2026 CVEs (page 335)
Page 335 of 452 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27912 | High | 8.0 | 2026-04-14 | Improper authorization in Windows Kerberos allows an authorized attacker to elevate privileges over an adjacent network. |
CVE-2026-27911 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to ele… |
CVE-2026-27910 | High | 7.8 | 2026-04-14 | Improper handling of insufficient permissions or privileges in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2026-27909 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
CVE-2026-27908 | High | 7.0 | 2026-04-14 | Use after free in Windows TDI Translation Driver (tdx.sys) allows an authorized attacker to elevate privileges locally. |
CVE-2026-27907 | High | 7.8 | 2026-04-14 | Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. |
CVE-2026-27906 | Medium | 4.4 | 2026-04-14 | Improper input validation in Windows Hello allows an authorized attacker to bypass a security feature locally. |
CVE-2026-27303 | Critical | 9.6 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code executio… |
CVE-2026-27288 | Medium | 5.4 | 2026-04-14 | Adobe Experience Manager versions 6.5.24, FP11.7 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit th… |
CVE-2026-27258 | Medium | 5.5 | 2026-04-14 | DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds write vulnerability that could lead to application denial-of-service. An attacker coul… |
CVE-2026-27246 | Critical | 9.3 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabi… |
CVE-2026-27245 | Critical | 9.3 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabi… |
CVE-2026-27243 | Critical | 9.3 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerabi… |
CVE-2026-26184 | High | 7.8 | 2026-04-14 | Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-26183 | High | 7.8 | 2026-04-14 | Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally. |
CVE-2026-26182 | High | 7.0 | 2026-04-14 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-26181 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2026-26180 | High | 7.8 | 2026-04-14 | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-26179 | High | 7.8 | 2026-04-14 | Double free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-26178 | High | 8.8 | 2026-04-14 | Integer size truncation in Windows Advanced Rasterization Platform (WARP) allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-26177 | High | 7.0 | 2026-04-14 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2026-26176 | High | 7.8 | 2026-04-14 | Heap-based buffer overflow in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to elevate privileges locally. |
CVE-2026-26175 | Medium | 4.6 | 2026-04-14 | Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2026-26174 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Update Service allows an authorized attacker to e… |
CVE-2026-26173 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2026-26172 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-26171 | High | 7.5 | 2026-04-14 | Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-26170 | High | 7.8 | 2026-04-14 | Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. |
CVE-2026-26169 | Medium | 6.1 | 2026-04-14 | Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally. |
CVE-2026-26168 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2026-26167 | High | 8.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elev… |
CVE-2026-26166 | High | 7.0 | 2026-04-14 | Double free in Windows Shell allows an authorized attacker to elevate privileges locally. |
CVE-2026-26165 | High | 7.0 | 2026-04-14 | Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. |
CVE-2026-26163 | High | 7.8 | 2026-04-14 | Double free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-26162 | High | 7.8 | 2026-04-14 | Access of resource using incompatible type ('type confusion') in Windows OLE allows an authorized attacker to elevate privileges locally. |
CVE-2026-26161 | High | 7.8 | 2026-04-14 | Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-26160 | High | 7.8 | 2026-04-14 | Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-26159 | High | 7.8 | 2026-04-14 | Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally. |
CVE-2026-26156 | High | 7.8 | 2026-04-14 | Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally. |
CVE-2026-26155 | Medium | 6.5 | 2026-04-14 | Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability |
CVE-2026-26154 | High | 7.5 | 2026-04-14 | Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-26153 | High | 7.8 | 2026-04-14 | Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. |
CVE-2026-26152 | High | 7.0 | 2026-04-14 | Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally. |
CVE-2026-26151 | High | 7.1 | 2026-04-14 | Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-26149 | Critical | 9.0 | 2026-04-14 | Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to perform spoofing over a network. |
CVE-2026-26143 | High | 7.8 | 2026-04-14 | Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-25184 | High | 7.0 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized… |
CVE-2026-24907 | Medium | 5.4 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in… |
CVE-2026-24906 | Medium | 5.4 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in… |
CVE-2026-23670 | Medium | 5.7 | 2026-04-14 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally. |
CVE-2026-23666 | High | 7.5 | 2026-04-14 | Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network. |
CVE-2026-23657 | High | 7.8 | 2026-04-14 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2026-23653 | Medium | 5.7 | 2026-04-14 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an authorized attacker to d… |
