Baitaphish
Security intelligence
SearchLatest briefing
Data & Insights

CVE Explorer

Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Snapshot urn:baitaphish:cve-read-model-snapshot:v3:f2c3f72dcc196f8e7d63aa2d29709ad8b3fea39110eb2d563da5ce9b6fa9da89Released 2026-08-05T02:00:00Z
Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-26208

ADB Explorer is a fluent UI for ADB on Windows. Prior to Beta 0.9.26020, ADB Explorer is vulnerable to Insecure Deserialization leading to Remote Code Execution. The application attempts to deserialize the App.txt settings file using Newtonsoft.Json with TypeNameHandling set to Objects. This allows an attacker to supply a crafted JSON file containing a gadget chain (e.g., ObjectDataProvider) to execute arbitrary code when the application launches and subsequently saves its settings. This vulnera

PUBLISHED
Vendor
Alex4SSB
Product
ADB-Explorer
Provider severity
HIGH
Conflicts
0

CVE-2026-26207

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `discourse-policy` plugin allows any authenticated user to interact with policies on posts they do not have permission to view. The `PolicyController` loads posts by ID without verifying the current user's access, enabling policy group members to accept/unaccept policies on posts in private categories or PMs they cannot see and any authenticated user to enumerate which post IDs have policies att

PUBLISHED
Vendor
discourse
Product
discourse
Provider severity
MEDIUM
Conflicts
0

CVE-2026-26206

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to before version 4.14.4, Wazuh's server API brute-force protection for POST /security/user/authenticate can be bypassed by sending concurrent authentication requests. Although the configured threshold (max_login_attempts, default 50) is enforced correctly for sequential requests, a parallel burst allows significantly more failed login attempts to be processed before the IP block is a

PUBLISHED
Vendor
wazuh
Product
wazuh
Provider severity
MEDIUM
Conflicts
1

CVE-2026-26205

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability in how the `input.parsed_path` field is constructed. HTTP request paths are treated as full URIs when parsed; interpreting leading path segments prefixed with double slashes (`//`) as authority components, and therefore dropping them from the parsed path. This creates a path interpretation mismatch between authorization policies and backend servers, enabling attackers to bypass

PUBLISHED
Vendor
open-policy-agent
Product
opa-envoy-plugin
Provider severity
HIGH
Conflicts
0

CVE-2026-26204

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to before version 4.14.4, a heap-based out-of-bounds WRITE occurs in GetAlertData, resulting in writing a NULL byte exactly 1 byte before the start of the buffer allocated by strdup. Due to unsigned integer underflow and pointer arithmetic wrapping, the write lands at offset -1 from the buffer, corrupting heap metadata. A malicious actor can potentially leverage this issue through a c

PUBLISHED
Vendor
wazuh
Product
wazuh
Provider severity
MEDIUM
Conflicts
1

CVE-2026-26203

PJSIP is a free and open source multimedia communication library. Versions prior to 2.17 have a critical heap buffer underflow vulnerability in PJSIP's H.264 packetizer. The bug occurs when processing malformed H.264 bitstreams without NAL unit start codes, where the packetizer performs unchecked pointer arithmetic that can read from memory located before the allocated buffer. Version 2.17 contains a patch for the issue.

PUBLISHED
Vendor
pjsip
Product
pjmedia-video
Provider severity
MEDIUM
Conflicts
0

CVE-2026-26202

Penpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user can read arbitrary files from the server by supplying a local file path (e.g. `/etc/passwd`) as a font data chunk in the `create-font-variant` RPC endpoint, resulting in the file contents being stored and retrievable as a "font" asset. This is an arbitrary file read vulnerability. Any authenticated user with team edit permissions can read arbitrary files accessible to the Penpot

PUBLISHED
Vendor
penpot
Product
penpot
Provider severity
HIGH
Conflicts
1

CVE-2026-26201

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 3.21.2, multiple shared maps are accessed without consistent synchronization across goroutines. Under concurrent activity, Go runtime can trigger `fatal error: concurrent map read and map write`, causing C2 process crash (availability loss). Version 3.21.2 fixes this issue.

PUBLISHED
Vendor
jm33-m0
Product
emp3r0r
Provider severity
HIGH
Conflicts
1

CVE-2026-26200

A flaw was found in HDF5, a software for managing data. An attacker who can control an `h5` file parsed by HDF5 can trigger a write-based heap buffer overflow. This can lead to a denial-of-service condition, and could potentially lead to further issues such as remote code execution, though its real-world exploitability for this is currently unknown.

