2026 · High

High-severity vulnerabilities disclosed in 2026

High-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 18 of 42

← All 2026 Known exploited (KEV)Critical High Medium All recent

CVE-2026-9222HIGH 8.1
The Setracker2 Android Companion App version 3.1.5 and earlier contains a critical authentication flaw. Instead of requiring a password during login to backend services, the app accepts only a password hash—the cryptographic fingerprint of the password. An attacker who obtains this hash (through network interception, database breach, or other means) can use it directly to authenticate without knowing the actual password, gaining full access to user accounts and associated data.
CVE-2026-9272HIGH 8.1
Progress Flowmon's Anomaly Detection System (ADS) contains a privilege escalation and data manipulation vulnerability affecting versions before 12.5.6 and 13.0.5. An authenticated user with low-level permissions can submit malicious requests to access and modify data they shouldn't be able to reach. This bypasses normal authorization controls and could expose sensitive network monitoring information or allow unauthorized changes to detection rules and configurations.
CVE-2026-9662HIGH 8.1
The Recover Exit For WooCommerce plugin contains a flaw that allows attackers to access files on a WordPress server without needing to log in. The plugin fails to properly check a user-submitted parameter before using it to load PHP files, enabling attackers to navigate outside intended directories and read or potentially execute arbitrary code. All versions through 1.0.3 are affected.
CVE-2026-9753HIGH 8.1
CVE-2026-9753 is a memory safety vulnerability in MongoDB's aggregation pipeline that allows any authenticated user to crash the server or read sensitive data from server memory. An attacker with valid database credentials can exploit the $_internalApplyOplogUpdate stage by submitting a specially crafted document diff with malformed binary data, triggering an out-of-bounds memory access. This does not require special privileges beyond basic database authentication.
CVE-2026-9800HIGH 8.1
A vulnerability in Keycloak's Policy Enforcer allows any logged-in user to bypass authorization controls by manipulating the request URL. An attacker can trick the system into accepting requests that should be blocked by including the configured access-denied page path as part of the URL—either as a path segment or query parameter. This circumvents role-based access control, scope restrictions, and User-Managed Access permissions, granting unauthorized access to protected resources. The flaw requires an attacker to already have some form of authentication, but the bypass is otherwise trivial to exploit once discovered.
CVE-2026-9843HIGH 8.1
A critical vulnerability affects popular WordPress form plugins—Database for Contact Form 7, WPforms, and Elementor forms—in versions up to 1.5.1. Attackers can craft malicious form entries that, when viewed or edited by a site administrator, trigger deletion of arbitrary files from the server. This includes sensitive configuration files like wp-config.php, which can lead to site takeover or complete compromise. The attack requires no authentication from the attacker and exploits a gap in how file paths are validated before deletion.
CVE-2026-9964HIGH 8.1
CVE-2026-9964 is a memory safety vulnerability in Chrome's Bluetooth implementation on macOS that can allow attackers to run malicious code on a victim's computer. The attack requires two user actions: the victim must first install a malicious Chrome extension, and then interact with Bluetooth functionality in a way that triggers the underlying flaw. Once those conditions are met, the attacker can execute arbitrary code with the same privileges as the Chrome process.
CVE-2025-14773HIGH 8.0
ABB T-MAC Plus versions up to 4.0-24 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. When another user views a page containing the injected script, the script executes in their browser with their privileges, potentially enabling attackers to steal sensitive information, hijack sessions, or perform unauthorized actions on behalf of victims. The vulnerability requires both user authentication and victim interaction, limiting but not eliminating its risk in multi-user environments.
CVE-2025-48640HIGH 8.0
CVE-2025-48640 is a privilege escalation vulnerability in Google Android where an attacker with local network proximity and low-level user privileges can bypass permission checks to approve third-party passkey pairings without the device owner's knowledge or action. This allows an attacker to gain elevated access to sensitive device functions and data.
CVE-2025-53829HIGH 8.0
ownCloud 10 versions before 10.15.3 contain a path traversal vulnerability that allows administrators with legitimate system access to execute arbitrary code on the server. An attacker would need to first obtain administrative credentials to exploit this, but once they do, they can bypass normal file access restrictions and run malicious commands with full system privileges. This is a significant insider-threat vector for organizations running affected ownCloud versions.
CVE-2025-68713HIGH 8.0
Rakuten Send Anywhere version 23.2.9 for Android contains a flaw that allows any app on a user's device—even one without file access permissions—to secretly force downloads into Send Anywhere's storage. Those files then show up in the app's trusted "Received" interface, making them appear legitimate. An attacker can exploit this to push malicious APK files (which the user might then install) or flood the app with huge files to crash or slow down the device.
CVE-2026-0059HIGH 8.0
A heap buffer overflow vulnerability in Android's SDP (Session Description Protocol) discovery module allows an attacker on the same network segment to execute code with the privileges of the affected process. No user action is required, and the attacker needs only basic network access—the flaw can be triggered remotely through specially crafted SDP packets. This is a serious local/adjacent network attack vector that bypasses normal authentication and user interaction requirements.
CVE-2026-0095HIGH 8.0
CVE-2026-0095 is a heap corruption flaw in Android's Bluetooth stack that allows a local attacker with limited privileges to escalate to higher system permissions. The vulnerability stems from an integer overflow in the l2c_fcr_clone_buf function, which can be manipulated to corrupt memory in the Bluetooth daemon process. Because this runs in a privileged context, successful exploitation grants elevated access without requiring additional tricks or user interaction.