CVE-2026-21331 | Medium | 6.1 | 2026-04-14 | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a vic… |
CVE-2026-20945 | Medium | 4.6 | 2026-04-14 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-20930 | High | 7.8 | 2026-04-14 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to ele… |
CVE-2026-20928 | Medium | 4.6 | 2026-04-14 | Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security… |
CVE-2026-20806 | Medium | 5.5 | 2026-04-14 | Access of resource using incompatible type ('type confusion') in Windows COM allows an authorized attacker to disclose information locally. |
CVE-2026-0390 | Medium | 6.7 | 2026-04-14 | Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locally. |
CVE-2026-0209 | | 2026-04-14 | Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured. | |
CVE-2026-0207 | | 2026-04-14 | A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions. | |
CVE-2026-34626 | Medium | 6.3 | 2026-04-14 | Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attribut… |
CVE-2026-34622 | High | 8.6 | 2026-04-14 | Acrobat Reader versions 26.001.21411, 24.001.30360, 24.001.30362 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attribut… |
CVE-2026-27291 | High | 7.8 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-27286 | Medium | 5.5 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker c… |
CVE-2026-27285 | Medium | 5.5 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to application denial-of-service… |
CVE-2026-27284 | High | 7.8 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a rea… |
CVE-2026-27283 | High | 7.8 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context… |
CVE-2026-27238 | High | 7.8 | 2026-04-14 | InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in… |
CVE-2026-22692 | Medium | 4.9 | 2026-04-14 | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.13 and versions 4.0.0 through 4.1.4 contain a sandbox bypass vulnerability… |
CVE-2026-5713 | | 2026-04-14 | The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features… | |
CVE-2026-4832 | | 2026-04-14 | CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unauthenticated attacke… | |
CVE-2026-39815 | High | 8.8 | 2026-04-14 | A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7.2.1 through 7.2.2 may allow atta… |
CVE-2026-39814 | Medium | 6.7 | 2026-04-14 | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.1 through 7.4.12, FortiWeb 7.2.7 t… |
CVE-2026-39813 | Critical | 9.8 | 2026-04-14 | A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of… |
CVE-2026-39812 | Medium | 4.8 | 2026-04-14 | A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox… |
CVE-2026-39811 | Medium | 4.9 | 2026-04-14 | A integer overflow or wraparound vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4 all versions, FortiWeb 7.2… |
CVE-2026-39810 | Medium | 6.0 | 2026-04-14 | A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5 may allow attacker to information disclosure via decrypting… |
CVE-2026-39809 | Medium | 6.7 | 2026-04-14 | A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClien… |
CVE-2026-39808 | Critical | 9.8 | 2026-04-14 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may all… |
CVE-2026-38533 | Medium | 6.5 | 2026-04-14 | An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to… |
CVE-2026-38532 | High | 8.1 | 2026-04-14 | A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to… |
CVE-2026-38530 | High | 8.1 | 2026-04-14 | A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to a… |
CVE-2026-38529 | High | 8.8 | 2026-04-14 | A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrari… |
CVE-2026-38528 | High | 7.1 | 2026-04-14 | Krayin CRM v2.2.x was discovered to contain a SQL injection vulnerability via the rotten_lead parameter at /Lead/LeadDataGrid.php. |
CVE-2026-38527 | High | 8.5 | 2026-04-14 | A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via sup… |
CVE-2026-38526 | Critical | 9.9 | 2026-04-14 | An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary co… |
CVE-2026-2405 | Medium | 6.5 | 2026-04-14 | CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Ad… |
CVE-2026-2404 | Medium | 5.3 | 2026-04-14 | CWE-116 Improper Encoding or Escaping of Output vulnerability exists that could cause log injection and forged log when an attacker alters the POST /j_security… |
CVE-2026-2403 | Medium | 4.3 | 2026-04-14 | CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a… |
CVE-2026-2402 | Medium | 5.3 | 2026-04-14 | CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker to gain access to the user account by perfo… |
CVE-2026-2401 | Medium | 5.0 | 2026-04-14 | CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user ex… |
CVE-2026-2400 | Medium | 4.3 | 2026-04-14 | CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to reset when a Web Ad… |
CVE-2026-2399 | Medium | 6.1 | 2026-04-14 | CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause critical files overwritten with tex… |
CVE-2026-27316 | Low | 2.7 | 2026-04-14 | A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 throu… |
CVE-2026-25691 | Medium | 6.7 | 2026-04-14 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0… |
CVE-2026-23708 | High | 7.5 | 2026-04-14 | A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through… |
CVE-2026-22828 | High | 8.1 | 2026-04-14 | A heap-based buffer overflow vulnerability in Fortinet FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.6.2 through 7.6.4 may allow a remote unaut… |
CVE-2026-22576 | Medium | 4.3 | 2026-04-14 | A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7… |
CVE-2026-22574 | Medium | 4.1 | 2026-04-14 | A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.4, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR PaaS 7… |