2026 CVEs (page 150)
Page 150 of 470 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-50663 | High | 8.8 | 2026-07-14 | Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network. |
CVE-2026-50653 | High | 7.5 | 2026-07-14 | Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network. |
CVE-2026-50652 | High | 7.5 | 2026-07-14 | Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network. |
CVE-2026-50522 | Critical | 9.8 | 2026-07-14 | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. |
CVE-2026-50520 | High | 8.4 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code local… |
CVE-2026-50506 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-50384 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clip Service allows an authorized attacker to elevate pr… |
CVE-2026-50381 | Medium | 5.5 | 2026-07-14 | Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information local… |
CVE-2026-50364 | High | 7.3 | 2026-07-14 | Improper link resolution before file access ('link following') in Windows Server Backup allows an authorized attacker to elevate privileges locally. |
CVE-2026-50356 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to ele… |
CVE-2026-50354 | High | 7.1 | 2026-07-14 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-50351 | High | 7.8 | 2026-07-14 | Improper access control in Windows Audio Compression Manager (ACM) allows an authorized attacker to elevate privileges locally. |
CVE-2026-50350 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Trusted Runtime Interface Driver allows an authorized attacker to disclose information lo… |
CVE-2026-50342 | High | 8.8 | 2026-07-14 | Improper access control in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. |
CVE-2026-50338 | High | 8.2 | 2026-07-14 | Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network. |
CVE-2026-50333 | High | 7.8 | 2026-07-14 | Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. |
CVE-2026-50325 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-50323 | High | 7.0 | 2026-07-14 | Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally. |
CVE-2026-50318 | High | 7.8 | 2026-07-14 | Stack-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-50316 | Medium | 5.5 | 2026-07-14 | Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-50311 | High | 7.8 | 2026-07-14 | Improper access control in Windows Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-50308 | High | 7.8 | 2026-07-14 | Integer underflow (wrap or wraparound) in Windows NTFS allows an unauthorized attacker to execute code locally. |
CVE-2026-50303 | Medium | 5.5 | 2026-07-14 | Use of a cryptographic primitive with a risky implementation in Windows Key Guard allows an authorized attacker to bypass a security feature locally. |
CVE-2026-50300 | Medium | 5.5 | 2026-07-14 | Integer underflow (wrap or wraparound) in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2026-50299 | Medium | 6.8 | 2026-07-14 | Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack. |
CVE-2026-50298 | Medium | 6.8 | 2026-07-14 | Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate privileges with a physical attack. |
CVE-2026-50297 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-50296 | High | 7.0 | 2026-07-14 | Use after free in Graphics Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-50295 | Medium | 5.5 | 2026-07-14 | Improper privilege management in Microsoft Windows DNS allows an authorized attacker to bypass a security feature locally. |
CVE-2026-50294 | Medium | 6.2 | 2026-07-14 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally. |
CVE-2026-50293 | High | 7.8 | 2026-07-14 | Use after free in Windows Internal Task Bar allows an authorized attacker to elevate privileges locally. |
CVE-2026-49808 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileg… |
CVE-2026-49807 | Medium | 6.2 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally. |
CVE-2026-49806 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-49805 | High | 7.0 | 2026-07-14 | Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. |
CVE-2026-49804 | Medium | 6.6 | 2026-07-14 | Heap-based buffer overflow in Windows USB Video Driver allows an unauthorized attacker to elevate privileges with a physical attack. |
CVE-2026-49803 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows AppX Deployment Service allows an authorized attacker to… |
CVE-2026-49802 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Print Driver allows an authorized attacker to elevat… |
CVE-2026-49801 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows SMB allows an authorized attacker to disclose information locally. |
CVE-2026-49800 | High | 7.8 | 2026-07-14 | Integer overflow or wraparound in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally. |
CVE-2026-49799 | Medium | 6.5 | 2026-07-14 | Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. |
CVE-2026-49798 | Critical | 9.3 | 2026-07-14 | Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-49797 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
CVE-2026-49796 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally. |
CVE-2026-49795 | High | 8.8 | 2026-07-14 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-49794 | Medium | 4.6 | 2026-07-14 | Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack. |
CVE-2026-49793 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. |
