By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 22 of 86

• CVE-2026-46319HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's traffic control act_ct module. When a traffic control policy is initialized, the code looks up a flow table object and then attempts to increment its reference counter—but between the lookup and the increment, the object can be freed by a separate cleanup process. An attacker with local access could exploit this race condition to cause a kernel crash or execute code with elevated privileges. The vulnerability requires precise timing to trigger but is feasible in environments where multiple processes interact with traffic control policies simultaneously.

• CVE-2026-46323HIGH 7.8

  A vulnerability in the Linux kernel's Generic Receive Offload (GRO) handler can cause a use-after-free condition when processing zerocopy network packets. The kernel's packet reassembly logic failed to account for zerocopy buffers that don't hold traditional page references, allowing freed memory to be accessed when fragments are incorrectly merged. This affects local processes with network capabilities on vulnerable systems.

• CVE-2026-46324HIGH 7.8

  A race condition vulnerability exists in the Linux kernel's netfilter subsystem where network hook removal operations fail to properly synchronize with concurrent list readers. When the kernel removes netdev hooks or flow table hooks, it uses an unsafe deletion method that doesn't account for other kernel components simultaneously reading the same list. This can lead to memory corruption or privilege escalation on affected systems. The vulnerability requires local access and normal user privileges to trigger.

• CVE-2026-46327HIGH 7.8

  A timing vulnerability exists in the Linux kernel's device mapper (dm) subsystem where a race condition can occur between checking if a device is suspended and actually retrieving its active table. An unprivileged local user could potentially exploit this gap to access a device after it appears suspended, leading to data corruption or privilege escalation. The fix reorders the operations to ensure the device cannot transition to suspended state between the safety check and table access.

• CVE-2026-46330HIGH 7.8

  A vulnerability in the Linux kernel's SMC (Shared Memory Communications) protocol implementation allows a local, authenticated attacker to crash the system or potentially execute code with elevated privileges. The flaw stems from a TCP ULP (Upper Layer Protocol) feature that incorrectly modifies core kernel file system structures in ways that violate fundamental assumptions about how those structures should behave, leading to memory safety violations. The kernel maintainers have resolved this by removing the problematic feature entirely, as the design approach was fundamentally flawed and alternatives exist for achieving the same transparency goals.

• CVE-2026-46331HIGH 7.8

  CVE-2026-46331 is a memory corruption vulnerability in the Linux kernel's network packet scheduling subsystem. The flaw occurs in the pedit (packet editor) module, which allows authorized users to modify packet headers. The bug stems from incomplete copy-on-write (COW) handling—when the kernel prepares to modify packet data, it sometimes fails to properly protect the entire region that will be written to, leaving portions of memory vulnerable to corruption. An attacker with local access and appropriate capabilities could exploit this to corrupt page cache memory, potentially leading to data corruption or privilege escalation.

• CVE-2026-46432HIGH 7.8

  LMDeploy, a toolkit for deploying and serving large language models, contains a critical flaw in how it loads models from HuggingFace. The toolkit automatically enables a dangerous feature called "trust_remote_code" without user awareness or consent. This setting allows arbitrary Python code embedded in model files to execute during loading. An attacker who controls or compromises a model file on HuggingFace can inject malicious code that runs with the privileges of the LMDeploy process. Versions 0.12.3 and earlier are affected, and no public patches exist as of publication.

• CVE-2026-46461HIGH 7.8

  Dell Server Hardware Manager versions before 3.2.2 contain an access control flaw that allows a low-privileged user with local system access to escalate their privileges to a higher level. An attacker with a basic user account on the affected server could gain elevated permissions, potentially compromising the confidentiality, integrity, and availability of server operations and data.

• CVE-2026-46517HIGH 7.8

  LMDeploy, a toolkit for compressing and deploying large language models, contains a critical flaw in versions 0.12.3 and earlier. The tool automatically trusts code downloaded from Hugging Face without asking users for permission. This "trust by default" setting allows attackers to inject malicious code into the supply chain—if a model or dependency on Hugging Face is compromised, LMDeploy will execute that code automatically on any system using the toolkit. No patches are currently available.

• CVE-2026-46529HIGH 7.8

  Atril, the default document viewer for MATE desktop environments on Linux, contains a critical vulnerability that allows attackers to execute arbitrary code with a single click. When a user opens a malicious PDF file and clicks on a specially crafted link, the application can be tricked into running attacker-supplied commands. The attack is particularly dangerous because the malicious PDF can be disguised as a legitimate shared library file, making it appear harmless. Affected versions are those prior to 1.26.3 and 1.28.4. The vulnerability stems from improper handling of PDF link destinations without adequate shell-escaping, allowing an attacker to inject executable code through command-line parameters.

• CVE-2026-46606HIGH 7.8

  Glances, a popular open-source system monitoring tool, contains a critical flaw in how it handles virtual machine names when monitoring KVM/QEMU environments. An attacker with local access to create or rename virtual machines can inject shell commands into those names, causing Glances to execute arbitrary commands with the privileges of the user running it—typically root on hypervisor hosts. This issue affects all versions prior to 4.5.5.