PUBLISHED
Vendor
HDFGroup, Red Hat
Product
hdf5, Red Hat Enterprise Linux AI (RHEL AI) 3
Provider severity
HIGH
Conflicts
2

CVE-2026-2620

A weakness has been identified in Huace Monitoring and Early Warning System 2.2. Affected by this issue is some unknown functionality of the file /Web/SysManage/ProjectRole.aspx. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED
Vendor
Huace
Product
Monitoring and Early Warning System
Provider severity
HIGH, MEDIUM
Conflicts
2

CVE-2026-26199

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If `H5Iget_name` is invoked on a group id with `0` for the size parameter, it will underflow when trying to place a null terminator in the buffer. This can occur if `H5Iget_name` is invoked in a way where `size` can be forced to zero, and there is important data before the `name` buffer.

PUBLISHED
Vendor
HDFGroup
Product
hdf5
Provider severity
MEDIUM
Conflicts
0

CVE-2026-26198

Ormar is a async mini ORM for Python. In versions 0.9.9 through 0.22.0, when performing aggregate queries, Ormar ORM constructs SQL expressions by passing user-supplied column names directly into `sqlalchemy.text()` without any validation or sanitization. The `min()` and `max()` methods in the `QuerySet` class accept arbitrary string input as the column parameter. While `sum()` and `avg()` are partially protected by an `is_numeric` type check that rejects non-existent fields, `min()` and `max()`

PUBLISHED
Vendor
collerek
Product
ormar
Provider severity
CRITICAL
Conflicts
0

CVE-2026-26197

HDF5 is a high-performance library and a file format specification that implements the HDF5 data model. If a file is corrupted such that an array datatype's size, the number of elements, and the element size are not in agreement it can trigger an out of bounds read. The array datatype stores the full size of the datatype (`dt->shared->size`) separately from the number of elements (`dt->shared->u.array.nelem`) and the element size (`dt->shared->parent->shared->size`). If any one of these are cor

PUBLISHED
Vendor
HDFGroup
Product
hdf5
Provider severity
MEDIUM
Conflicts
0

CVE-2026-26196

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can leak through logs, browser history, and referrers. This issue has been patched in version 0.14.2.

PUBLISHED
Vendor
gogs
Product
gogs
Provider severity
MEDIUM
Conflicts
0

CVE-2026-26195

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2.

PUBLISHED
Vendor
gogs
Product
gogs
Provider severity
MEDIUM
Conflicts
0

CVE-2026-26194

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.

PUBLISHED
Vendor
gogs
Product
gogs
Provider severity
HIGH
Conflicts
0

CVE-2026-26193

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.6.44, aanually modifying chat history allows setting the `embeds` property on a response message, the content of which is loaded into an iFrame with a sandbox that has `allow-scripts` and `allow-same-origin` set, ignoring the "iframe Sandbox Allow Same Origin" configuration. This enables stored XSS on the affected chat. This also triggers when the chat is in the shared format. Th

PUBLISHED
Vendor
open-webui
Product
open-webui
Provider severity
HIGH
Conflicts
0

CVE-2026-26192

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allows setting the `html` property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML, and render them in an iFrame when the citation is previewed. This allows stored XSS via a weaponized document payload in a chat. The payload also executes when the citation is viewed on a shared chat

PUBLISHED
Vendor
open-webui
Product
open-webui
Provider severity
HIGH
Conflicts
0

CVE-2026-26191

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet's software installer pipeline could allow a crafted software package to execute arbitrary commands as root (macOS/Linux) or SYSTEM (Windows) on managed endpoints when an uninstall is triggered. When a software package (.pkg, .deb, .rpm, .exe, or .msi) is uploaded to Fleet, metadata is extracted from the package binary and used to generate uninstall scripts. In affected versions, this metadata is no

PUBLISHED
Vendor
fleetdm
Product
fleet
Provider severity
MEDIUM
Conflicts
0

CVE-2026-26190

Milvus is an open-source vector database built for generative AI applications. Prior to 2.5.27 and 2.6.10, Milvus exposes TCP port 9091 by default, which enables authentication bypasses. The /expr debug endpoint uses a weak, predictable default authentication token derived from etcd.rootPath (default: by-dev), enabling arbitrary expression evaluation. The full REST API (/api/v1/*) is registered on the metrics/management port without any authentication, allowing unauthenticated access to all busi

PUBLISHED
Vendor
milvus-io
Product
milvus
Provider severity
CRITICAL
Conflicts
0

CVE-2026-2619

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to incorrect authorization.