CVE-2026-0097HIGH 8.0
A logic error in Android's Bluetooth Low Energy (LE) pairing mechanism allows an attacker within wireless range to pair a device without requiring user approval or interaction. An attacker with local access to a Bluetooth-enabled Android device can escalate privileges by circumventing the normal pairing consent flow, potentially gaining full read, write, and execution access on the target device. This is particularly dangerous because it requires no user action to exploit.
CVE-2026-0411HIGH 8.0
A security flaw in NETGEAR Orbi mesh WiFi systems could let someone already on your network steal administrator credentials and take control of your router. The vulnerability affects specific satellite models in the RBR, RBE, and RBS product lines. Standalone Orbi systems without satellites are not at risk. An attacker with network access could escalate from regular user to full administrative control without needing to interact with the device itself.
CVE-2026-0419HIGH 8.0
A flaw in NETGEAR's JR6150 AC750 WiFi router allows anyone connected to the local wireless network to run arbitrary operating system commands on the device. The vulnerability stems from inadequate checking of user input before executing system-level operations. Because this router model reached end-of-support in 2018, NETGEAR has stated no security patches will be released. The company recommends replacing affected devices with current models that receive ongoing security updates.
CVE-2026-10538HIGH 8.0
CVE-2026-10538 is a deserialization vulnerability in Control-M messaging that allows authenticated attackers to trigger unintended server behavior by sending specially crafted serialized data. The flaw exists in out-of-support Control-M/Server and Control-M/Enterprise Manager versions 9.0.20.x and potentially earlier, where the messaging consumer fails to properly restrict which object types can be deserialized. An attacker with valid credentials can exploit this to compromise confidentiality, integrity, and availability across connected systems.
CVE-2026-10712HIGH 8.0
GitLab has patched a reflected cross-site scripting (XSS) vulnerability affecting recent versions of GitLab Community Edition and Enterprise Edition. An attacker could craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript code within the user's browser session. The vulnerability stems from improper validation of URL paths under specific conditions. No authentication is required to exploit this flaw—only user interaction (clicking a link) is necessary. The issue affects GitLab versions 18.10 through 18.11.5, 19.0 through 19.0.2, and 19.1 before 19.1.1.
CVE-2026-11241HIGH 8.0
A vulnerability in Google Chrome's Cast feature allows an attacker on your local network to escalate their privileges on an affected machine by tricking a user into visiting a specially crafted web page. The attack requires the attacker to already be on your network segment and the user to interact with the malicious page, but once triggered, it grants elevated system access. Google rates this as a low-severity issue in Chromium, yet the CVSS 3.1 score reflects broader impact potential including confidentiality, integrity, and availability compromise.
CVE-2026-11400HIGH 8.0
A privilege escalation flaw exists in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL. An authenticated user with low privileges can exploit an untrusted search path to run malicious code that escalates their access level to match any other database user, potentially gaining superuser rights. The attack requires the victim to connect to the cluster through the affected wrapper, making it a realistic threat in environments where multiple database users operate through the same wrapper instance.
CVE-2026-11401HIGH 8.0
A privilege escalation flaw exists in the AWS Advanced Go Wrapper used to connect to Amazon Aurora PostgreSQL databases. A low-privileged, authenticated database user can craft a malicious function that executes when another user connects through the wrapper, allowing them to assume that user's privileges—potentially including rds_superuser access. This requires the attacker to have database credentials and user interaction (such as a targeted user initiating a connection), but once triggered, it grants near-complete database control to an unauthorized actor.
CVE-2026-11766HIGH 8.0
The Ultimate Member WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in custom textarea profile fields. Any authenticated user—including those with minimal Subscriber privileges—can inject malicious JavaScript into their profile that will execute in the browsers of other users viewing that profile, including administrators. This allows attackers to steal credentials, perform unauthorized actions, or compromise admin accounts without requiring special permissions or user interaction beyond viewing a profile.
CVE-2026-11903HIGH 8.0
A cross-site scripting (XSS) vulnerability exists in the Ad Hoc module of Progress MOVEit Transfer. An authenticated attacker can inject malicious scripts into web pages that execute in the context of other users' browsers, potentially stealing session tokens, credentials, or performing unauthorized actions on their behalf. The vulnerability requires user interaction (a victim clicking a malicious link) and affects multiple recent versions of MOVEit Transfer.
CVE-2026-12218HIGH 8.0
Yealink SIP-T46U IP phones running firmware version 108.87.50.1 contain a stack-based buffer overflow vulnerability in the web service. An attacker on the local network with user-level privileges can exploit this flaw by sending a specially crafted request to the `/api/inner/beforewifitest` endpoint, potentially executing arbitrary code or crashing the device. The vulnerability has been publicly disclosed, though the vendor is actively developing a patch.
CVE-2026-12220HIGH 8.0
A stack-based buffer overflow vulnerability exists in Yealink SIP-T46U IP phones (firmware version 108.86.0.118 and potentially others) within the firmware upload mechanism. An authenticated attacker on the local network can exploit this by sending a specially crafted request to the firmware chunk upload endpoint, causing the application to write data beyond allocated buffer boundaries. This could lead to code execution or a device crash. The vulnerability requires local network access and valid credentials, which significantly constrains the attack surface but remains a serious risk in office environments where internal networks may not be fully trusted.