• CVE-2026-46607HIGH 7.8

  Glances, a popular open-source system monitoring tool, has a critical flaw in how it handles version-check data. When Glances starts up, it reads a cached version file from your user's home directory using a method that blindly trusts whatever data is in that file. An attacker who gains write access to that cache location—whether through a compromised container, shared system, or other local privilege—can sneak in malicious data that executes arbitrary commands as the user running Glances. This only happens if version checking is enabled, which is the default. The issue affects all versions before 4.5.5.

• CVE-2026-46680HIGH 7.8

  containerd, the widely-used container runtime, has a flaw in how it handles numeric user identifiers in container images. When a container image specifies a user as a very large number that cannot fit in a 32-bit integer, containerd incorrectly treats it as a username string instead of rejecting it or parsing it properly. An attacker can exploit this by crafting a malicious image that maps this large numeric string to root in the /etc/passwd file, causing the container to run with root privileges even when Kubernetes policies require non-root execution. This bypasses a critical security boundary that many organizations rely on to prevent privilege escalation.

• CVE-2026-46710HIGH 7.8

  Notepad++ versions 8.9.4 through 8.9.6 contain a local privilege escalation flaw in the Windows installer. The installer runs PowerShell without specifying a full file path after changing to a custom installation directory. An attacker who can place a fake powershell.exe in a user-writable directory could trick a privileged user into running the malicious executable during installation, granting it administrator-level access. The vulnerability has been resolved in version 8.9.6.

• CVE-2026-46733HIGH 7.8

  Dell Display and Peripheral Manager (DDPM) for Windows versions before 2.3 has an access control flaw that allows a user with basic local system access to run arbitrary code. An attacker would need to already have a foothold on the machine—either through a standard user account or through physical access—but once present, they could escalate their privileges and take full control of the system. This is a post-compromise risk rather than a worm-like threat.

• CVE-2026-46735HIGH 7.8

  Dell Display and Peripheral Manager for Mac (versions before 2.3) has a command injection flaw that lets a local attacker with low-level system access run arbitrary OS commands. An attacker could exploit this to execute code with the privileges of the user running the vulnerable software, potentially compromising the affected Mac system.

• CVE-2026-46888HIGH 7.8

  A privilege escalation vulnerability exists in Oracle Siebel CRM Deployment affecting versions 17.0 through 26.5. A low-privileged user with local access to the infrastructure running Siebel CRM Deployment can exploit this flaw in the Database Upgrade component to gain full control of the system. The vulnerability requires only basic system access and no user interaction to exploit, making it a meaningful risk for organizations that haven't properly restricted local access to their Siebel infrastructure.

• CVE-2026-47292HIGH 7.8

  Visual Studio Code contains a flaw that allows an attacker with local access to run malicious code with elevated privileges. The vulnerability stems from the application loading or executing functionality from untrusted sources, which an attacker can exploit if they can trick a user into interacting with a malicious file or extension. This is a local privilege escalation risk that requires user interaction but poses a significant threat to developers and organizations relying on VS Code for secure development workflows.

• CVE-2026-47331HIGH 7.8

  Ubuntu Linux kernel version 6.8 contains a critical flaw in the AppArmor security module where protective locks are not properly acquired during linked list modifications. This oversight allows an unprivileged local user to create a race condition that results in a use-after-free memory error. While arbitrary code execution is theoretical at this stage, the vulnerability poses a serious risk to system integrity and confidentiality. An attacker with local system access could potentially escalate privileges or compromise sensitive data.

• CVE-2026-47333HIGH 7.8

  A memory safety flaw in Ubuntu Linux kernels 6.8, 6.17, and 7.0 allows unprivileged local users to read sensitive data from kernel memory. The vulnerability stems from incorrect buffer size calculation in AppArmor SAUCE patches, enabling out-of-bounds memory reads in the notification handling subsystem. An attacker can trigger this bug without administrative privileges and cause the AppArmor security policy engine to process invalid data, potentially exposing sensitive information or causing unexpected system behavior.

• CVE-2026-47747HIGH 7.8

  stable-diffusion.cpp, a C/C++ library for running inference on diffusion models like Stable Diffusion and Flux, contains a memory safety flaw in its checkpoint file parser. When processing .ckpt model files, a sign-confusion bug in the BINUNICODE opcode handler causes the parser to interpret a negative length value as an extremely large positive number, triggering an out-of-bounds memory copy that corrupts the heap. An attacker who controls a .ckpt file can exploit this to crash applications or potentially execute arbitrary code. The vulnerability affects versions prior to master-584-0a7ae07.

• CVE-2026-47749HIGH 7.8

  A flaw in stable-diffusion.cpp allows an attacker to corrupt the memory of applications that load malicious model checkpoint files (.ckpt format). The vulnerability exists in how the library parses PyTorch checkpoint files—specifically in the SHORT_BINUNICODE opcode handler. An improperly crafted .ckpt file can exploit a sign-handling bug to trigger an oversized memory copy operation, immediately corrupting the application's heap. If you use stable-diffusion.cpp to load model files from untrusted sources (like public model repositories), a crafted file could crash your application or potentially enable code execution. The risk is local and requires user interaction to load a malicious file.

• CVE-2026-47750HIGH 7.8

  stable-diffusion.cpp, a C/C++ library for running AI image generation models locally, contains a critical flaw in how it parses checkpoint (.ckpt) files. When processing a specially crafted malicious .ckpt file, the parser can fail to validate the expected structure, causing it to write beyond allocated memory boundaries. An attacker could exploit this by distributing a poisoned model file through public model-sharing platforms, tricking users or applications into loading it. Once loaded, the memory corruption could lead to a complete system compromise—data theft, unauthorized changes, or denial of service. The vulnerability requires user interaction (loading the file) but no special privileges to trigger.

