2026 · High

High-severity vulnerabilities disclosed in 2026

High-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4140 published vulnerabilities · page 42 of 42

← All 2026 Known exploited (KEV)Critical High Medium All recent

CVE-2026-8874HIGH 7.1
Securly Chrome Extension version 3.0.7 downloads security configuration files—specifically crisis alert keywords and filtering rules—over plain HTTP instead of the encrypted HTTPS protocol. While the same extension correctly uses HTTPS for other sensitive data (IWF and CIPA filtering data), this inconsistency leaves downloaded crisis alert configurations vulnerable to interception and modification by network-positioned attackers. An attacker on the same network could intercept these files and inject malicious keywords or rules, potentially disrupting the extension's security functionality or causing it to behave unexpectedly.
CVE-2026-9154HIGH 7.1
A vulnerability in Rapid7 InsightConnect's Sed Plugin allows authenticated users to write malicious files to any location on Linux systems. An attacker with valid credentials can exploit the 'expression' parameter to place arbitrary content at arbitrary file paths, potentially overwriting critical system or application files. This is a file-write vulnerability rather than code execution, but the impact depends heavily on what files an attacker targets.
CVE-2026-9570HIGH 7.1
The Taskbuilder WordPress plugin before version 5.0.8 contains a reflected cross-site scripting (XSS) vulnerability in its frontend shortcode functionality. An attacker can craft a malicious URL containing JavaScript code that, when visited by a logged-in user, executes in the context of that user's browser session. The vulnerability stems from inadequate sanitization of a URL parameter before it is output directly into inline JavaScript code on the page. This allows an attacker to hijack user sessions, steal sensitive data, or perform actions on behalf of the victim within WordPress.
CVE-2026-9808HIGH 7.1
Mautic 7's API has a flaw where user permission restrictions aren't being honored properly. Specifically, permissions designed to let users only see or edit their own resources (called 'owner-scope' restrictions) are being bypassed. An attacker with low-level API access can exploit this to view or modify other users' data, even though they shouldn't have that permission.
CVE-2024-38487HIGH 7.0
CVE-2024-38487 is a container escape vulnerability affecting api-gateway containers that run with root privileges. An attacker with local access to a system running a vulnerable api-gateway container could break out of the container and gain access to the underlying host system, potentially allowing them to modify, delete, or disable critical services and data. The vulnerability requires local access and some effort to exploit, but the consequences—full host compromise—are severe.
CVE-2026-0083HIGH 7.0
A race condition in Android's NFC (Near Field Communication) event handling code allows a local attacker with basic system access to escalate their privileges to access sensitive data or modify system files. The vulnerability requires precise timing exploitation but no special permissions or user interaction to trigger, making it a significant local security concern.
CVE-2026-0125HIGH 7.0
CVE-2026-0125 is a race condition vulnerability in Android's VPU (Video Processing Unit) driver that allows a local attacker to escalate their privileges. An attacker with a low-privilege local account can trigger a use-after-free condition in the vpu_ioctl.c file by timing requests carefully, potentially gaining higher-level access to the device without needing special permissions or user interaction. This is a serious flaw because it requires only local access and basic user privileges to exploit.
CVE-2026-34335HIGH 7.0
A use-after-free memory vulnerability exists in Windows Ancillary Function Driver for WinSock (AFD.sys), affecting Windows 10 and Windows 11 across multiple versions, as well as Windows Server 2012 through 2025. An authenticated local attacker can exploit this flaw to escalate their privileges to SYSTEM level. The vulnerability requires local access and specific conditions to trigger, but once exploited, grants complete control over the affected system.
CVE-2026-41108HIGH 7.0
A memory safety flaw in Windows DNS could allow someone with local system access to break out of normal restrictions and gain full control of the computer. The vulnerability exists because DNS processes input in a way that can overflow a memory buffer, and an attacker positioned locally—such as a low-privilege user or service—could exploit this to run code with elevated permissions. This is not a remote vulnerability, but it poses a significant risk in multi-user or shared-system environments.
CVE-2026-42462HIGH 7.0
Fedify, a TypeScript library for building federated applications using ActivityPub, contains a vulnerability that allows attackers to manipulate cryptographically signed activities without invalidating the signatures. By exploiting JSON-LD (JSON Linked Data) restructuring techniques, an attacker who receives a validly signed activity from a third party can alter its meaning and content while the Linked Data Signature remains valid. This breaks the integrity guarantee that signatures are supposed to provide, enabling attackers to forge or modify federated messages in a way that appears authentic.