PUBLISHED
Vendor
GitLab
Product
GitLab
Provider severity
MEDIUM
Conflicts
0

CVE-2026-26189

Trivy Action runs Trivy as GitHub action to scan a Docker container image for vulnerabilities. A command injection vulnerability exists in `aquasecurity/trivy-action` versions 0.31.0 through 0.33.1 due to improper handling of action inputs when exporting environment variables. The action writes `export VAR=<input>` lines to `trivy_envs.txt` based on user-supplied inputs and subsequently sources this file in `entrypoint.sh`. Because input values are written without appropriate shell escaping, att

PUBLISHED
Vendor
aquasecurity
Product
trivy-action
Provider severity
MEDIUM
Conflicts
0

CVE-2026-26188

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens. This vulnerability is fixed in 5.14.7.

PUBLISHED
Vendor
solspace
Product
craft-freeform
Provider severity
MEDIUM
Conflicts
0

CVE-2026-26187

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter (pkg/block/local/adapter.go) allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used strings.HasPrefix() to verify that requested paths fall within the configured storage directory. This check was insufficient because it validated only the path prefix without requiring a path separator, allowing

PUBLISHED
Vendor
treeverse
Product
lakeFS
Provider severity
HIGH
Conflicts
0

CVE-2026-26186

Fleet is open source device management software. A SQL injection vulnerability in versions prior to 4.80.1 allowed authenticated users to inject arbitrary SQL expressions via the `order_key` query parameter. Due to unsafe use of `goqu.I()` when constructing the `ORDER BY` clause, specially crafted input could escape identifier quoting and be interpreted as executable SQL. An authenticated attacker with access to the affected endpoint could inject SQL expressions into the underlying MySQL query.

PUBLISHED
Vendor
fleetdm
Product
fleet
Provider severity
MEDIUM
Conflicts
0

CVE-2026-26185

Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.

PUBLISHED
Vendor
directus, directus
Product
@directus/api, directus
Provider severity
MEDIUM
Conflicts
1

CVE-2026-26184

Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2019, Windows 10 Version 1809, Windows Server 2025 (Server Core installation), Windows Server 2019 (Server Core installation), Windows 10 Version 22H2, Windows 11 version 22H3, Windows 11 Version 24H2, Windows Server 2025, Windows Server 2022, Windows 11 Version 23H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 21H2
Provider severity
HIGH
Conflicts
1

CVE-2026-26183

Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2012, Windows Server 2012 R2 (Server Core installation), Windows Server 2012 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2016, Windows Server 2025 (Server Core installation), Windows Server 2016 (Server Core installation), Windows Server 2025, Windows Server 2022, Windows Server 2012 R2, Windows Server 2019, Windows Server 2019 (Server Core installation)
Provider severity
HIGH
Conflicts
1

CVE-2026-26182

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2022, Windows 10 Version 1809, Windows Server 2016 (Server Core installation), Windows 10 Version 21H2, Windows 11 Version 23H2, Windows 10 Version 1607, Windows Server 2012 (Server Core installation), Windows Server 2012, Windows 11 Version 24H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 22H2, Windows Server 2025, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2025 (Server Core installation), Windows 11 version 26H1, Windows 11 Version 25H2, Windows Server 2012 R2, Windows 11 version 22H3
Provider severity
HIGH
Conflicts
1

CVE-2026-26181

Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 Version 24H2, Windows 11 version 22H3, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 23H2, Windows 11 Version 25H2, Windows Server 2025 (Server Core installation), Windows Server 2025, Windows 11 version 26H1
Provider severity
HIGH
Conflicts
2

CVE-2026-26180

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2016, Windows 10 Version 21H2, Windows Server 2012 R2, Windows Server 2025, Windows 10 Version 1607, Windows Server 2016 (Server Core installation), Windows 11 Version 24H2, Windows 11 version 22H3, Windows Server 2012 R2 (Server Core installation), Windows Server 2012 (Server Core installation), Windows 10 Version 22H2, Windows Server 2012, Windows 10 Version 1809, Windows Server 2019, Windows 11 version 26H1, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2022, Windows Server 2019 (Server Core installation), Windows 11 Version 23H2, Windows 11 Version 25H2
Provider severity
HIGH
Conflicts
1

CVE-2026-2618

A vulnerability was determined in Beetel 777VR1 up to 01.00.09. This impacts an unknown function of the component SSH Service. This manipulation causes risky cryptographic algorithm. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED
Vendor
Beetel
Product
777VR1
Provider severity
LOW, MEDIUM
Conflicts
2