• CVE-2026-47829HIGH 7.8

  A flaw in bosh-cli versions before 7.10.4 allows an attacker who controls a BOSH Director to execute arbitrary commands on an operator's workstation. When an operator uses bosh-cli to interact with a compromised Director—via commands like `bosh ssh -c` or `bosh logs -f`—the attacker can inject malicious OpenSSH options that get passed to the local SSH process, resulting in command execution on the operator's machine. This is a local attack that requires the operator to actively run bosh-cli commands against a compromised Director, but it directly compromises the operator's workstation security.

• CVE-2026-47908HIGH 7.8

  Adobe Dreamweaver Desktop versions 21.7 and earlier contain a memory safety defect that could allow attackers to execute arbitrary code on a victim's computer. The vulnerability is triggered when a user opens a specially crafted file, making it a user-interaction-dependent attack. The flaw affects Windows and macOS systems running vulnerable Dreamweaver versions.

• CVE-2026-47911HIGH 7.8

  Adobe Acrobat Reader contains a critical flaw that allows attackers to execute arbitrary code on a user's computer by tricking them into opening a specially crafted file. The vulnerability affects multiple recent versions across Windows and macOS systems. While the flaw requires user interaction—specifically opening a malicious PDF or document—the potential impact is severe, as successful exploitation grants the attacker the same privileges as the logged-in user.

• CVE-2026-47912HIGH 7.8

  Adobe Acrobat Reader contains a use-after-free memory vulnerability that allows an attacker to execute arbitrary code on a victim's computer with the privileges of the logged-in user. The attack requires the victim to open a specially crafted malicious PDF file. Versions 24.001.30365, 26.001.21651, and earlier on Windows and macOS are affected. This is a serious flaw because it bypasses the application's normal security controls and gives attackers direct code execution capability.

• CVE-2026-47913HIGH 7.8

  Adobe Acrobat Reader contains a use-after-free memory flaw that allows an attacker to execute arbitrary code if a user opens a specially crafted PDF file. The vulnerability affects Acrobat Reader version 24.001.30365, 26.001.21651 and earlier on both Windows and macOS. Because exploitation requires the victim to manually open a malicious document, this is not a wormable vulnerability, but it represents a meaningful risk in environments where users regularly receive files from untrusted sources.

• CVE-2026-47914HIGH 7.8

  Adobe Acrobat Reader contains a use-after-free memory safety bug that allows attackers to execute arbitrary code on a victim's system. The vulnerability is triggered when a user opens a specially crafted PDF file, making it a file-based attack that relies entirely on social engineering or misdirection to succeed. Versions 24.001.30365, 26.001.21651, and earlier are vulnerable. Once exploited, an attacker gains the same privileges as the logged-in user, potentially enabling data theft, malware installation, or lateral movement within a network.

• CVE-2026-47915HIGH 7.8

  Adobe Acrobat Reader contains a use-after-free memory vulnerability that allows attackers to execute arbitrary code with the privileges of the user running the application. The flaw affects Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier on Windows and macOS. An attacker must trick a user into opening a specially crafted malicious document for the vulnerability to be exploited. Once triggered, the attacker gains full control over the affected system, potentially allowing data theft, system compromise, or lateral movement within your network.

• CVE-2026-47916HIGH 7.8

  Adobe Acrobat Reader contains a use-after-free memory defect that attackers can exploit to run arbitrary code with the same privileges as the user opening the file. The vulnerability affects multiple Acrobat Reader versions and requires an attacker to trick a user into opening a specially crafted malicious PDF or document. While the technical barrier to triggering the flaw is low, successful exploitation still depends on user action—someone must be convinced to open the dangerous file.

• CVE-2026-47917HIGH 7.8

  Adobe Acrobat Reader contains a use-after-free memory defect that allows attackers to execute code with the same privileges as the user running the application. The vulnerability exists in versions 24.001.30365, 26.001.21651 and earlier on Windows and macOS systems. An attacker must trick a user into opening a specially crafted file to trigger the flaw, making this a file-based attack vector rather than a remote network vulnerability.

• CVE-2026-47918HIGH 7.8

  Adobe Acrobat Reader contains a use-after-free vulnerability that allows attackers to execute arbitrary code on affected systems. The flaw requires a victim to open a malicious PDF or similar file, at which point the attacker's code runs with the same permissions as the user. Versions 24.001.30365, 26.001.21651, and earlier on Windows and macOS are vulnerable. This is a high-severity issue that should be prioritized for patching.

• CVE-2026-47919HIGH 7.8

  Adobe Acrobat Reader contains a use-after-free flaw that allows an attacker to execute arbitrary code on a victim's computer. The attack requires the victim to open a specially crafted malicious PDF or document file. Once executed, the attacker gains the same privileges as the user running Acrobat Reader, potentially enabling data theft, system compromise, or further lateral movement.

• CVE-2026-47920HIGH 7.8

  Adobe Acrobat Reader contains a use-after-free memory vulnerability that allows an attacker to execute arbitrary code with the privileges of the user opening a malicious PDF file. The vulnerability affects Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier on both Windows and macOS. Successful exploitation requires social engineering to convince a user to open a specially crafted document, but once opened, the attacker gains full code execution in that user's security context.