CVE-2026-42836HIGH 7.0
A race condition in Windows' Function Discovery Service (fdwsd.dll) allows a user already logged into a machine to escalate their privileges to administrator level. The vulnerability exists because the service does not properly synchronize access to shared resources when multiple processes run concurrently, creating a narrow window where an attacker can manipulate the process. An authorized user would need local access and specific timing to exploit this, but successful exploitation grants full system-level permissions.
CVE-2026-42911HIGH 7.0
A use-after-free memory vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD.sys). An attacker who already has local access to a machine can exploit this flaw to gain elevated privileges, potentially running code with system-level permissions. The vulnerability requires specific conditions to trigger—it is not trivially exploitable—but once successful grants significant control over the affected system.
CVE-2026-42912HIGH 7.0
A race condition in Windows Telephony Service allows an attacker who already has local user access to exploit improper synchronization of shared resources and gain system-level privileges. The vulnerability requires the attacker to perform specific timing-dependent actions during concurrent operations—making it moderately difficult to exploit in practice, but reliably escalatable once triggered. No user interaction is required beyond the attacker's ability to run code as a local user.
CVE-2026-42984HIGH 7.0
A use-after-free memory vulnerability exists in the Windows Kernel that allows an authorized local user to escalate their privileges to a higher level of access. An attacker with standard user permissions could exploit this flaw to gain system-level control on an affected machine. The vulnerability requires local access and specific conditions to trigger, but successful exploitation would grant complete compromise of the target system.
CVE-2026-44495HIGH 7.0
Axios, a widely-used HTTP client library for JavaScript applications, contains prototype-pollution gadgets that can be exploited if another vulnerability in the same process has already poisoned JavaScript's Object.prototype. The issue affects versions 0.19.0 through 0.31.0 in the 0.x branch and version 1.15.1 in the 1.x branch. By itself, Axios does not cause the initial prototype pollution; instead, it becomes a secondary target once an attacker has already compromised Object.prototype through a separate vulnerability. When this occurs, Axios may incorrectly interpret inherited properties as legitimate request configuration, leading to potential code execution or data exposure. The vulnerability is addressed in Axios 0.31.1 and 1.15.2.
CVE-2026-44604HIGH 7.0
A flaw in RPM's archive extraction tool allows an attacker to run arbitrary commands on a system by crafting a malicious archive with shell metacharacters embedded in its folder name. When a user extracts such an archive using the rpmuncompress utility, the unsanitized folder name is passed directly into a shell command, enabling code execution with the privileges of the extracting user. The vulnerability affects ZIP, 7z, and GEM archive formats.
CVE-2026-44818HIGH 7.0
A race condition vulnerability in Microsoft Office Excel could allow an attacker to execute code on a user's computer. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker would need to trick a user into opening a malicious Excel file, but once triggered, the vulnerability can grant full control over the affected system. The vulnerability affects multiple versions of Excel and Office across 365 subscriptions, on-premises deployments, and older perpetual licenses.
CVE-2026-45596HIGH 7.0
A use-after-free vulnerability in the Windows Ancillary Function Driver for WinSock (AFD) allows an authenticated attacker to elevate their privileges on a local system. The vulnerability requires the attacker to already have user-level access and involves a race condition during memory management. Successfully exploiting it grants the attacker full system-level control.
CVE-2026-45597HIGH 7.0
A race condition vulnerability in Windows UI Automation Manager allows an authorized local user to escalate privileges on affected systems. The flaw arises from improper synchronization when multiple processes access shared resources simultaneously. An attacker with existing local access can exploit timing windows to gain system-level privileges. This is not a remote vulnerability and requires prior authentication or local access, which narrows but does not eliminate the risk in shared computing environments.
CVE-2026-45598HIGH 7.0
A race condition in Windows' Ancillary Function Driver for WinSock (AFD.sys) allows an attacker who already has local access to a system to escalate their privileges to a higher level. The vulnerability stems from improper synchronization when the driver handles shared resources, meaning that under specific timing conditions, an attacker can exploit the flaw to gain elevated permissions. This is not a remote attack—the attacker must already have a foothold on the machine, such as a low-privileged user account or compromised application context.
