager) - [CVE-2026-52841](https://cve.now/CVE-2026-52841.md): Easy!Appointments: Authorization bypass in Google OAuth provider binding lets any backend user rebind a peer provider's Google sync (CVSS 3.1, alextselegidis easyappointments · alextselegidis/easyappoin…) - [CVE-2026-52840](https://cve.now/CVE-2026-52840.md): Easy!Appointments has server-side request forgery in CalDAV connection test that exposes the deployment's internal network (CVSS 2.7, alextselegidis easyappointments · alextselegidis/easyappoin…) - [CVE-2026-11944](https://cve.now/CVE-2026-11944.md): openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download (CVSS 5.3, OS4ED openSIS-Classic) - [CVE-2026-52839](https://cve.now/CVE-2026-52839.md): Easy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass (CVSS 3.3, alextselegidis easyappointments · alextselegidis/easyappoin…) - [CVE-2026-59840](https://cve.now/CVE-2026-59840.md): A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 (CVSS 4.1, Fortinet FortiOS · Fortinet FortiPAM +2) - [CVE-2025-43892](https://cve.now/CVE-2025-43892.md): A buffer over-read vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2 all versions, FortiOS 7.0 (CVSS 4.1, Fortinet FortiOS) - [CVE-2026-23573](https://cve.now/CVE-2026-23573.md): An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability \[CWE-79\] vulnerability in Fortinet For (CVSS 6.1, Fortinet FortiOS · Fortinet FortiProxy +1) - [CVE-2026-59839](https://cve.now/CVE-2026-59839.md): A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, Fort (CVSS 5.0, Fortinet FortiProxy · Fortinet FortiOS +1) - [CVE-2025-62826](https://cve.now/CVE-2025-62826.md): An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability \[CWE-113\] vulnerability in Fortinet F (CVSS 3.1, Fortinet FortiPAM · Fortinet FortiProxy +1) - [CVE-2026-12707](https://cve.now/CVE-2026-12707.md): Unbounded path event queue growth in quiche via peer-driven source connection ID rotation (CVSS 7.5, Cloudflare quiche) - [CVE-2025-62675](https://cve.now/CVE-2025-62675.md): An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability \[CWE-113\] vulnerability in Fortinet F (CVSS 3.4, Fortinet FortiOS · Fortinet FortiPAM +1) - [CVE-2026-15697](https://cve.now/CVE-2026-15697.md): svgdotjs svg.js npm Package API EventTarget.on prototype pollution (CVSS 5.3, svgdotjs svg.js) - [CVE-2026-59836](https://cve.now/CVE-2026-59836.md): A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiCli (CVSS 6.7, Fortinet FortiClientEMS) - [CVE-2026-59841](https://cve.now/CVE-2026-59841.md): A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 ma (CVSS 6.9, Fortinet FortiSIEMWindowsAgent) - [CVE-2026-12659](https://cve.now/CVE-2026-12659.md): Rockwell Automation Flex 5000® Adapter - Denial of Service (CVSS 8.7, Rockwell Automation The FLEX 5000® EtherNet/IP Adapter) - [CVE-2025-53379](https://cve.now/CVE-2025-53379.md): A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remot (CVSS 7.0, Fortinet FortiAuthenticator) - [CVE-2026-9128](https://cve.now/CVE-2026-9128.md): Studio 5000 Logix Designer® – Multiple Vulnerabilities (CVSS 7.3, Rockwell Automation Studio 5000 Logix Designer) - [CVE-2026-59835](https://cve.now/CVE-2026-59835.md): A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allo (CVSS 7.7, Fortinet FortiSandbox) - [CVE-2026-9636](https://cve.now/CVE-2026-9636.md): Rockwell Automation CompactLogix® 