CVE-2026-12221HIGH 8.0
Yealink SIP-T46U IP phones running firmware version 108.86.0.118 contain a stack-based buffer overflow in their firmware upgrade component. An attacker on the same local network who has valid credentials can send specially crafted upgrade requests with manipulated parameters to trigger the overflow, potentially allowing them to execute arbitrary code with the same privileges as the phone process. Proof-of-concept code has already been disclosed publicly, increasing immediate risk.
CVE-2026-12222HIGH 8.0
A stack-based buffer overflow vulnerability exists in Yealink SIP-T46U IP phones running firmware version 108.86.0.118. The flaw is in the Web FastCGI Service's Bluetooth testing function, which fails to properly validate input parameters (btMac, pin, and reserved fields) when processing requests to the /api/inner/bttest endpoint. An attacker on the local network with user-level access can send specially crafted requests to overflow the stack and potentially execute arbitrary code on the phone. Public exploit code is available, increasing the practical risk.
CVE-2026-12240HIGH 8.0
The Export User Data plugin for WordPress has a critical flaw that allows authenticated users with basic subscriber privileges to delete any file on the website's server. The vulnerability stems from improper validation when the plugin processes serialized data objects. An attacker can embed a malicious payload in their user profile's display name, and when a site administrator exports user data, the plugin deserializes and processes this payload unsafely, leading to file deletion. By strategically deleting essential files like wp-config.php, an attacker can gain complete control of the website or render it non-functional. This requires an admin to initiate the export, but since site administrators regularly perform data exports for legitimate reasons, the risk window is substantial.
CVE-2026-14476HIGH 8.0
A path traversal vulnerability exists in SSSD's Active Directory GPO (Group Policy Object) provider. An attacker with AD GPO management permissions can exploit improper input validation to write files outside the intended GPO cache directory with root privileges. On default Red Hat Enterprise Linux systems running SELinux in enforcing mode, this could be leveraged to modify Kerberos configuration files and bypass authentication mechanisms.
CVE-2026-15293HIGH 8.0
The WP Business Intelligence Lite WordPress plugin contains a flaw that allows low-privileged users to bypass authorization controls and modify SQL queries. When an administrator views one of these tampered queries, it can execute arbitrary SQL code, potentially giving attackers administrative privileges. This affects all versions up to and including 3.2.0 and requires only Subscriber-level access to exploit.
CVE-2026-20452HIGH 8.0
A heap buffer overflow vulnerability exists in MediaTek's wireless LAN access point driver that allows a nearby attacker with local user privileges to corrupt memory and achieve remote code execution. The flaw requires the attacker to be on the same local network segment but does not require any user interaction to trigger. Exploitation would grant the attacker the same privilege level as the user running the affected driver—typically limited, but sufficient to compromise the integrity and confidentiality of the device.
CVE-2026-23879HIGH 8.0
py7zr is a Python library used to work with 7zip archives. A flaw in versions 1.1.2 and earlier allows an attacker to craft a malicious archive containing symbolic links that, when extracted, write files outside the intended destination folder. By chaining symbolic links, an attacker can bypass the library's directory boundary protections and write arbitrary files to the system. This could lead to code execution, privilege escalation, or data corruption depending on what files are overwritten and where.
CVE-2026-33245HIGH 8.0
React Router, a widely-used routing library for React applications, contains a cross-site scripting (XSS) vulnerability in its experimental React Server Components (RSC) feature. Versions 7.7.0 through 7.13.1 are affected. If an attacker can influence redirect instructions sent to your application—for example, through a compromised backend endpoint or man-in-the-middle scenario—malicious code could execute in users' browsers. The vulnerability is limited to applications actively using the unstable RSC APIs; standard React Router implementations are not impacted. A patch is available in version 7.13.2.
CVE-2026-34171HIGH 8.0
Coolify, a self-hosted platform for managing servers and applications, contains a flaw in how it handles password reset invitations. An attacker can craft a password reset link and trick a user into clicking it, then reset that user's password to a value the attacker knows in advance. This bypasses normal authentication and gives the attacker full account access. The vulnerability affects Coolify versions before 4.0.0-beta.471 and requires user interaction (clicking a malicious link) to exploit.
CVE-2026-34693HIGH 8.0
Adobe Experience Manager Forms JEE is vulnerable to a reflected cross-site scripting (XSS) flaw that allows attackers to inject malicious code into web pages. When a victim visits a specially crafted URL or interacts with a compromised page, the attacker can potentially hijack the user's session, escalate privileges, or take over their account. The vulnerability affects LTS SP1 and version 6.5.24.0 and earlier. Successful exploitation requires social engineering—tricking a user into clicking a malicious link or visiting a compromised site—but does not require the attacker to have direct system access.
CVE-2026-35482HIGH 8.0
alf.io, an open-source ticketing platform for conferences and events, contains a critical sandbox escape flaw in its extension script engine. An authenticated administrator can exploit this vulnerability to run arbitrary commands on the server. The flaw stems from an improperly protected Java object exposed to the sandboxed JavaScript environment, combined with gaps in code validation that allow attackers to use Java reflection to break out of the sandbox entirely. This requires administrator credentials to exploit, but once compromised, grants complete control over the underlying server.
CVE-2026-35630HIGH 8.0
OpenClaw versions before 2026.5.18 have an authorization bypass flaw in the QQBot approval workflow. Users who are not designated approvers can click approval buttons to authorize pending requests for code execution or plugin installations—permissions they should not have. An attacker with basic OpenClaw access could escalate their capabilities by approving requests they have no business approving, effectively bypassing the system's governance controls.