• CVE-2026-47921HIGH 7.8

  Adobe Acrobat Reader versions 24.001.30365, 26.001.21651 and earlier contain a use-after-free memory vulnerability that allows attackers to execute arbitrary code with the privileges of the logged-in user. The attack requires social engineering—a victim must be tricked into opening a malicious PDF or related file. This is a practical threat because Acrobat Reader is ubiquitous in enterprise and consumer environments, and users routinely open files from untrusted sources.

• CVE-2026-47952HIGH 7.8

  Adobe Acrobat Reader contains a memory safety flaw that allows attackers to execute arbitrary code on a victim's computer when a malicious PDF or related document is opened. The vulnerability affects multiple versions across Windows and macOS platforms. While exploitation requires a user to be tricked into opening a specially crafted file, the impact is severe—an attacker could gain complete control of the user's system, steal data, or install malware. This is a classic code execution risk in a ubiquitous document viewer, making it a meaningful concern for any organization with Acrobat users.

• CVE-2026-47955HIGH 7.8

  A Use After Free flaw in Adobe Acrobat Reader allows an attacker to execute arbitrary code on a victim's computer. The vulnerability exists in specific versions of Reader (24.001.30365, 26.001.21651 and earlier) and requires the victim to open a specially crafted malicious file. Once exploited, the attacker gains the same privileges as the user running the application, potentially allowing them to steal data, install malware, or modify documents.

• CVE-2026-47959HIGH 7.8

  Adobe Acrobat Reader contains a flaw in how it processes certain file content that can cause the application to crash or allow an attacker to run arbitrary code with the same permissions as the user viewing the file. The vulnerability exists in versions 24.001.30365, 26.001.21651, and earlier across Windows and macOS. An attacker would need to trick a user into opening a specially crafted PDF or related document file to exploit this issue.

• CVE-2026-47964HIGH 7.8

  Adobe's DNG SDK (Digital Negative Software Development Kit), a widely used library for processing raw image files, contains a heap-based buffer overflow flaw in versions 1.7.1 2536 and earlier. An attacker can craft a malicious DNG image file that, when opened by a user, triggers the overflow and executes arbitrary code with the privileges of the person viewing the file. No special access or authentication is required; the only barrier is social engineering to get a victim to open the file.

• CVE-2026-47965HIGH 7.8

  Adobe Reader contains a critical flaw that allows attackers to run malicious code on a victim's computer if the user opens a specially crafted file. The vulnerability exists in versions 24.001.30365 and 26.001.21651 of Acrobat Reader and earlier releases. While the attacker cannot exploit this remotely—the victim must actively open the malicious file—successful exploitation grants the attacker the same permissions as the logged-in user, potentially enabling data theft, system compromise, or further lateral movement.

• CVE-2026-48291HIGH 7.8

  A heap-based buffer overflow vulnerability in Adobe Format Plugins version 1.1.2 and earlier allows attackers to execute arbitrary code on an affected system. The vulnerability requires a user to open a specially crafted malicious file, making it a user-interaction-dependent attack. Once exploited, an attacker gains the same privileges as the user running the application, potentially compromising sensitive data or system integrity.

• CVE-2026-48292HIGH 7.8

  Format Plugins, an Adobe product, contains a memory handling flaw that allows attackers to execute arbitrary code on affected systems. The vulnerability exists in versions 1.1.2 and earlier. An attacker must trick a user into opening a specially crafted file to trigger the vulnerability—there is no remote attack vector. Once exploited, the attacker gains the same privileges as the logged-in user, potentially leading to data theft, system compromise, or lateral movement within the network.

• CVE-2026-48293HIGH 7.8

  Adobe InDesign Desktop is vulnerable to an out-of-bounds write flaw that could allow an attacker to execute arbitrary code on a victim's computer. The vulnerability affects InDesign versions 21.3, 20.5.3 and earlier running on Windows or macOS. An attacker would need to trick a user into opening a specially crafted file—there is no indication the vulnerability can be exploited remotely or without user action. Successfully exploiting this flaw gives an attacker the same privileges as the logged-in user, potentially allowing theft of data, installation of malware, or lateral movement within a network.

• CVE-2026-48305HIGH 7.8

  Adobe Substance3D - Sampler contains a memory safety flaw that could allow an attacker to execute arbitrary code on a victim's machine. The vulnerability exists in versions 6.0.0 and earlier. An attacker would need to trick a user into opening a specially crafted malicious file—the code does not execute automatically or remotely. Once the file is opened, the attacker gains the same privileges as the user running the application, potentially allowing theft of data, installation of malware, or system compromise.

• CVE-2026-48306HIGH 7.8

  Adobe Substance 3D Sampler versions 6.0.0 and earlier contain an out-of-bounds memory write flaw that allows attackers to execute arbitrary code with the privileges of the user running the application. The attack requires a victim to open a specially crafted malicious file, making it a file-based vector that could be delivered via email, file-sharing services, or compromised websites. This is a genuine code execution risk for design and creative professionals who rely on Substance 3D tools.