5380 ControlLogix® 5580 / 1756-EN4 Communications Module – Certificate Revocation List Vulnerability (CVSS 8.2, Rockwell Automation ControlLogix® 5580, CompactLogix® 5380,…) - [CVE-2026-9127](https://cve.now/CVE-2026-9127.md): Studio 5000 Logix Designer® – Multiple Vulnerabilities (CVSS 7.3, Rockwell Automation Studio 5000 Logix Designer) - [CVE-2026-9108](https://cve.now/CVE-2026-9108.md): Studio 5000 Logix Designer® – Multiple Vulnerabilities (CVSS 5.4, Rockwell Automation Studio 5000 Logix Designer) - [CVE-2026-55954](https://cve.now/CVE-2026-55954.md): Missing ID token claim validation in ueberauth\_apple allows account takeover (CVSS 9.1, ueberauth\_apple) - [CVE-2026-52838](https://cve.now/CVE-2026-52838.md): Easy!Appointments disable\_booking\_message rendered as raw HTML on public booking page — Stored XSS (CVSS 2.6, alextselegidis easyappointments · alextselegidis/easyappoin…) - [CVE-2026-11917](https://cve.now/CVE-2026-11917.md): ThinManager® - Path Traversal via API (CVSS 7.2, Rockwell Automation FactoryTalk ThinManager) - [CVE-2026-59837](https://cve.now/CVE-2026-59837.md): A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2 all versions, FortiOS 7.0 all versions, For (CVSS 5.9, Fortinet FortiOS · Fortinet FortiProxy +1) - [CVE-2026-9292](https://cve.now/CVE-2026-9292.md): Rockwell Automation FactoryTalk® DataMosaix™ Private Cloud - Stored Cross-Site Scripting (CVSS 8.4, Rockwell Automation FactoryTalk® DataMosaix™ Private Cloud) - [CVE-2025-11698](https://cve.now/CVE-2025-11698.md): CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow (CVSS 9.2, Rockwell Automation CompactLogix® 5380 Recovery Image…) - [CVE-2025-12012](https://cve.now/CVE-2025-12012.md): CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow (CVSS 9.2, Rockwell Automation CompactLogix® 5370 Compact GuardLo…) - [CVE-2025-12011](https://cve.now/CVE-2025-12011.md): CompactLogix ®, ControlLogix ®, Compact GuardLogix ® and GuardLogix ® Buffer Overflow (CVSS 9.2, Rockwell Automation CompactLogix® 5370 Compact GuardLo…) - [CVE-2026-15265](https://cve.now/CVE-2026-15265.md): Tenable Agent Path Traversal Leading to Remote Code Execution (CVSS 9.1, tenable\_agent) - [CVE-2026-10714](https://cve.now/CVE-2026-10714.md): Rockwell Automation FactoryTalk® Services Platform FTSP - Weak Authentication via JWT Validation Bypass (CVSS 8.8, Rockwell Automation FactoryTalk® Services Platform) - [CVE-2026-10672](https://cve.now/CVE-2026-10672.md): Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI) (CVSS 8.2, zephyrproject zephyr) - [CVE-2026-10671](https://cve.now/CVE-2026-10671.md): User thread can re-initialize an in-use \`k\_pipe\`, corrupting kernel wait queues (\`CONFIG\_USERSPACE\`) (CVSS 7.1, zephyrproject zephyr) - [CVE-2026-10670](https://cve.now/CVE-2026-10670.md): User-triggerable kernel NULL-pointer dereference (DoS) in \`k\_thread\_name\_copy()\` syscall verifier (CVSS 5.5, zephyrproject zephyr) - [CVE-2026-10669](https://cve.now/CVE-2026-10669.md): Xtensa MPU \`arch\_buffer\_validate()\` integer-overflow lets a user thread bypass syscall pointer validation (CVSS 7.8, zephyrproject zephyr) - [CVE-2026-9653](https://cve.now/CVE-2026-9653.md): 1756-EN2, 1756-EN3, and 1756-ENBT - Denial of Service via CIP Connection ID (CVSS 8.7, Rockwell Automation 1756-EN2, 1756-EN3 · Rockwell Automatio…) - [CVE-2026-10573](https://cve.now/CVE-2026-10573.md): 