CVE-2026-37266HIGH 8.0
Responsive File Manager version 9.14.0 contains a remote code execution vulnerability in its force_download.php component. An authenticated attacker can exploit this flaw to execute arbitrary code on the server, potentially gaining full control of the application and underlying system. The vulnerability requires an attacker to have valid login credentials and user interaction (such as clicking a malicious link), but poses a significant risk in multi-user or publicly accessible deployments.
CVE-2026-39598HIGH 8.0
Kodezen's Academy LMS Pro contains a file upload vulnerability that allows administrators with high-level access to upload and execute malicious web shells on the server. An attacker with administrative credentials could bypass file type restrictions and place executable code directly on the web server, leading to complete system compromise. The vulnerability exists in versions before 3.5.2.
CVE-2026-40711HIGH 8.0
Dell Container Storage Modules versions 2.16.0 across four product lines (PowerStore, Unity, PowerFlex, and PowerMax) contain an OS command injection flaw. An attacker with high-level administrative privileges and network access could craft malicious input to execute arbitrary commands on affected systems. This is a serious vulnerability because container storage infrastructure often handles critical data and sits in sensitive network positions.
CVE-2026-41722HIGH 8.0
VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities that allow authenticated attackers with policy creation, view, or text-widget privileges to inject malicious scripts. These scripts execute in the context of administrative actions within VMware Cloud Foundation Operations, potentially allowing attackers to perform unauthorized administrative operations. The vulnerability requires user interaction (such as an administrator viewing a malicious policy or widget) but can have significant impact once triggered.
CVE-2026-41723HIGH 8.0
VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities that allow authenticated users with policy, view, or text-widget creation privileges to inject malicious scripts. These scripts execute in the context of administrative sessions, potentially enabling attackers to perform unauthorized administrative actions. The vulnerability requires an attacker to have legitimate access credentials and user interaction to succeed, but poses significant risk to organizations running affected VMware infrastructure management platforms.
CVE-2026-41724HIGH 8.0
VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities that allow authenticated users with policy, view, or text-widget creation privileges to inject malicious scripts. These scripts execute in the context of administrative sessions, potentially enabling attackers to perform unauthorized administrative actions without additional authentication. The vulnerability requires both authentication and user interaction (clicking a link or visiting a crafted page), but once triggered, grants full administrative capability within the affected platform.
CVE-2026-44168HIGH 8.0
MariaDB Server has a command injection vulnerability in its data replication process. When a database node joins a cluster using the mariabackup method, the existing node (donor) improperly validates parameters sent by the joining node. A malicious actor with high-level database access could craft malicious parameters to execute arbitrary commands on the donor's server. This affects multiple recent MariaDB versions across the 10.6, 10.11, 11.4, 11.8, and 12.3 release branches.
CVE-2026-45644HIGH 8.0
Microsoft Live Share Canvas SDK contains a cross-site scripting (XSS) vulnerability that allows an authorized user to inject malicious code into web pages. An attacker with valid credentials can craft specially formatted input that executes arbitrary JavaScript in the context of other users' browsers, potentially allowing them to steal sessions, modify content, or escalate their privileges within collaborative environments. The vulnerability requires user interaction—specifically, a victim must view a page containing the attacker's injected payload—but poses significant risk in teams using Live Share Canvas for real-time code collaboration.
CVE-2026-45745HIGH 8.0
Termix Desktop, a web-based server management application built on Electron, has a critical flaw in how it validates HTTPS certificates. Starting from version 1.7.0, the application disables TLS certificate validation entirely, which means attackers on the same network can impersonate the Termix server and intercept all traffic between your desktop client and the management server. This creates a direct path to stealing login credentials and session tokens while you work.
CVE-2026-46332HIGH 8.0
A memory overflow vulnerability exists in the Linux kernel's Greybus BeaglePlay bootloader driver. The vulnerability occurs when the bootloader receives data over a serial device connection. The driver uses a fixed-size buffer to collect incoming data chunks, but it doesn't properly validate whether new data fits into the remaining buffer space before copying it. An attacker with local or adjacent network access could send specially crafted data packets to overflow this buffer, potentially executing arbitrary code or causing system crashes.
CVE-2026-46787HIGH 8.0
A vulnerability in Oracle WebCenter Content (version 14.1.2.0.0) allows an unauthenticated attacker to compromise the system and modify or delete critical data. The attack requires tricking a legitimate user into performing an action—the attacker cannot exploit it directly. Because the vulnerability can spread its impact to other connected systems, the overall risk is rated HIGH. An attacker with network access could potentially read, modify, or delete sensitive information stored in WebCenter Content or systems that rely on it.
CVE-2026-46796HIGH 8.0
A vulnerability in Oracle WebCenter Sites allows a low-privileged attacker with network access to take over the system through a specially crafted request. The attack requires tricking an authorized user into clicking a malicious link or interacting with the attacker's content. While the attacker needs existing low-level access and user interaction to succeed, successful exploitation results in complete compromise of the WebCenter Sites instance, including exposure of sensitive data and ability to modify or disable systems.
CVE-2026-46894HIGH 8.0
A vulnerability in Oracle's iSupplier Portal—a supplier management component of Oracle E-Business Suite—allows a low-privileged attacker to gain complete control over the portal through a specially crafted request. The flaw requires tricking a legitimate user into interacting with malicious content, but once successful, an attacker can read sensitive data, modify information, or disrupt service availability. Versions 12.2.3 through 12.2.15 are affected.