• CVE-2026-48565HIGH 7.8

  Windows Narrator Braille, Microsoft's screen reader accessibility tool, contains a privilege escalation vulnerability that allows a user with local access to run code with elevated system permissions. The flaw stems from how the application searches for libraries or modules, loading them from untrusted paths—a classic 'DLL search order' weakness. An attacker who already has a login on the system can exploit this during normal use to gain administrative control without user interaction.

• CVE-2026-48574HIGH 7.8

  A heap-based buffer overflow flaw in Windows Media could allow an attacker with local access to execute arbitrary code on a vulnerable system. The vulnerability requires user interaction (such as opening a malicious media file) but does not need elevated privileges to trigger. Successful exploitation grants the attacker the same privileges as the logged-in user, potentially leading to full system compromise if that user has administrative rights.

• CVE-2026-48583HIGH 7.8

  A use-after-free vulnerability exists in the Windows Kernel that allows an attacker with local access and standard user privileges to escalate their access to system-level permissions. The flaw stems from improper memory management in kernel code, where memory is freed but then accessed again, potentially enabling arbitrary code execution at the highest privilege level.

• CVE-2026-48703HIGH 7.8

  Warp, a development environment designed to support agent-assisted coding workflows, contains a critical gap in its command execution controls. The Grep and FileGlob search tools—which appear to users as read-only operations—actually construct and run shell commands built from untrusted input provided by the agent. An attacker or compromised agent instance could exploit this to execute arbitrary commands within the user's terminal session, effectively bypassing intended security boundaries. The flaw affects Warp versions from April 2025 through May 2026 and is resolved in version 0.2026.05.06.15.42.stable_01.

• CVE-2026-48723HIGH 7.8

  BrowserStack's Cypress CLI tool contains a command injection vulnerability in how it processes configuration file paths. When users specify a cypress config file location, the tool passes that path unsafely to the operating system shell, allowing an attacker to inject arbitrary commands by crafting a malicious config file path with shell metacharacters. An attacker could exploit this to run commands with the same privileges as the user running the Cypress tests. This affects all versions before 1.36.6.

• CVE-2026-48731HIGH 7.8

  Warp, a developer environment tool, contains a command injection vulnerability in how it launches external text editors on Linux systems. When a user opens a file through Warp's editor integration features, the application expands desktop configuration templates without properly sanitizing the file path. An attacker can craft a malicious file path containing shell commands that will execute with the user's privileges when the file is opened. This affects Warp versions from February 2024 through early May 2026, and is resolved in version 0.2026.05.06.15.42.stable_01.

• CVE-2026-48778HIGH 7.8

  Notepad++ contains a vulnerability where a malicious actor with local access to a user's computer can modify a configuration file to execute arbitrary commands with the privileges of the user running Notepad++. The vulnerability exists because Notepad++ reads a command-line interpreter setting from its config.xml file without verifying that the value is legitimate, then uses that untrusted value directly when the user attempts to open a command prompt in a folder. This allows attackers to replace the legitimate command interpreter path with malicious code that runs silently when triggered. The vulnerability affects versions prior to 8.9.6.1.

• CVE-2026-48800HIGH 7.8

  Notepad++ versions before 8.9.6.1 allow arbitrary command injection through the shortcuts configuration file. An attacker who can modify the shortcuts.xml file—either directly or by tricking a user into importing a malicious configuration—can inject shell commands that execute with the user's privileges when that menu item is clicked. Because the injected command appears as a normal entry in the Run menu, this creates both an execution risk and a stealthy persistence mechanism.

• CVE-2026-49033HIGH 7.8

  A stack-based buffer overflow vulnerability allows an attacker with local access to execute arbitrary code on an affected system. The vulnerability requires user interaction—such as opening a malicious file or clicking a link—but does not require elevated privileges to trigger. Once exploited, an attacker gains the same permissions as the user running the vulnerable application, potentially allowing full system compromise.

• CVE-2026-49161HIGH 7.8

  Microsoft PC Manager contains an access control weakness that allows a logged-in attacker to circumvent a built-in security control on the local system. The flaw does not require user interaction and grants an attacker with standard user privileges the ability to read sensitive data, modify system settings, or disable protective features.

• CVE-2026-49189HIGH 7.8

  CVE-2026-49189 is a privilege escalation vulnerability in Acer Connect M6E 5G devices where a core system component (Broadcast Receiver) fails to enforce access controls. Any application installed on the device—even one with minimal permissions—can trigger administrative operations that should be restricted. This bridges the gap between a low-privilege app and high-impact actions, allowing local attackers to escalate their capabilities without user interaction.

• CVE-2026-49237HIGH 7.8

  Canonical Multipass for macOS has a privilege escalation vulnerability where auxiliary binaries remain under user control despite a previous patch attempt. An attacker with local access can replace one of these binaries with malicious code, which then executes as root when the Multipass daemon runs routine operations. This bypasses the partial fix from version 1.16.0 that only secured the main daemon binary.

• CVE-2026-49366HIGH 7.8

  JetBrains IntelliJ IDEA contains a command injection vulnerability in its filename completion feature that could allow an attacker to execute arbitrary commands on a developer's machine. The vulnerability requires local access and user interaction—specifically, a user must interact with the filename completion mechanism—but once triggered, it grants full system access with the privileges of the user running the IDE. This affects versions before 2026.1.1.