CVE-2026-26179

Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 version 22H3, Windows Server 2025, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 Version 23H2, Windows 11 version 26H1
Provider severity
HIGH
Conflicts
1

CVE-2026-26178

Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows an unauthorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2016 (Server Core installation), Windows 10 Version 1809, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 Version 23H2, Windows Server 2019, Windows Server 2025, Windows 11 version 22H3, Windows 10 Version 22H2, Windows 10 Version 21H2, Windows 11 Version 24H2, Windows Server 2025 (Server Core installation), Windows Server 2016, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 1607, Windows 11 Version 25H2
Provider severity
HIGH
Conflicts
2

CVE-2026-26177

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2019 (Server Core installation), Windows 11 Version 24H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025 (Server Core installation), Windows 11 Version 25H2, Windows Server 2016 (Server Core installation), Windows Server 2012, Windows Server 2025, Windows 11 Version 23H2, Windows Server 2012 (Server Core installation), Windows 10 Version 1809, Windows 10 Version 1607, Windows Server 2012 R2 (Server Core installation), Windows 11 version 22H3, Windows Server 2012 R2, Windows Server 2016, Windows 11 version 26H1, Windows Server 2022, Windows 10 Version 22H2, Windows 10 Version 21H2, Windows Server 2019
Provider severity
HIGH
Conflicts
1

CVE-2026-26176

Heap-based buffer overflow in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2012, Windows 11 Version 23H2, Windows Server 2012 R2, Windows Server 2019, Windows Server 2012 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 21H2, Windows Server 2016, Windows Server 2025, Windows Server 2012 R2 (Server Core installation), Windows Server 2019 (Server Core installation), Windows 11 Version 25H2, Windows Server 2016 (Server Core installation), Windows Server 2022, Windows 10 Version 22H2, Windows 10 Version 1809, Windows Server 2025 (Server Core installation), Windows 10 Version 1607, Windows 11 version 22H3, Windows 11 version 26H1, Windows 11 Version 24H2
Provider severity
HIGH
Conflicts
1

CVE-2026-26175

Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows 11 Version 23H2, Windows Server 2022, Windows Server 2019 (Server Core installation), Windows Server 2025, Windows Server 2019, Windows 10 Version 1809, Windows 11 version 22H3, Windows 10 Version 21H2, Windows Server 2016 (Server Core installation), Windows 11 version 26H1, Windows Server 2016, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 11 Version 25H2, Windows 10 Version 1607, Windows 10 Version 22H2
Provider severity
MEDIUM
Conflicts
1

CVE-2026-26174

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2012 (Server Core installation), Windows Server 2012, Windows 10 Version 1607, Windows Server 2022, Windows Server 2012 R2 (Server Core installation), Windows 11 version 22H3, Windows 10 Version 21H2, Windows 11 Version 25H2, Windows 11 version 26H1, Windows Server 2019 (Server Core installation), Windows Server 2025, Windows Server 2016 (Server Core installation), Windows 10 Version 22H2, Windows 10 Version 1809, Windows Server 2016, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2019, Windows 11 Version 24H2, Windows Server 2012 R2, Windows 11 Version 23H2, Windows Server 2025 (Server Core installation)
Provider severity
HIGH
Conflicts
2

CVE-2026-26173

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 Version 23H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2012, Windows 11 Version 24H2, Windows Server 2025 (Server Core installation), Windows 10 Version 1607, Windows Server 2019, Windows 10 Version 21H2, Windows Server 2016, Windows Server 2022, Windows 11 Version 25H2, Windows 10 Version 22H2, Windows Server 2016 (Server Core installation), Windows Server 2025, Windows Server 2012 (Server Core installation), Windows 10 Version 1809, Windows 11 version 26H1, Windows Server 2012 R2, Windows 11 version 22H3, Windows Server 2019 (Server Core installation), Windows Server 2012 R2 (Server Core installation)
Provider severity
HIGH
Conflicts
2

CVE-2026-26172

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 21H2, Windows 11 Version 25H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025 (Server Core installation), Windows 11 Version 24H2, Windows Server 2025, Windows 11 version 26H1, Windows Server 2022, Windows 10 Version 22H2, Windows 11 Version 23H2, Windows 11 version 22H3
Provider severity
HIGH
Conflicts
2

CVE-2026-26171

A flaw was found in .NET. A remote attacker could exploit a vulnerability related to unsafe transforms in EncryptedXml. This could lead to a Denial of Service (DoS), making the service unavailable, and a bypass of security features.