CVE-2026-47294HIGH 8.0
Microsoft Office SharePoint contains a vulnerability that allows authenticated users to execute arbitrary code on affected servers through specially crafted input in OS commands. An attacker with valid SharePoint credentials can inject malicious commands that bypass input validation, leading to unauthorized code execution with the privileges of the SharePoint service account. This vulnerability requires user interaction and network access but poses significant risk to organizations relying on SharePoint for document management and collaboration.
CVE-2026-47298HIGH 8.0
CVE-2026-47298 is a high-severity authorization flaw in Microsoft SharePoint Server that allows an authenticated attacker to execute arbitrary code on affected systems over the network. While the attacker must already have valid credentials, the vulnerability bypasses intended access controls, enabling privilege escalation or lateral movement within an organization. User interaction is required to trigger the exploit, which limits but does not eliminate risk in environments where phishing or social engineering are viable attack vectors.
CVE-2026-48163HIGH 8.0
MariaDB servers are vulnerable to arbitrary command execution when two nodes communicate during a state transfer process (SST). An attacker who controls a newly joining node can trick the existing node into running malicious shell commands. This affects multiple MariaDB versions and relies on the rsync method for transferring data between nodes. The vulnerability requires administrative access to initiate the join process, but once exploited, it provides full control over the donor database server.
CVE-2026-48165HIGH 8.0
A critical security flaw in MariaDB allows high-privileged database users to execute arbitrary shell commands with the permissions of the MariaDB process on Galera cluster joiner nodes. The vulnerability exists in the wsrep_sst_receive_address and wsrep_sst_donor configuration variables, which can be manipulated by administrative users to break out of the database context. This affects multiple versions across MariaDB's active release lines and requires immediate patching to prevent unauthorized system access.
CVE-2026-48612HIGH 8.0
CVE-2026-48612 is a flaw in how OAuth authentication validates state during the login process. An attacker can exploit this by tricking a victim into linking their account to an attacker-controlled account. Once linked, the attacker gains control over the victim's account, effectively taking it over. The vulnerability requires the attacker to have some initial access or credentials and needs user interaction, but the impact—full account compromise—is severe.
CVE-2026-48719HIGH 8.0
Warp, a development environment designed to support agentic workflows, contains a command injection vulnerability in how it handles Git branch names. An attacker who can push a malicious branch to a repository can craft a branch name containing shell commands. When a developer using Warp selects that branch from the UI, the crafted commands execute in the victim's shell with their privileges. This requires the attacker to have push access to the repository and the victim to interact with the malicious branch through Warp's interface.
CVE-2026-49091HIGH 8.0
Kibana contains a flaw where specially crafted input can be injected into log files without being properly cleaned or neutralized. When those logs are later displayed in a terminal, the injected content may include control sequences that alter what the user sees—potentially masking real activity, inserting false entries, or manipulating audit trails. An attacker must have valid credentials to exploit this, and the victim must view the compromised logs in an affected terminal. This creates a risk to log integrity and could complicate incident investigation or compliance audits.
CVE-2026-49367HIGH 8.0
JetBrains IntelliJ IDEA contains a command execution vulnerability affecting versions before 2026.1.1. An authenticated user with guest-level privileges can execute arbitrary commands on the system where IntelliJ IDEA is running. The vulnerability requires user interaction but grants an attacker with low-privilege access the ability to perform high-impact actions, including reading sensitive files, modifying project code, or disrupting development environments.
CVE-2026-53256HIGH 8.0
A use-after-free vulnerability exists in the Linux kernel's Bluetooth RFCOMM module. When a device attempts to establish a Bluetooth connection, the kernel retrieves a reference to a listening socket but fails to properly protect it from being freed by a simultaneous socket closure. An attacker with local Bluetooth access and user-level privileges can trigger this race condition, potentially causing the kernel to crash or execute arbitrary code. The vulnerability requires specific timing and local access, making it a moderate but credible threat in multi-user or shared-device environments.
CVE-2026-53357HIGH 8.0
A use-after-free vulnerability exists in the Linux kernel's Bluetooth L2CAP socket implementation. When a listening socket is closed while a Bluetooth device simultaneously disconnects, a child socket can be freed by the disconnect handler before the listening socket's cleanup routine finishes accessing it. This occurs because the cleanup code and the disconnect handler don't properly coordinate access to sockets that are in the process of being accepted. An attacker with local access and Bluetooth connectivity could exploit this to crash the kernel or potentially execute code with elevated privileges.
CVE-2026-53829HIGH 8.0
OpenClaw versions prior to 2026.5.18 suffer from a display truncation flaw that allows authenticated users to deceive approval workflows. An attacker can craft oversized commands with innocent-looking prefixes that pass review, but hidden malicious suffixes execute after approval is granted. This bypasses the human review step that should catch unauthorized operations.
CVE-2026-54030HIGH 8.0
LibreChat, a self-hosted ChatGPT alternative that integrates with multiple AI providers, contains a flaw in how it validates OAuth credentials when connecting to Model Context Protocol (MCP) servers. Before version 0.8.5, the application fails to verify that incoming OAuth tokens are actually intended for the server you configured, leaving the door open for a malicious MCP server to intercept and steal those tokens. An attacker would need to trick a user into connecting to their malicious server, but once they do, they gain the ability to impersonate that user across integrated AI services.
CVE-2026-59224HIGH 8.0
Open WebUI, a self-hosted AI platform, contains an authentication bypass vulnerability in versions before 0.10.0. When a user accesses the terminal feature, the system constructs a backend connection using an unencoded session ID, allowing an attacker to inject query parameters and impersonate another user. Additionally, the system trusts an HTTP header (X-User-Id) without verifying it, making it possible for an authenticated attacker to escalate privileges or access other users' terminal sessions. The vulnerability requires the attacker to be already logged in and relies on social engineering or user interaction to succeed.