• CVE-2026-49412HIGH 7.8

  A critical flaw in the FreeBSD kernel's IPv6 multicast filter handling creates a use-after-free vulnerability. When a user configures IPv6 multicast filters, the kernel briefly releases a lock to safely copy filter settings from user memory. During this window, another thread can delete the filter structure entirely. When the kernel reacquires the lock and resumes work, it holds a pointer to memory that has already been freed—a classic use-after-free condition. An unprivileged local user can deliberately trigger this race condition to execute arbitrary code with kernel privileges.

• CVE-2026-49414HIGH 7.8

  A timing-of-checks flaw in FreeBSD's ELF image loader allows unprivileged users to disable address space layout randomization (ASLR) on setuid binaries. An attacker can call procctl(2) before execve(2) to disable ASLR, causing the kernel to compute the binary's base address without ASLR protection—even though the flag should have been cleared before that computation. This dramatically reduces the difficulty of exploiting memory corruption bugs in setuid programs that would normally rely on ASLR as a mitigation.

• CVE-2026-49416HIGH 7.8

  A flaw in FreeBSD's virtual terminal (vt) driver allows an unprivileged local user to cause a heap buffer overflow by requesting an excessively large console history size. The kernel fails to properly validate the requested size, triggering an integer overflow that causes the system to allocate less memory than needed. When the driver then initializes this undersized buffer, it writes beyond the allocated region, corrupting kernel memory. An attacker with local access to a vt device can exploit this to escalate their privileges.

• CVE-2026-50100HIGH 7.8

  Ricoh and KONICA MINOLTA printer drivers contain a privilege escalation flaw that allows an authenticated local user to gain elevated system permissions. An attacker with login access to a machine running one of these affected drivers can exploit a specially crafted driver to escalate from their current privilege level to administrator or system-level access. This is a local attack that requires prior authentication—not a remote vulnerability—but the impact of successful exploitation is severe.

• CVE-2026-50207HIGH 7.8

  A flaw in how the Acer Connect M6E 5G processes cellular commands allows local applications to bypass security controls and send unverified AT commands directly to the device's baseband modem. This creates a pathway for local attackers to extract sensitive baseband files or interfere with cellular connectivity. The vulnerability requires local access and unprivileged application-level execution, making it a risk in multi-app environments where untrusted code can run.

• CVE-2026-50209HIGH 7.8

  CVE-2026-50209 is a local privilege escalation flaw in Acer Connect M6E 5G devices that allows a low-privileged user or malware running on the device to hijack the Mobile Device Management (MDM) configuration. By exploiting broadcast event handling, an attacker can rewrite the MDM endpoint address to point to an attacker-controlled server, effectively transferring administrative control of the device away from the legitimate organization. This is particularly dangerous in corporate deployments where MDM is the primary remote management and security enforcement mechanism.

• CVE-2026-50256HIGH 7.8

  The X.Org X server and Xwayland contain a buffer overflow vulnerability caused by a mismatch in how the server and its font library handle font alias names. The server reserves a 256-byte buffer for font alias processing, but the underlying libXfont2 library allows names up to 1024 bytes. An attacker can supply a specially crafted font alias name between 257 and 1023 bytes, causing the server to overflow the undersized buffer. This can crash the display server or, if the X server runs with root privileges, potentially enable privilege escalation.

• CVE-2026-50257HIGH 7.8

  A use-after-free vulnerability exists in the X.Org X server and Xwayland that allows an attacker to crash the display server or potentially escalate privileges. The flaw occurs in the miSyncDestroyFence() function when multiple X clients interact with fence synchronization primitives. An attacker would establish a fence trigger, then have a second connection destroy it prematurely, leaving the first client's code trying to reference memory that has been freed. If the X server runs with root privileges—common in many deployments—this could lead to privilege escalation.

• CVE-2026-50258HIGH 7.8

  A flaw in the X.Org X server and Xwayland allows a local user to cause a crash or potentially gain elevated privileges by manipulating keyboard type configurations. The vulnerability stems from incomplete validation of keyboard shift level parameters, enabling a malicious application or user to exceed safe memory boundaries and overflow the server's stack. Because X servers often run with elevated privileges on Linux systems, this issue carries significant risk in shared or untrusted environments.

• CVE-2026-50259HIGH 7.8

  A stack memory overflow vulnerability exists in the X.Org X server and Xwayland that allows a local attacker with limited privileges to crash the display server or potentially gain elevated privileges. The flaw stems from improper bounds checking when processing keyboard mapping configuration, where an attacker can write beyond a fixed-size array on the stack. If the X server runs with root privileges—a common configuration in many Linux environments—this becomes a path to privilege escalation.

• CVE-2026-50260HIGH 7.8

  A use-after-free vulnerability exists in the X.Org X server and Xwayland display servers. An attacker with local access can exploit this by creating multiple synchronized counters through one client connection, then destroying them from a separate connection, causing the server to access memory that has already been freed. This can crash the display server or, if the X server runs with root privileges, potentially allow privilege escalation to system administrator level.

• CVE-2026-50261HIGH 7.8

  A use-after-free memory vulnerability exists in the X.Org X server and Xwayland, specifically in the SyncChangeCounter() function. An attacker with local access can exploit this by setting up multiple sync counters from one client connection and then destroying them from a second connection while modifying the counters. This creates a window where the server attempts to access memory that has already been freed, potentially crashing the display server or—in cases where the X server runs with root privileges—enabling privilege escalation.