1734 POINT I/OTM - Denial of Service via Malformed Inputs on CIP Object (CVSS 6.3, Rockwell Automation 1734 POINT I/O) - [CVE-2026-9140](https://cve.now/CVE-2026-9140.md): 1718-AENTR/1719-AENTR - Denial of Service (CVSS 8.7, Rockwell Automation 1718-AENTR/1719-AENTR) - [CVE-2026-52837](https://cve.now/CVE-2026-52837.md): Easy!Appointments has unauthenticated customer PII disclosure on booking reschedule page (CVSS 6.9, alextselegidis easyappointments · alextselegidis/easyappoin…) - [CVE-2026-15696](https://cve.now/CVE-2026-15696.md): Tenda BE12 Pro VirtualSer fromVirtualSer stack-based overflow (CVSS 8.7, Tenda BE12 Pro) - [CVE-2026-58479](https://cve.now/CVE-2026-58479.md): Sustainable Irrigation Platform 5.2.16 RCE via cli\_control Plugin Command Injection (CVSS 9.2, Dan-in-CA SIP) - [CVE-2026-58478](https://cve.now/CVE-2026-58478.md): Sustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URL (CVSS 6.3, Dan-in-CA SIP) - [CVE-2026-58477](https://cve.now/CVE-2026-58477.md): Sustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP Parameters (CVSS 8.8, Dan-in-CA SIP) - [CVE-2026-60114](https://cve.now/CVE-2026-60114.md): Sustainable Irrigation Platform 5.2.16 Path Traversal via JSON Backup Restore (CVSS 8.7, Dan-in-CA SIP) - [CVE-2026-15695](https://cve.now/CVE-2026-15695.md): Tenda BE12 Pro DhcpListClient fromDhcpListClient stack-based overflow (CVSS 8.7, Tenda BE12 Pro) - [CVE-2026-14903](https://cve.now/CVE-2026-14903.md): Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web r (CVSS 7.7, ivanti Xtraction) - [CVE-2026-58476](https://cve.now/CVE-2026-58476.md): Sustainable Irrigation Platform 5.2.16 CSRF via Administrative GET Requests (CVSS 7.0, Dan-in-CA SIP) - [CVE-2026-14902](https://cve.now/CVE-2026-14902.md): An open redirect in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary externa (CVSS 4.0, ivanti Xtraction) - [CVE-2026-58475](https://cve.now/CVE-2026-58475.md): Sustainable Irrigation Platform 5.2.16 Stored XSS via Program Name (CVSS 5.3, Dan-in-CA SIP) - [CVE-2026-15694](https://cve.now/CVE-2026-15694.md): Tenda BE12 Pro SetIpBind fromSetIpBind stack-based overflow (CVSS 8.7, Tenda BE12 Pro) - [CVE-2026-15736](https://cve.now/CVE-2026-15736.md): Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy (CVSS 8.3, Snowflake SQLAlchemy · snowflake-sqlalchemy) - [CVE-2026-8590](https://cve.now/CVE-2026-8590.md): Spotfire OAuth2 PKCE Bypass for public clients (CVSS 8.7, Spotfire Enterprise · Spotfire on Kubernetes) - [CVE-2026-15693](https://cve.now/CVE-2026-15693.md): Tenda BE12 Pro SafeMacFilter fromSafeMacFilter stack-based overflow (CVSS 8.7, Tenda BE12 Pro) - [CVE-2026-53566](https://cve.now/CVE-2026-53566.md): Out-of-bounds memory read (CVSS 6.8, Citrix Secure Access Client for Windows) - [CVE-2026-10577](https://cve.now/CVE-2026-10577.md): Rockwell Automation 1715 Redundant IO – Access Control Vulnerability (CVSS 10.0, Rockwell Auotmation 1715 EtherNet/IP Communications Module) - [CVE-2026-53565](https://cve.now/CVE-2026-53565.md): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (CVSS 8.5, Citrix Secure Access Client for Windows · Citrix Endpoint A…) - [CVE-2026-8314](https://cve.now/CVE-2026-8314.md): Rockwell Automation Arena® - Memory Corruption Vulnerability (CVSS 7.0, Rockwell Automation Arena® Simulation) - [CVE-2026-8313](https://cve.now/CVE-2026-8313.md): Rockwell