CVE-2026-9212HIGH 8.0
A vulnerability in multiple NETGEAR routers and mesh systems allows users already connected to your local network to run unauthorized commands or change device settings without proper authentication checks. This affects a broad range of NETGEAR models, including mesh systems and enterprise-grade routers. An attacker must be on your network to exploit it, but once there, they can access sensitive data or alter your router's configuration.
CVE-2026-12250HIGH 7.9
Pardus Domain Joiner contains a vulnerability where sensitive information is exposed in process invocations, potentially allowing an attacker with local access to extract confidential data. The vulnerability affects versions 0.5.2 through 0.5.3 and requires an interactive session with local privileges to exploit. While not currently listed in CISA's Known Exploited Vulnerabilities catalog, the exposure of sensitive data in process memory or command-line arguments represents a meaningful risk in multi-user or shared system environments.
CVE-2026-35266HIGH 7.9
Oracle REST Data Services contains a vulnerability that allows an attacker with low-level network access and user credentials to manipulate critical data or disrupt service availability. The attack requires tricking another user into taking action, making it moderately difficult to exploit in practice. Versions 24.2.0 through 26.1.0 are affected. Success can lead to unauthorized access, modification, or deletion of sensitive information, as well as partial service outages.
CVE-2026-42487HIGH 7.9
This is a race condition vulnerability in Xen's handling of guest virtual machine I/O port access. When a guest operating system attempts to access hardware I/O ports, Xen's device model manages how those accesses are translated or emulated. The problem: the internal list tracking these translations can be modified while another part of Xen is reading it, creating a window where the system reads inconsistent or stale information. This can lead to unexpected behavior, data corruption, or system crashes. A local attacker with guest-level privileges could exploit this to affect the stability or integrity of the hypervisor or other guest systems sharing the same host.
CVE-2026-45588HIGH 7.9
A weakness in Windows Secure Boot—a fundamental protection mechanism that ensures only authorized code runs during system startup—has been discovered that allows a high-privileged attacker to bypass this security feature on affected systems. The flaw affects multiple versions of Windows 10, Windows 11, and Windows Server across generations. While exploitation requires high-level access locally (such as from an administrator account), a successful bypass could allow an attacker to circumvent boot-time protections, potentially enabling persistence or further system compromise.
CVE-2026-45654HIGH 7.9
Windows Secure Boot, a critical firmware-level security mechanism, contains an access control flaw that allows a high-privileged local attacker to circumvent its protections. Secure Boot is designed to ensure that only trusted code runs during system startup; this vulnerability permits an authorized user with administrative or equivalent rights to bypass those protections, potentially allowing unsigned or malicious code to execute at boot time. The issue affects recent Windows 11 versions and Windows Server 2025.
CVE-2026-46848HIGH 7.9
Oracle WebLogic Server contains a privilege escalation vulnerability in its Console component that allows a low-privileged, authenticated attacker with local access to the server to compromise the system and gain unauthorized access to sensitive data. The attack requires trick a different user into taking an action, but once successful, can lead to disclosure or modification of critical information accessible through WebLogic. The vulnerability affects WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0.
CVE-2026-47656HIGH 7.9
CVE-2026-47656 is a high-severity vulnerability in the Windows Boot Manager that allows an attacker with administrator privileges to disable or circumvent a security protection mechanism on a local system. While the attacker must already have elevated permissions, once exploited, they can interfere with boot-level security controls—a critical concern because these controls are meant to prevent unauthorized system modifications. This is not currently listed as actively exploited in the wild, but it warrants prompt patching given the scope of affected Windows versions.
CVE-2026-48568HIGH 7.9
CVE-2026-48568 is a high-severity vulnerability in Windows Secure Boot that allows a user with administrator or higher privileges to bypass a key security mechanism on their local system. Secure Boot is designed to prevent unauthorized code from running during system startup. This flaw breaks that protection, potentially enabling an attacker with elevated local access to load malicious code earlier in the boot process than normal security controls would permit. The vulnerability affects a broad range of Windows 10 and Windows 11 versions, as well as Windows Server 2012 through 2025.
CVE-2026-48570HIGH 7.9
A flaw in Windows Secure Boot allows a high-privileged local attacker to disable or circumvent this critical platform security feature. Secure Boot is designed to prevent unauthorized code from running during system startup; this vulnerability defeats that protection. The attacker needs administrative or system-level access to exploit it, and the impact spans confidentiality and integrity of the entire system. This is not currently known to be exploited in the wild, but it represents a significant risk for any environment where an insider or compromised administrator poses a threat.
CVE-2026-48573HIGH 7.9
A vulnerability in Windows Secure Boot allows someone with high-level local access to bypass a key security feature that prevents unauthorized code from running during system startup. The flaw affects multiple versions of Windows 10, Windows 11, and Windows Server. While an attacker needs elevated privileges to exploit it, successful exploitation could allow them to circumvent protections that are meant to ensure only trusted software loads at boot time.
CVE-2026-48575HIGH 7.9
Windows Secure Boot, a critical firmware security feature designed to prevent unauthorized code execution during system startup, contains a protection mechanism failure that an authorized attacker can exploit locally. An attacker with administrative privileges can bypass Secure Boot controls, potentially allowing them to load unauthorized code at the lowest system level. The vulnerability affects multiple versions of Windows 10 and Windows 11, as well as Windows Server editions spanning 2012 through 2025.