• CVE-2026-50264HIGH 7.8

  A memory corruption vulnerability exists in X.Org's X server and Xwayland that allows a local user to write beyond allocated memory boundaries. An attacker can craft a specially crafted request asking for multiple back-left and one front-left DRI2 buffer attachment, causing the server to write data into memory it shouldn't access. This can crash the display server or, if that server runs with elevated privileges, enable privilege escalation. The vulnerability requires local access and user-level permissions to trigger.

• CVE-2026-50511HIGH 7.8

  Microsoft PC Manager contains a privilege escalation vulnerability where an authorized local user can exploit improper link handling to gain elevated system privileges. The flaw stems from the application's failure to safely resolve symbolic or hard links before accessing files, allowing an attacker with standard user permissions to manipulate the system through link-following attacks. This is a local-only vulnerability requiring existing access to the affected system.

• CVE-2026-50512HIGH 7.8

  Microsoft PC Manager contains a missing authentication vulnerability that allows a local user with existing system access to bypass security controls and gain elevated privileges. An attacker with an existing account on the system could exploit this flaw to gain administrative-level permissions without providing additional authentication credentials, potentially compromising the entire system.

• CVE-2026-50656HIGH 7.8

  Microsoft Defender's Malware Protection Engine contains a vulnerability that allows a local user to gain elevated privileges on a system. Tracked as 'RoguePlanet,' this flaw requires an attacker to already have local access and does not require user interaction to exploit. The vulnerability grants high-level system permissions, potentially allowing an attacker to read sensitive data, modify system files, or disable security controls.

• CVE-2026-52750HIGH 7.8

  Ghidra, the reverse-engineering toolkit maintained by the NSA, has a vulnerability in how it handles URLs embedded in program annotations on Windows systems. If a researcher opens a Ghidra project containing a malicious URL hidden in a code comment and clicks that URL, an attacker can run arbitrary commands on their machine with the same privileges as the Ghidra user. The vulnerability affects Ghidra versions before 12.1 and requires user interaction—an analyst must click the embedded link for the attack to succeed.

• CVE-2026-52752HIGH 7.8

  Ghidra, the NSA's open-source reverse-engineering framework, contains a flaw in how it handles user-installed extensions. When you install an extension (a ZIP file that adds features), the software doesn't properly check whether filenames inside that ZIP are trying to escape the extension directory using path-traversal tricks like '../'. A malicious actor can create a specially crafted extension that, when installed, writes files anywhere on your system where Ghidra has write access—potentially including executable locations that would let them run arbitrary code with the same privileges as your user account.

• CVE-2026-52755HIGH 7.8

  Ghidra, the NSA's reverse-engineering and binary analysis framework, contains a vulnerability in its theme import feature that allows an attacker to write files anywhere on a user's system, not just in the theme directory. An attacker can craft a malicious theme file—distributed as a ZIP archive—with specially crafted filenames that escape the intended directory. When a user imports this theme, files get written to unexpected locations, potentially allowing code execution or modification of critical system files like SSH keys or shell initialization scripts. This requires the user to actively import the malicious theme, but once triggered, the impact is severe.

• CVE-2026-52858HIGH 7.8

  Vim's Python omni-completion feature contains a local code execution vulnerability. When you open a hostile Python file alongside a malicious Python package and trigger code completion, Vim automatically executes that package's initialization code with your user privileges. This happens because the editor adds the buffer's working directory to Python's module search path, allowing arbitrary code to run during the import process. The vulnerability requires local access and user interaction (invoking omni-completion), but once triggered, an attacker can run commands as the editing user.

• CVE-2026-52860HIGH 7.8

  Vim's Python code-completion feature (omni-completion) has a dangerous flaw: when you open a file in Vim and trigger Python completion, the editor reconstructs Python function and class definitions from that file and executes them using Python's exec() function. An attacker can craft a malicious Vim file that contains specially crafted Python code—hidden in function default arguments, type hints, or class inheritance expressions—that will automatically execute when you simply try to get code completions. This happens without any explicit user action beyond opening the file and asking for completions, making it a surprising vector for arbitrary code execution on your system.

• CVE-2026-52884HIGH 7.8

  Notepad++ versions up to 8.9.6.1 contain a path traversal vulnerability that allows an attacker to bypass security checks and execute arbitrary programs from untrusted locations. When a user attempts to run an external command through Notepad++'s Run dialog, the application checks whether the target executable is in a trusted directory. However, this check uses a simple string-matching approach that can be circumvented by embedding path traversal sequences (like ..\..) after the trusted directory name. An attacker can craft a malicious file path that appears to pass the security check but actually resolves to an executable in an untrusted location, leading to arbitrary code execution if a user is tricked into running it. The issue is resolved in version 8.9.6.2.

• CVE-2026-52907HIGH 7.8

  A boundary condition vulnerability exists in the Linux kernel's Rockchip camera interface (rkcif) driver. The flaw involves improper array bounds checking that allows code to read from memory locations just beyond the intended array boundaries. An attacker with local access could exploit this to read sensitive kernel memory, modify kernel state, or crash the system. The issue stems from using comparison operators (> instead of >=) that fail to prevent off-by-one array access.