Automation Arena® - Memory Corruption Vulnerability (CVSS 7.0, Rockwell Automation Arena® Simulation) - [CVE-2026-15305](https://cve.now/CVE-2026-15305.md): TYPO3 CMS - Unrestricted File Upload in Form Framework (CVSS 6.3, TYPO3 CMS · typo3/cms-form) - [CVE-2026-12588](https://cve.now/CVE-2026-12588.md): An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. (CVSS 6.0, Trellix HX Console) - [CVE-2026-8312](https://cve.now/CVE-2026-8312.md): Rockwell Automation Arena® - Memory Corruption Vulnerability (CVSS 7.0, Rockwell Auotmation Arena® Simulation) - [CVE-2026-8085](https://cve.now/CVE-2026-8085.md): Rockwell Automation Arena® - Memory Corruption Vulnerability (CVSS 7.0, Rockwell Automation Arena® Simulation) - [CVE-2026-15692](https://cve.now/CVE-2026-15692.md): Tenda BE12 Pro SafeUrlFilter fromSafeUrlFilter stack-based overflow (CVSS 8.7, Tenda BE12 Pro) - [CVE-2026-49488](https://cve.now/CVE-2026-49488.md): Apache OpenMeetings: Arbitrary File Read (CVSS 6.5, Apache Software Foundation Apache OpenMeetings) - [CVE-2026-62393](https://cve.now/CVE-2026-62393.md): Apache Kylin: Improper authorization in job information retrieval (CVSS 4.3, Apache Software Foundation Apache Kylin) - [CVE-2026-62392](https://cve.now/CVE-2026-62392.md): Apache Kylin: OS Command Injection via Async Query API (CVSS 8.8, Apache Software Foundation Apache Kylin) - [CVE-2026-15719](https://cve.now/CVE-2026-15719.md): Site isolation issue in the DOM: Navigation component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-15718](https://cve.now/CVE-2026-15718.md): Invalid pointer in the JavaScript: WebAssembly component (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-15691](https://cve.now/CVE-2026-15691.md): Tenda BE12 Pro SafeClientFilter fromSafeClientFilter stack-based overflow (CVSS 8.7, Tenda BE12 Pro) - [CVE-2026-62390](https://cve.now/CVE-2026-62390.md): Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API (CVSS 9.8, Apache Software Foundation Apache Kylin) - [CVE-2026-15690](https://cve.now/CVE-2026-15690.md): open62541 Shared Client ua\_client\_connect.c responseReadNamespacesArray null pointer dereference (CVSS 2.3, open62541) - [CVE-2026-9341](https://cve.now/CVE-2026-9341.md): Academy LMS \<= 3.8.0 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'user\_id' Parameter (CVSS 4.3, kodezen Academy LMS) - [CVE-2026-62422](https://cve.now/CVE-2026-62422.md): In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass v (CVSS 10.0, JetBrains YouTrack) - [CVE-2026-15389](https://cve.now/CVE-2026-15389.md): Inadequate access control in Sesame Time session management (CVSS 8.7, Sesame Time) - [CVE-2026-3014](https://cve.now/CVE-2026-3014.md): Remote Code Execution by administrative user on the Management Server (CVSS 6.4, Milestone Systems XProtect Management Server) - [CVE-2026-15043](https://cve.now/CVE-2026-15043.md): DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted \<= and \>= SQL operators on text (CVSS 9.8, HMBRAND DBI::SQL::Nano) - [CVE-2026-58319](https://cve.now/CVE-2026-58319.md): Apache Doris: Improper Authentication in Frontend HTTP API (CVSS 9.1, Apache Software Foundation Apache Doris) - [CVE-2026-14852](https://cve.now/CVE-2026-14852.md): mk\_sap\_hana: Privilege escalation via crafted sapstartsrv process name (CVSS 5.2, Checkmk) - [CVE-2026-12478](https://cve.now/CVE-2026-12478.md): Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path) (CVSS 