2026 · High

High-severity vulnerabilities disclosed in 2026

High-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

2608 published vulnerabilities · page 27 of 27

• CVE-2026-46299HIGH 7.0

  CVE-2026-46299 is a lock-handling bug in the Linux kernel's HFS+ filesystem driver that can allow a local attacker with moderate privileges to crash the system or potentially escalate privileges. The vulnerability occurs during filesystem mount when the code acquires a lock but fails to release it properly if certain filename validation steps fail. This causes the system to detect a memory leak while a critical lock is still held, triggering a kernel warning and potential system instability.

• CVE-2026-46309HIGH 7.0

  CVE-2026-46309 is a memory access control flaw in the Linux kernel's GPU driver (xe) that can leak sensitive data. When a privileged process uses a low-coherency GPU memory mode on CPU-cached buffers, the GPU can bypass CPU caches and read stale data directly from RAM—including sensitive information from previously freed memory of other processes. The fix validates GPU memory configuration requests to prevent this dangerous combination.

• CVE-2026-47293HIGH 7.0

  A use-after-free vulnerability exists in Microsoft Office's Click-To-Run installation and update mechanism. An attacker with valid credentials on a local machine can exploit a memory management flaw to gain elevated (administrator) privileges. This is not a remote vulnerability—it requires an authorized user account and local access—but the privilege escalation risk makes it a meaningful threat in environments where credential compromise or insider activity is a concern.

• CVE-2026-47648HIGH 7.0

  CVE-2026-47648 is a privilege escalation vulnerability in Windows Storage that affects multiple versions of Windows 10, Windows 11, and Windows Server. An authorized local user can exploit an untrusted search path flaw to gain elevated privileges on a compromised system. The vulnerability requires local access and user interaction is not needed, but exploitation depends on specific system conditions. With a CVSS score of 7.0 (HIGH), this poses a meaningful risk to environments where local account compromise is plausible.

• CVE-2026-54229HIGH 7.0

  A timing vulnerability exists in the abrt-dbus D-Bus service that allows a local attacker with limited privileges to take control of crash dump files while the system is processing them. The vulnerability stems from a race condition where the ChownProblemDir method changes file ownership even though privileged event handlers are actively writing to the same directory. An attacker exploiting this can redirect, modify, or delete crash dumps before they're fully processed, potentially compromising system integrity and enabling local privilege escalation.

• CVE-2026-54230HIGH 7.0

  A vulnerability in libreport's ABRT (Automatic Bug Reporting Tool) event handler scripts allows a local attacker with limited privileges to overwrite arbitrary files on a system. The flaw occurs because event scripts use file output redirection without protective measures that would prevent following symbolic links. An attacker can replace a target file with a symlink pointing to a sensitive system file, then trigger an ABRT event. Since the event scripts run as root, they unwittingly follow the symlink and write data to the attacker's chosen location, potentially corrupting critical system files or planting malicious content.

• CVE-2026-54321HIGH 7.0

  Daytona, a platform for running AI-generated code securely, had a caching bug that allowed certain sandboxes to remain publicly accessible even after their owners switched them to private. If an organization marked a preview sandbox as private, the system's cache did not update immediately, creating a window where unauthenticated users could still access the sandbox and potentially view or interact with code and data that should have been restricted. This gap has been closed in version 0.184.0.

• CVE-2026-6090HIGH 7.0

  CVE-2026-6090 is a HIGH severity authentication bypass vulnerability in Lenovo Smart Connect for Windows that allows an authenticated local user to gain elevated system privileges and run arbitrary code. An attacker already logged into the system could exploit this to escalate their access and take full control of the machine. The vulnerability requires local access and some specific conditions to trigger, making it a meaningful risk for shared systems or environments where user accounts are provisioned broadly.