CVE-2026-45601HIGH 7.0
A race condition in the Windows Ancillary Function Driver for WinSock allows someone already logged into a Windows system to escalate their privileges to a higher level of access. The vulnerability arises from improper synchronization of shared resources, meaning two processes can interfere with each other when accessing the same data simultaneously. An attacker with local user privileges can exploit this timing-dependent flaw to gain elevated system rights, though doing so requires specific conditions and is not trivial to reproduce reliably.
CVE-2026-45603HIGH 7.0
A race condition vulnerability exists in Windows' Ancillary Function Driver for WinSock (AFD) that allows an authorized local user to escalate privileges to a higher level on the system. The flaw arises from improper synchronization when multiple processes access a shared resource simultaneously, creating a narrow window of opportunity for an attacker to manipulate the driver's behavior. An authenticated user with basic local access can exploit this to gain elevated privileges, potentially achieving full system compromise. This is not a remote vulnerability and requires the attacker already has some level of access to the target machine.
CVE-2026-45640HIGH 7.0
A use-after-free vulnerability in the Windows Bluetooth Port Driver permits a user with local system access to escalate their privileges to a higher level. The flaw exists because the driver fails to properly manage memory when Bluetooth port operations conclude, leaving a freed memory region accessible for malicious manipulation. An attacker must already have some level of local authentication and user rights to exploit this issue, but successful exploitation grants full system control.
CVE-2026-45653HIGH 7.0
A heap-based buffer overflow vulnerability in the Windows Kernel allows a user with local system access to overflow a memory buffer, enabling them to execute code with elevated privileges. The attack requires an authenticated user account and moderate technical effort to exploit, but if successful grants attacker control over the affected system. This is a local privilege escalation issue, not a remote attack vector.
CVE-2026-46154HIGH 7.0
A race condition exists in the Linux kernel's scheduler extension (sched_ext) cgroup interface that can lead to use-after-free memory access. When system administrators adjust cgroup scheduling parameters like weight, idle status, or bandwidth, the kernel reads a pointer to the scheduler without proper synchronization. If another process simultaneously disables and re-enables a different scheduler, the cached pointer becomes stale and points to freed memory. When the original operation tries to use this pointer, it dereferences already-freed kernel memory, potentially allowing local privilege escalation.
CVE-2026-46164HIGH 7.0
A memory management bug in the Linux kernel's Btrfs filesystem can cause the same memory region to be freed twice when a sysfs initialization step fails. This double-free condition can lead to memory corruption and potentially allow an attacker with local access to crash the system or execute code with elevated privileges. The issue occurs in error handling code that wasn't properly coordinated between two layers of the filesystem's initialization logic.
CVE-2026-46299HIGH 7.0
CVE-2026-46299 is a lock-handling bug in the Linux kernel's HFS+ filesystem driver that can allow a local attacker with moderate privileges to crash the system or potentially escalate privileges. The vulnerability occurs during filesystem mount when the code acquires a lock but fails to release it properly if certain filename validation steps fail. This causes the system to detect a memory leak while a critical lock is still held, triggering a kernel warning and potential system instability.
CVE-2026-46309HIGH 7.0
CVE-2026-46309 is a memory access control flaw in the Linux kernel's GPU driver (xe) that can leak sensitive data. When a privileged process uses a low-coherency GPU memory mode on CPU-cached buffers, the GPU can bypass CPU caches and read stale data directly from RAM—including sensitive information from previously freed memory of other processes. The fix validates GPU memory configuration requests to prevent this dangerous combination.
CVE-2026-47293HIGH 7.0
A use-after-free vulnerability exists in Microsoft Office's Click-To-Run installation and update mechanism. An attacker with valid credentials on a local machine can exploit a memory management flaw to gain elevated (administrator) privileges. This is not a remote vulnerability—it requires an authorized user account and local access—but the privilege escalation risk makes it a meaningful threat in environments where credential compromise or insider activity is a concern.
CVE-2026-47648HIGH 7.0
CVE-2026-47648 is a privilege escalation vulnerability in Windows Storage that affects multiple versions of Windows 10, Windows 11, and Windows Server. An authorized local user can exploit an untrusted search path flaw to gain elevated privileges on a compromised system. The vulnerability requires local access and user interaction is not needed, but exploitation depends on specific system conditions. With a CVSS score of 7.0 (HIGH), this poses a meaningful risk to environments where local account compromise is plausible.
CVE-2026-49417HIGH 7.0
A use-after-free vulnerability in FreeBSD's audio device handling allows unprivileged local users to read and write kernel memory. When an audio device is closed, its backing buffer may be freed while memory mappings remain valid, leaving the process able to access the freed region. Since audio device nodes are world-accessible by default, any local user with access to the system can exploit this to either escalate privileges to gain full system control or crash the kernel, causing a denial of service.