CVE-2026-49792 | High | 7.8 | 2026-07-14 | Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally. |
CVE-2026-49791 | High | 7.1 | 2026-07-14 | Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate pri… |
CVE-2026-49790 | High | 7.3 | 2026-07-14 | Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability |
CVE-2026-49789 | High | 7.3 | 2026-07-14 | Stack-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. |
CVE-2026-49788 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in HTTP/2 allows an unauthorized attacker to deny service over a network. |
CVE-2026-49787 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. |
CVE-2026-49784 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to ele… |
CVE-2026-49783 | High | 7.8 | 2026-07-14 | Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. |
CVE-2026-49184 | High | 8.4 | 2026-07-14 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
CVE-2026-49183 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard Server allows an authorized attacker to elevat… |
CVE-2026-49181 | High | 7.5 | 2026-07-14 | Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-49180 | Medium | 5.5 | 2026-07-14 | Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information loca… |
CVE-2026-49178 | High | 8.8 | 2026-07-14 | Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network. |
CVE-2026-49176 | High | 7.8 | 2026-07-14 | Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally. |
CVE-2026-49175 | High | 7.8 | 2026-07-14 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. |
CVE-2026-49174 | Medium | 6.1 | 2026-07-14 | Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally. |
CVE-2026-49173 | High | 7.8 | 2026-07-14 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-49172 | Critical | 9.8 | 2026-07-14 | Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network. |
CVE-2026-49171 | High | 7.5 | 2026-07-14 | Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. |
CVE-2026-49170 | High | 7.8 | 2026-07-14 | Insufficient granularity of access control in Windows StateRepository API allows an authorized attacker to elevate privileges locally. |
CVE-2026-49169 | High | 8.0 | 2026-07-14 | Use after free in DNS Server allows an authorized attacker to execute code over a network. |
CVE-2026-49168 | Medium | 6.8 | 2026-07-14 | Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack. |
CVE-2026-49167 | Medium | 4.7 | 2026-07-14 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-49166 | High | 7.8 | 2026-07-14 | Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally. |
CVE-2026-49165 | High | 7.1 | 2026-07-14 | Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally. |
CVE-2026-49164 | High | 8.1 | 2026-07-14 | Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. |
CVE-2026-49162 | High | 7.0 | 2026-07-14 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-48581 | High | 7.8 | 2026-07-14 | Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally. |
CVE-2026-48572 | High | 7.0 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate p… |
CVE-2026-48571 | High | 7.0 | 2026-07-14 | Use after free in Windows App Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-48564 | High | 8.8 | 2026-07-14 | Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network. |
CVE-2026-48561 | Critical | 9.6 | 2026-07-14 | Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute… |
CVE-2026-47632 | High | 8.8 | 2026-07-14 | Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network. |
CVE-2026-47296 | High | 7.5 | 2026-07-14 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2026-47282 | Medium | 6.5 | 2026-07-14 | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. |
CVE-2026-45646 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2026-45496 | Medium | 5.5 | 2026-07-14 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security featu… |
CVE-2026-44806 | Medium | 5.3 | 2026-07-14 | Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network. |
CVE-2026-44800 | High | 7.8 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-42990 | Critical | 9.8 | 2026-07-14 | Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network. |
CVE-2026-42982 | High | 7.8 | 2026-07-14 | Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. |
CVE-2026-42975 | High | 8.0 | 2026-07-14 | Heap-based buffer overflow in Windows Bluetooth Port Driver allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2026-42900 | High | 8.1 | 2026-07-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate pri… |
CVE-2026-41087 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-40422 | Medium | 5.5 | 2026-07-14 | Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally. |
CVE-2026-40400 | High | 8.0 | 2026-07-14 | Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network. |
CVE-2026-40378 | High | 7.5 | 2026-07-14 | Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over… |
CVE-2026-36214 | Medium | 6.4 | 2026-07-14 | osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insuff… |
CVE-2026-34349 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally. |
CVE-2026-34348 | Medium | 6.5 | 2026-07-14 | Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network. |
CVE-2026-34346 | Medium | 5.5 | 2026-07-14 | Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally. |
CVE-2026-34328 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information locally. |
CVE-2026-33842 | Medium | 5.5 | 2026-07-14 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. |