CVE-2026-48576HIGH 7.9
CVE-2026-48576 is a high-severity security flaw in Windows Secure Boot that allows an authorized attacker with elevated privileges to bypass a critical security feature on local systems. Secure Boot is a foundational Windows security mechanism designed to prevent unauthorized code from executing during system startup. This vulnerability undermines that protection, potentially enabling an attacker to load unsigned or malicious firmware or bootloaders. The threat requires the attacker to already have administrative or system-level access, limiting the immediate attack surface, but the ability to circumvent Secure Boot represents a significant escalation once that initial access is obtained.
CVE-2026-48578HIGH 7.9
CVE-2026-48578 is a privilege escalation flaw in Windows Secure Boot affecting Windows 10 and 11 across multiple versions, as well as Windows Server 2012 through 2025. An attacker who already has administrative credentials on a system can exploit improper access controls to gain elevated privileges, potentially affecting system integrity and confidentiality. The vulnerability requires the attacker to be locally present and authenticated, but does not require user interaction to exploit. This is not currently listed in CISA's Known Exploited Vulnerabilities catalog.
CVE-2016-20085HIGH 7.8
Realtek's High Definition Audio Driver version 6.0.1.6730 has a privilege escalation flaw rooted in how the Windows service is configured. The driver specifies its service path without quotation marks, meaning Windows may look for an executable in an unexpected location before finding the intended one. A local attacker with basic user privileges can exploit this by placing a malicious executable in one of those intermediate directories, then triggering a service restart to run their code with the highest system privileges (LocalSystem). This turns a low-impact design oversight into a serious lateral movement and persistence weapon.
CVE-2016-20086HIGH 7.8
Vembu StoreGrid 4.0 has a privilege escalation vulnerability in two critical Windows services—RemoteBackup and RemoteBackup_webServer. These services are configured with unquoted file paths, which means an attacker with local system access can place a malicious executable in a location along the service's search path. When the service is restarted, Windows will execute the attacker's code instead of the legitimate service binary, granting the attacker full system-level (LocalSystem) privileges. This is a classic local privilege escalation attack that requires initial local access but yields complete system compromise.
CVE-2016-20087HIGH 7.8
Fortitude HTTP version 1.0.4.0 contains a privilege escalation flaw rooted in how Windows constructs the path to the service executable. When a service path lacks quotation marks, Windows will attempt to execute the first unquoted portion of the path, creating an opportunity for a local attacker to plant a malicious executable in a directory that gets searched during service startup. If successful, that malicious code runs with SYSTEM-level privileges, giving an attacker complete control over the affected machine.
CVE-2016-20088HIGH 7.8
Comodo Chromodo Browser version 52.15.25.664 has a privilege escalation vulnerability in its automatic update service. The service path is not properly quoted, allowing a local user with regular (non-admin) access to place a malicious program in the service directory. When the service restarts—either manually, during a system reboot, or during an update—the malicious program runs with full system privileges, giving an attacker complete control of the affected machine.
CVE-2016-20089HIGH 7.8
Iperius Remote version 1.7.0 has a critical flaw in how it registers itself as a Windows service. If the software is installed in a folder path containing spaces (like C:\Program Files\Iperius Remote), an attacker with local access to the system can place a malicious executable in that path. When the service starts or the system reboots, Windows will execute the attacker's malicious file with SYSTEM-level privileges instead of the legitimate Iperius service, giving the attacker complete control over the machine.
CVE-2016-20090HIGH 7.8
Comodo Dragon Browser versions up to 52.15.25.663 contain a local privilege escalation flaw in the DragonUpdater service. The service runs with SYSTEM-level permissions but uses an unquoted path to launch its executable. This allows a local attacker to place a malicious program in the service path that will execute with full system privileges when the service restarts or the system reboots. An attacker would need existing local access to exploit this, but the ability to run arbitrary code as SYSTEM makes this a significant security issue.
CVE-2016-20091HIGH 7.8
Windows Firewall Control version 4.8.6.0 has a privilege escalation vulnerability caused by an unquoted service path in the wfcs.exe service executable. A local user on an affected system can place a malicious executable in a directory along the service's path and trigger execution of that malicious file with LocalSystem (full administrative) privileges when the service restarts or the system reboots. This is a classic file-placement attack that requires local access to the system but results in complete system compromise.
CVE-2016-20092HIGH 7.8
NetDrive 2.6.12 is vulnerable to a privilege escalation attack through an unquoted service path. When the NetDrive service starts or the system reboots, an attacker with local access can place a malicious executable in the system root directory with a carefully crafted name. The Windows service loader will execute that malicious file with SYSTEM privileges instead of the legitimate NetDrive service, giving the attacker complete control over the affected system.
CVE-2016-20093HIGH 7.8
Wise Care 365 version 4.27 and Wise Disk Cleaner version 9.29 contain a local privilege escalation vulnerability caused by improper quoting of service executable paths. An attacker with local access to the system can place a malicious executable in the system root directory with a name that matches part of the unquoted service path. When the affected service starts or the system reboots, Windows will execute the attacker's malicious file with SYSTEM privileges instead of the intended legitimate executable, granting the attacker complete control over the compromised system.