4.8, Red Hat Enterprise Linux) - [CVE-2026-56451](https://cve.now/CVE-2026-56451.md): A vulnerability has been identified in Opcenter X (All versions \< V2604). (CVSS 10.0, Siemens Opcenter X) - [CVE-2026-54429](https://cve.now/CVE-2026-54429.md): A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). (CVSS 7.4, Siemens SIMATIC S7-PLCSIM Advanced) - [CVE-2025-40945](https://cve.now/CVE-2025-40945.md): A vulnerability has been identified in COMOS V10.4.5 (All versions \< V10.4.5.0.2), COMOS V10.6 (All versions \< V10.6.1), Designcenter NX (Al (CVSS 6.7, Siemens COMOS · Siemens Designcenter NX +6) - [CVE-2024-7708](https://cve.now/CVE-2024-7708.md): For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. (CVSS 7.5, Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:jetty-…) - [CVE-2026-15416](https://cve.now/CVE-2026-15416.md): Argo-cd: argo cd unauthenticated remote code execution in repo-server via generatemanifest grpc endpoint (CVSS 8.9, argoproj argo-helm · Red Hat OpenShift GitOps +1) - [CVE-2026-8384](https://cve.now/CVE-2026-8384.md): In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admi (CVSS 5.3, Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:jetty-…) - [CVE-2026-6790](https://cve.now/CVE-2026-6790.md): In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what p (CVSS 5.3, Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:jetty-…) - [CVE-2026-10051](https://cve.now/CVE-2026-10051.md): In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the (CVSS 6.9, Eclipse Foundation Eclipse Jetty · org.eclipse.jetty:jetty-…) - [CVE-2026-15183](https://cve.now/CVE-2026-15183.md): Input Validation Vulnerabilities in Snowflake Spark Connector (CVSS 9.2, Snowflake Spark Connector) - [CVE-2026-59246](https://cve.now/CVE-2026-59246.md): Zero-length HTTP/2 CONTINUATION frames bypass Mint's header-block byte-size cap and exhaust client memory (CVSS 6.3, elixir-mint mint) - [CVE-2026-58229](https://cve.now/CVE-2026-58229.md): Unbounded HTTP/1 response-header and chunked-trailer accumulation in Mint causes memory-exhaustion DoS (CVSS 8.2, elixir-mint mint) - [CVE-2026-12606](https://cve.now/CVE-2026-12606.md): Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leverag (CVSS 6.3, Eclipse Foundation Eclipse GlassFish) - [CVE-2026-59084](https://cve.now/CVE-2026-59084.md): Apache Tomcat: EncryptInterceptor requirements not clearly documented (CVSS 9.1, Apache Software Foundation Apache Tomcat) - [CVE-2026-15075](https://cve.now/CVE-2026-15075.md): In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates al (CVSS 8.2, Eclipse Foundation Eclipse Vert.x) - [CVE-2026-59083](https://cve.now/CVE-2026-59083.md): Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass (CVSS 9.1, Apache Software Foundation Apache Tomcat) - [CVE-2026-15076](https://cve.now/CVE-2026-15076.md): In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Vert.x Web Client does (CVSS 8.2, Eclipse Foundation Eclipse Vert.x) - [CVE-2026-9561](https://cve.now/CVE-2026-9561.md): Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source of the client IP addr (CVSS 8.8, Eclipse Foundation Eclipse Kura) - [CVE-2026-57898](https://cve.now/CVE-2026-57898.md): In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to (CVSS 9.0, Eclipse Foundation Eclipse BaSyx - Java Server SDK) - [CVE-2025-8412](https://cve.now/CVE-2025-8412.md): VMDP: Potential buffer overflow in the RtlQueryRegistryValues function (CVSS 2.0, SUSE Virtual Machine Driver Pack) - [CVE-2026-13699](https://cve.now/CVE-2026-13699.md): Databroker 0.6.1 PublishValue missing data\_point panic (CVSS 4.3, Eclipse Foundation Eclipse KUKSA - Databroker) - [CVE-2026-59674](https://cve.now/CVE-2026-59674.md): LPE from suricata user to root due to chown in %post in suricata packaging (CVSS 7.1, openSUSE Tumbleweed) - [CVE-2026-6851](https://cve.now/CVE-2026-6851.md): Improper link resolution before file access in Bitdefender Total Security via Link Following (VA-13681) (CVSS 7.0, Bitdefender Total Security · Bitdefender Internet Security) - [CVE-2026-15678](https://cve.now/CVE-2026-15678.md): code-projects Online Job Portal DetailJob.php cross site scripting (CVSS 5.1, code-projects Online Job Portal) - [CVE-2026-15677](https://cve.now/CVE-2026-15677.md): code-projects Online Job Portal JobSeekerInsert.php unrestricted upload (CVSS 6.9, code-projects Online Job Portal) - [CVE-2026-15676](https://cve.now/CVE-2026-15676.md): code-projects Online Job Portal DeleteUser.php sql injection (CVSS 6.9, code-projects Online Job Portal) - [CVE-2026-12988](https://cve.now/CVE-2026-12988.md): WP 2FA \< 3.1.1.2 - Account Takeover via 2FA Setup Email Binding (CVSS 6.4, WP 2FA) - [CVE-2026-12583](https://cve.now/CVE-2026-12583.md): Newsletters \< 4.15 - Unauthenticated PHP Object Injection via Subscriber Custom Field (CVSS 8.1, Newsletters) - [CVE-2026-12511](https://cve.now/CVE-2026-12511.md): AI Engine \< 3.5.5 - Editor+ Arbitrary File Write via Path Traversal (CVSS 8.1, AI Engine) - [CVE-2026-11567](https://cve.now/CVE-2026-11567.md): SureForms \< 2.11.1 - Unauthenticated Payment Amount Bypass (CVSS 5.9, SureForms) - [CVE-2026-11563](https://cve.now/CVE-2026-11563.md): Word Count and Social Shares \<= 1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal (CVSS 9.6, Word Count and Social Shares) - [CVE-2025-15665](https://cve.now/CVE-2025-15665.md): BEAF \< 4.7.1 - Admin+ Stored XSS via Widget Shortcode Field (CVSS 5.4, Ultimate Before After Image Slider & Gallery) - [CVE-2026-15675](https://cve.now/CVE-2026-15675.md): code-projects Online Job Portal EditUser.php sql injection (CVSS 6.9, code-projects Online Job Portal) - [CVE-2026-15672](https://cve.now/CVE-2026-15672.md): itsourcecode Electronic Judging System add\_judges.php sql injection (CVSS 5.3, itsourcecode Electronic Judging System) - [CVE-2026-15669](https://cve.now/CVE-2026-15669.md): louisho5 picobot exec Tool exec.go ExecTool.Execute os command injection (CVSS 4.8, louisho5 picobot) - [CVE-2026-12482](https://cve.now/CVE-2026-12482.md): Path Traversal via Symlink Name Validation Bypass in keras-team/keras (CVSS 3.1, keras-team/keras · keras) - [CVE-2026-15668](https://cve.now/CVE-2026-15668.md): louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery (CVSS 5.3, louisho5 picobot) - [CVE-2026-15629](https://cve.now/CVE-2026-15629.md): louisho5 picobot Workspace filesystem.go GetSkill link following (CVSS 5.3, louisho5 picobot) - [CVE-2026-15628](https://cve.now/CVE-2026-15628.md): zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision.\_download\_to\_data\_url server-side request forgery (CVSS 5.3, zhayujie chatgpt-on-wechat CowAgent) - [CVE-2026-15627](https://cve.now/CVE-2026-15627.md): nextlevelbuilder GoClaw tool.go handleNavigate information disclosure (CVSS 5.3, nextlevelbuilder GoClaw) - [CVE-2026-15626](https://cve.now/CVE-2026-15626.md): nextlevelbuilder GoClaw ACP ToolBridge Workspace tool\_bridge.go writeFile path traversal (CVSS 5.3, nextlevelbuilder GoClaw) - [CVE-2026-15625](https://cve.now/CVE-2026-15625.md): nextlevelbuilder GoClaw exec\_approval.go ExecApprovalManager.CheckCommand incomplete blacklist (CVSS 5.3, nextlevelbuilder GoClaw) - [CVE-2026-15624](https://cve.now/CVE-2026-15624.md): nextlevelbuilder GoClaw invoke Endpoint create\_video\_byteplus.go bytePlusDownloadVideo server-side request forgery (CVSS 5.3, nextlevelbuilder GoClaw) - [CVE-2026-7640](https://cve.now/CVE-2026-7640.md): WP Customer Area \<= 8.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute (CVSS 6.4, aguilatechnologies WP Customer Area) - [CVE-2026-11390](https://cve.now/CVE-2026-11390.md): News Kit Addons For Elementor \<= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets (CVSS 6.4, blazethemes News Kit Addons For Elementor) - [CVE-2026-11802](https://cve.now/CVE-2026-11802.md): FoodBook Lite \<= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration\_action' AJAX Action (CVSS 5.3, themelooks FoodBook Lite – Online Food Ordering System) - [CVE-2026-15622](https://cve.now/CVE-2026-15622.md): poco-ai poco-claw Workspace API workspace.py get\_workspace\_file authorization (CVSS 6.9, poco-ai poco-claw) - [CVE-2026-15621](https://cve.now/CVE-2026-15621.md): mosaxiv clawlet File Tools fs\_ops.go edit\_file link following (CVSS 4.8, mosaxiv clawlet) - [CVE-2026-44767](https://cve.now/CVE-2026-44767.md): Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection (CVSS 6.1, SAP\_SE @ui5/webcomponents-base) - [CVE-2026-58233](https://cve.now/CVE-2026-58233.md): Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach) (CVSS 7.6, SAP\_SE SAP Change and Transport System Attach Tool) - [CVE-2026-44771](https://cve.now/CVE-2026-44771.md): Missing Authorization check in SAP S/4HANA (Draft operation) (CVSS 4.3, SAP\_SE SAP S/4HANA) - [CVE-2026-44770](https://cve.now/CVE-2026-44770.md): Missing Authorization check in SAP S/4 HANA (Create Single Payment) (CVSS 4.3, SAP\_SE SAP S/4 HANA) - [CVE-2026-44769](https://cve.now/CVE-2026-44769.md): SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO) (CVSS 5.5, SAP\_SE SAP S/4HANA Project Management) - [CVE-2026-44768](https://cve.now/CVE-2026-44768.md): Security misconfiguration in SAP CRM (WebClient UI) (CVSS 4.1, SAP\_SE SAP CRM) - [CVE-2026-44761](https://cve.now/CVE-2026-44761.md): Insecure Sample Credentials in SAP Commerce Cloud (CVSS 9.1, SAP\_SE SAP Commerce Cloud) - [CVE-2026-44760](https://cve.now/CVE-2026-44760.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) (CVSS 4.7, SAP\_SE SAP NetWeaver Application Server ABAP) - [CVE-2026-44759](https://cve.now/CVE-2026-44759.md): Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (CVSS 6.1, SAP\_SE SAP NetWeaver Enterprise Portal) - [CVE-2026-44753](https://cve.now/CVE-2026-44753.md): Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service) (CVSS 3.7, SAP\_SE SAP HANA Extended Application Services classic model) - [CVE-2026-44752](https://cve.now/CVE-2026-44752.