CVE-2026-53329HIGH 7.0
A memory allocation vulnerability exists in the Linux kernel's AMD display driver. When reserving space for a data structure, the code calculates the required memory size using arithmetic that can overflow, potentially allocating far less memory than needed. This creates a heap overflow condition where subsequent operations write beyond the allocated buffer, potentially allowing local attackers with unprivileged access to crash the system or execute code. The fix replaces the unsafe allocation function with a safer variant that detects and prevents overflow conditions.
CVE-2026-54229HIGH 7.0
A timing vulnerability exists in the abrt-dbus D-Bus service that allows a local attacker with limited privileges to take control of crash dump files while the system is processing them. The vulnerability stems from a race condition where the ChownProblemDir method changes file ownership even though privileged event handlers are actively writing to the same directory. An attacker exploiting this can redirect, modify, or delete crash dumps before they're fully processed, potentially compromising system integrity and enabling local privilege escalation.
CVE-2026-54230HIGH 7.0
A vulnerability in libreport's ABRT (Automatic Bug Reporting Tool) event handler scripts allows a local attacker with limited privileges to overwrite arbitrary files on a system. The flaw occurs because event scripts use file output redirection without protective measures that would prevent following symbolic links. An attacker can replace a target file with a symlink pointing to a sensitive system file, then trigger an ABRT event. Since the event scripts run as root, they unwittingly follow the symlink and write data to the attacker's chosen location, potentially corrupting critical system files or planting malicious content.
CVE-2026-54321HIGH 7.0
Daytona, a platform for running AI-generated code securely, had a caching bug that allowed certain sandboxes to remain publicly accessible even after their owners switched them to private. If an organization marked a preview sandbox as private, the system's cache did not update immediately, creating a window where unauthenticated users could still access the sandbox and potentially view or interact with code and data that should have been restricted. This gap has been closed in version 0.184.0.
CVE-2026-56254HIGH 7.0
@capgo/capacitor-updater before version 12.128.2 contains a critical flaw in how it protects app updates. The library distributes the private encryption key to every device, which means attackers can forge legitimate-looking updates. If an attacker intercepts the connection between a device and Capgo's servers—or compromises those servers—they can trick devices into installing malicious updates, even though the signatures will appear valid. This bypasses a core security mechanism that should ensure only authorized updates are installed.
CVE-2026-56297HIGH 7.0
FreeRDP versions before 3.22.0 contain a flaw that allows a malicious RDP server to crash or potentially take control of the client machine. The vulnerability involves a race condition—a timing problem where two network messages arrive in quick succession and cause the software to use memory that has already been freed. An attacker running a malicious RDP server can exploit this by sending specially timed messages to trigger the condition, resulting in either denial of service or remote code execution.
CVE-2026-58050HIGH 7.0
libssh2, a widely used SSH client library, contains a heap buffer overflow vulnerability affecting versions through 1.11.1. When a libssh2 client connects to an SSH server, the library parses responses from the public-key subsystem. An attacker operating a malicious SSH server can craft a response with a specially crafted attribute count that causes integer overflow during memory allocation on 32-bit platforms, resulting in a smaller buffer than intended. The library then writes attribute data beyond the allocated buffer boundary, corrupting heap memory and potentially enabling code execution or denial of service.
CVE-2026-59948HIGH 7.0
Composer, the widely-used PHP dependency manager, contains a vulnerability that allows attackers to place malicious files anywhere on a developer's system during package installation or updates. An attacker who controls a third-party repository can craft a package with an invalid name that bypasses validation checks, letting them write files outside the intended vendor directory. This is a local-impact vulnerability requiring user interaction (installing or updating packages), but the consequences are severe: an attacker can modify system files, inject code into projects, or disrupt operations. The issue affects all versions of Composer before 2.2.29 and 2.10.2.
CVE-2026-6090HIGH 7.0
CVE-2026-6090 is a HIGH severity authentication bypass vulnerability in Lenovo Smart Connect for Windows that allows an authenticated local user to gain elevated system privileges and run arbitrary code. An attacker already logged into the system could exploit this to escalate their access and take full control of the machine. The vulnerability requires local access and some specific conditions to trigger, making it a meaningful risk for shared systems or environments where user accounts are provisioned broadly.