CVE-2016-20094HIGH 7.8
AnyDesk 2.5.0 has a security flaw in how it registers its Windows service. The service path is not properly quoted, which means an attacker with local access to the system can place a malicious program in the system root directory. When AnyDesk starts or the system reboots, Windows will execute the attacker's malicious file instead of the legitimate AnyDesk service, giving it SYSTEM-level privileges—the highest level of access on Windows. This turns a local access vulnerability into a serious privilege escalation problem.
CVE-2016-20095HIGH 7.8
Matrix42 Remote Control Host version 3.20.0031 has a privilege escalation vulnerability affecting its FastViewerRemoteService and FastViewerRemoteProxy services. An attacker with local system access can exploit an unquoted service path to place a malicious executable in the Program Files directory. When the service starts, it will execute the attacker's code with SYSTEM-level privileges, effectively giving an adversary complete control over the affected computer.
CVE-2019-25747HIGH 7.8
Network Inventory Advisor version 5.0.26.0 contains a privilege escalation vulnerability stemming from how it installs its Windows service. The service binary path is not properly quoted, which means Windows will search for and execute the first matching file it encounters while parsing the path—a classic local privilege escalation vector. An authenticated attacker with limited user privileges can place a malicious executable in an intermediate directory along the service's search path, and when the service starts (either at boot or manual restart), their malicious code runs with full system-level privileges. This converts a local access account into full system compromise.
CVE-2020-37250HIGH 7.8
TFTP Broadband version 4.3.0.1465 contains a flaw in how it specifies the path to its service executable. When Windows launches the tftpt.exe service, it does not properly quote the full file path, creating an opportunity for local attackers to place a malicious program in the Program Files directory with a name that will be executed first. If successful, this code runs with the highest system privileges (LocalSystem), potentially giving an attacker complete control over the machine.
CVE-2020-37251HIGH 7.8
RealTimes Desktop Service version 18.1.4 has a privilege escalation vulnerability caused by an unquoted file path in its rpdsvc.exe service binary. A local attacker with standard user privileges can place a malicious executable in a directory along the unquoted service path and have it executed with system-level permissions when the service starts or the system reboots, effectively taking control of the affected machine.
CVE-2020-37252HIGH 7.8
Realtek Audio Service version 1.0.0.55 has a vulnerability in how it specifies its executable path when starting as a system service. Because the path is not properly quoted, Windows will search for and execute the first matching file it finds in parent directories or the current working directory. An attacker with local access can exploit this by placing a malicious executable in a predictable location, causing it to run with the highest system privileges (LocalSystem) when the service starts or the system reboots.
CVE-2020-37253HIGH 7.8
Winstep version 18.06.0096 contains a Windows service configuration flaw that allows local users to gain administrative control of affected systems. The vulnerability stems from an improperly quoted file path in the Winstep Xtreme Service startup configuration. An attacker with basic user access can place a malicious executable in the Program Files directory, which the service then runs with the highest Windows privilege level (LocalSystem) when it starts. This transforms a low-privilege account into a full system compromise vector.
CVE-2020-37254HIGH 7.8
Wondershare PDFelement 5.2.9 has a Windows service configuration flaw that allows local users to escalate their privileges to system-level access. An attacker with a standard user account can place a specially crafted executable file in a predictable location on the system, then trigger a service restart or reboot to execute malicious code with the highest Windows privileges (LocalSystem). This is a classic privilege escalation attack enabled by improper path handling in the WsAppService component.
CVE-2020-9695HIGH 7.8
Adobe Acrobat Reader contains a memory corruption flaw that allows attackers to execute arbitrary code on a user's system when a victim opens a specially crafted PDF file. The vulnerability affects multiple versions across Windows and macOS platforms. While the flaw is serious, it requires an attacker to socially engineer a user into opening a malicious document, making it a targeted rather than worm-like threat.
CVE-2021-47985HIGH 7.8
Brother SAPSprint version 7.60 has a privilege escalation vulnerability where the Windows service that runs this software doesn't properly quote the full path to its executable file. An attacker with standard user access to a Windows system can place a malicious program in the Program Files directory that will be executed with full system privileges when the SAPSprint service starts. This turns a limited local account into one with complete control of the machine.
CVE-2022-49036HIGH 7.8
Synology Active Backup for Business Recovery Media Creator versions prior to 2.5.0-2081 contain a flaw where untrusted OpenSSL configuration can be loaded during operation. A local user with standard privileges can exploit this to execute arbitrary code on the system. The vulnerability stems from the application trusting configuration from a location or source that should not be trusted, creating a path for privilege escalation or lateral movement within an affected environment.
CVE-2022-49042HIGH 7.8
Synology Hyper Backup Explorer contains a vulnerability that allows authenticated local users to execute arbitrary code through a flaw in how the MinGW DLL component handles untrusted libraries or code. An attacker with local access to a system running vulnerable versions can leverage this weakness to run malicious code with the privileges of the user running the application, potentially compromising data or system integrity.
CVE-2022-50971HIGH 7.8
Malwarebytes version 4.5 has a privilege escalation flaw in its service startup process. An attacker with basic local access can place a malicious program in specific system directories, and when Malwarebytes' service starts or the system reboots, that malicious code runs with the highest system privileges, giving the attacker complete control over the machine.
CVE-2023-45795HIGH 7.8
Pilz PASvisu versions before 1.14.1 contain a cross-site scripting (XSS) vulnerability in the Builder Component that allows a local attacker to inject and execute malicious JavaScript code. An attacker with local access to an affected system can exploit this flaw to gain complete control of the device without requiring prior authentication. This is particularly concerning in industrial automation environments where Pilz controllers are commonly deployed.