PUBLISHED
Vendor
Microsoft, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Microsoft, Microsoft, Red Hat, Red Hat, Microsoft, Red Hat, Red Hat, Red Hat, Microsoft, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product
PowerShell 7.5, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 10, Red Hat Hardened Images, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Enterprise Linux 9, .NET 8.0, .NET 10.0, Red Hat Hardened Images, Red Hat Enterprise Linux 10, .NET 9.0, Red Hat Enterprise Linux 8, Red Hat Hardened Images, Red Hat Enterprise Linux 10, PowerShell 7.6, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10.0 Extended Update Support
Provider severity
HIGH
Conflicts
3

CVE-2026-26170

Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 version 22H3, Windows 10 Version 1607, Windows 11 Version 25H2, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 22H2, Windows 10 Version 1809, Windows Server 2016 (Server Core installation), Windows Server 2025, Windows 11 Version 23H2, Windows 11 version 26H1, Windows Server 2016, Windows 10 Version 21H2, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 11 Version 24H2, Windows Server 2022
Provider severity
HIGH
Conflicts
1

CVE-2026-2617

A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of the component Telnet Service/SSH Service. The manipulation results in insecure default initialization of resource. The attack can only be performed from the local network. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED
Vendor
Beetel
Product
777VR1
Provider severity
MEDIUM
Conflicts
1

CVE-2026-26169

Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2019, Windows 11 Version 24H2, Windows 10 Version 1809, Windows Server 2025 (Server Core installation), Windows 10 Version 1607, Windows 11 Version 25H2, Windows Server 2022, Windows Server 2025, Windows Server 2019 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 21H2, Windows 10 Version 22H2, Windows Server 2016 (Server Core installation), Windows 11 version 22H3, Windows 11 version 26H1, Windows 11 Version 23H2, Windows Server 2016
Provider severity
MEDIUM
Conflicts
1

CVE-2026-26168

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 1809, Windows Server 2025, Windows 11 Version 25H2, Windows Server 2019, Windows 10 Version 22H2, Windows Server 2012 R2, Windows Server 2019 (Server Core installation), Windows 11 Version 23H2, Windows 10 Version 21H2, Windows Server 2016, Windows 11 version 26H1, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2012 R2 (Server Core installation), Windows Server 2025 (Server Core installation), Windows 10 Version 1607, Windows 11 version 23H2, Windows Server 2022, Windows 11 Version 24H2, Windows Server 2012, Windows Server 2016 (Server Core installation), Windows Server 2012 (Server Core installation)
Provider severity
HIGH
Conflicts
2

CVE-2026-26167

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 1607, Windows Server 2019, Windows 11 version 26H1, Windows 11 version 22H3, Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2025 (Server Core installation), Windows Server 2022, Windows 11 Version 25H2, Windows Server 2016, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 11 Version 24H2, Windows 11 Version 23H2, Windows Server 2019 (Server Core installation), Windows 10 Version 22H2, Windows Server 2016 (Server Core installation)
Provider severity
HIGH
Conflicts
2

CVE-2026-26166

Double free in Windows Shell allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 11 version 26H1, Windows 11 Version 23H2, Windows 11 Version 25H2, Windows 11 Version 24H2, Windows Server 2025 (Server Core installation), Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025, Windows Server 2022, Windows 11 version 22H3
Provider severity
HIGH
Conflicts
1

CVE-2026-26165

Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows Server 2022, 23H2 Edition (Server Core installation), Windows Server 2025 (Server Core installation), Windows Server 2025, Windows Server 2022, Windows 11 Version 24H2, Windows 11 version 22H3, Windows 11 Version 25H2, Windows 11 version 26H1, Windows 11 Version 23H2
Provider severity
HIGH
Conflicts
1

CVE-2026-26164

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

PUBLISHED
Vendor
Microsoft
Product
Microsoft 365 Copilot's Business Chat
Provider severity
HIGH
Conflicts
0

CVE-2026-26163

Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.

PUBLISHED
Vendor
Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft, Microsoft
Product
Windows 10 Version 21H2, Windows Server 2022, 23H2 Edition (Server Core installation), Windows 10 Version 22H2, Windows Server 2016 (Server Core installation), Windows 10 Version 1607, Windows Server 2012 R2 (Server Core installation), Windows 11 version 26H1, Windows Server 2016, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows 11 Version 25H2, Windows Server 2025, Windows 11 version 22H3, Windows 11 Version 24H2, Windows 10 Version 1809, Windows Server 2012 R2, Windows Server 2019, Windows Server 2025 (Server Core installation), Windows 11 Version 23H2
Provider severity
HIGH
Conflicts
1