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard) (CVSS 8.2, SAP\_SE SAP NetWeaver Application Server Java) - [CVE-2026-44747](https://cve.now/CVE-2026-44747.md): Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP (CVSS 9.9, SAP\_SE SAP NetWeaver Application Server ABAP) - [CVE-2026-44745](https://cve.now/CVE-2026-44745.md): Open Redirect vulnerability in SAP Approuter (CVSS 8.1, SAP\_SE SAP Approuter · @sap/approuter) - [CVE-2026-27690](https://cve.now/CVE-2026-27690.md): HTTP Request Smuggling in SAP Approuter (CVSS 9.1, SAP\_SE SAP Approuter · @sap/approuter) - [CVE-2026-0487](https://cve.now/CVE-2026-0487.md): DLL Hijacking vulnerability in SAProuter on Microsoft Windows (CVSS 8.4, SAP\_SE SAProuter on Microsoft Windows) - [CVE-2026-15620](https://cve.now/CVE-2026-15620.md): mosaxiv clawlet tool\_web\_fetch.go tools.webFetch server-side request forgery (CVSS 5.3, mosaxiv clawlet) - [CVE-2026-15619](https://cve.now/CVE-2026-15619.md): mosaxiv clawlet IPv4 tool\_web\_fetch.go web\_fetch server-side request forgery (CVSS 5.3, mosaxiv clawlet) - [CVE-2025-56361](https://cve.now/CVE-2025-56361.md): A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) 1.3 thru 1.4, specifically within the Level Control cluster's (CVSS 5.7) - [CVE-2025-56362](https://cve.now/CVE-2025-56362.md): A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.2, specifically within the Level Control cluster's (CVSS 5.7) - [CVE-2025-56363](https://cve.now/CVE-2025-56363.md): A null pointer dereference vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, affecting the ReadRevisionAttribute functi (CVSS 5.7) - [CVE-2025-56364](https://cve.now/CVE-2025-56364.md): A use of uninitialized value vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, where the \`GetDestinationGroupId().Value (CVSS 5.7) - [CVE-2025-56365](https://cve.now/CVE-2025-56365.md): A reachable assertion vulnerability exists in the Matter SDK (connectedhomeip) before 1.4.0, in the interaction model command processing log (CVSS 5.7) - [CVE-2026-36035](https://cve.now/CVE-2026-36035.md): Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows au (CVSS 6.5) - [CVE-2026-36214](https://cve.now/CVE-2026-36214.md): osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip c (CVSS 6.4, osTicket) - [CVE-2026-38450](https://cve.now/CVE-2026-38450.md): An issue in Aetopia Digital Asset Management DAM v.1.0.0 allows a remote attacker to execute arbitrary code via the name and description par (CVSS 9.8) - [CVE-2026-51105](https://cve.now/CVE-2026-51105.md): Buffer Overflow vulnerability in aMULE-Project aMule v.2.3.3 allows a remote attacker to cause a denial of service via the OP\_SERVERMESSAGE (CVSS 7.5) - [CVE-2026-51807](https://cve.now/CVE-2026-51807.md): Heap-based out-of-bounds write in j2k\_precinct\_subband::parse\_packet\_header() in OpenHTJ2K versions 0.18.3 and earlier (fixed in v0.18.4) ca (CVSS 9.8) - [CVE-2026-51808](https://cve.now/CVE-2026-51808.md): Buffer Overflow vulnerability in OpenHTJ2K v.0.18.4 and before allows an attacker to execute arbitrary code via the openhtj2k\_decoder\_impl:: (CVSS 9.8) - [CVE-2026-52100](https://cve.now/CVE-2026-52100.md): Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary cod (CVSS 7.5) - [CVE-2026-52101](https://cve.now/CVE-2026-52101.md): An issue in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to obtain sensitive information via the function uploadR (CVSS 9.1) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2026-07-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.