• CVE-2026-52908HIGH 7.8

  A vulnerability exists in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem where the re-registration of memory regions does not properly validate access level changes. When a memory region's access permissions are changed from read-only to read-write during re-registration, the underlying memory is not re-evaluated to ensure it meets the stricter pinning requirements for writable access. This can result in memory regions being used with insufficient access controls, potentially allowing privileged local users to read, modify, or crash the system.

• CVE-2026-52909HIGH 7.8

  A vulnerability in the Linux kernel's IPv6 Virtual Tunnel Interface (VTI6) allows a local user with limited privileges to move the fallback tunnel device between network namespaces when the netns_immutable flag is not set. This breaks the isolation intended by the Linux kernel's network namespace feature, potentially allowing an unprivileged user to interfere with system-wide tunnel configuration or gain unauthorized access to network traffic. Other tunnel implementations (IPv6 tunnel, SIT, IPv6 GRE, and IPv4 tunnel) already protect against this issue by setting the immutability flag correctly.

• CVE-2026-52910HIGH 7.8

  A race condition exists in the Linux kernel's UDP socket handling code when multiple threads interact with Berkeley Packet Filter (BPF) programs attached to UDP socket groups. Specifically, when one thread replaces an attached BPF program while another thread is processing incoming UDP packets, the kernel may free the old BPF program prematurely without waiting for all packet-processing operations to complete. This can cause the packet processor to read from freed memory, leading to kernel crashes or potential code execution. The issue requires local access and unprivileged user-level code to trigger.

• CVE-2026-52912HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's netfilter bridge packet queuing mechanism. When bridge packets are queued for userspace processing via NFQUEUE, the kernel can lose track of the correct network device reference. If the bridge is torn down while packets remain queued, reinjecting those packets causes the kernel to access memory that has already been freed, potentially leading to system crash or code execution with local privilege.

• CVE-2026-52919HIGH 7.8

  A flaw in the Linux kernel's batman-adv network module can cause a counter to go negative when multiple code paths attempt to shut down the packet transmission meter. When this counter drops below zero, the sender thread mistakenly believes it still has work to do and enters an infinite loop. If the network interface is removed while this zombie thread is running, the kernel accesses memory that has already been freed, potentially allowing local privilege escalation.

• CVE-2026-52923HIGH 7.8

  A memory safety bug in the Linux kernel's IPC (Inter-Process Communication) subsystem allows a local attacker with limited privileges to cause a denial of service or potentially leak sensitive information. The vulnerability exists in how the kernel allocates System V IPC identifiers during checkpoint/restore operations. When the valid ID space becomes full, the kernel can mistakenly allocate IDs beyond the legitimate range, creating orphaned memory references that may be accessed later through proc filesystem enumeration, leading to use-after-free conditions.

• CVE-2026-52927HIGH 7.8

  A flaw in the Linux kernel's netfilter ebtables subsystem allows unprivileged local users to read memory beyond intended boundaries. The vulnerability stems from insufficient validation of user-supplied data structures when converting 32-bit ebtables extensions to kernel-native format. An attacker with local access can craft malformed extension data with undersized match or target structures, triggering out-of-bounds memory reads that leak kernel information or potentially crash the system.

• CVE-2026-52933HIGH 7.8

  A flaw in the Linux kernel's io_uring polling mechanism causes a critical security check to be bypassed. The kernel uses a flag to signal when poll operations should take a slower, more careful processing path. However, due to a signed/unsigned integer comparison error, when that flag is set, the comparison incorrectly treats it as a negative number and skips the safety check. This allows an unprivileged local user to cause kernel memory corruption or escalate privileges by manipulating io_uring poll operations.

• CVE-2026-52935HIGH 7.8

  A memory-safety bug exists in the Linux kernel's IPsec over TCP (espintcp) implementation. When an application sends data through this encrypted tunnel, the kernel is supposed to manage one message at a time. However, under certain conditions—specifically when a blocking application calls the send function while a previous transmission is still in progress—the kernel incorrectly reuses the same internal state for a new message. This can leave stale data references pointing to the wrong memory location, potentially allowing the kernel to read data from outside its intended boundaries during the send operation. An unprivileged local user with the ability to use the espintcp feature could trigger this flaw, potentially gaining access to sensitive kernel memory.

• CVE-2026-52943HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's network packet handling code. When the kernel copies packet metadata during certain fragmentation operations, it fails to properly track reference counts for zero-copy transmission buffers. This causes the kernel to prematurely free buffer structures that are still in use by active network packets, leading to memory corruption. An unprivileged local user can exploit this to gain full root-level control of the system.

• CVE-2026-52947HIGH 7.8

  A critical race condition exists in the Linux kernel's QRTR (Qualcomm Technologies IPC Router) networking module. When a port is being removed, the code decrements a socket's reference counter prematurely—before the port data structure is fully cleaned up and before other parts of the kernel finish their work. This creates a narrow but exploitable window where another part of the kernel can try to use the socket while its reference count has already dropped to zero, leading to memory corruption and potential arbitrary code execution. The vulnerability was discovered during automated fuzzing and has been confirmed to cause refcount saturation warnings and use-after-free conditions.

• CVE-2026-52950HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's DRM/XE DMA-buf subsystem. The flaw occurs when the kernel attempts to retry an operation after an error condition, but the underlying memory object has already been freed, causing the kernel to reference invalid memory. An attacker with local access and unprivileged user privileges could exploit this to crash the system or potentially execute arbitrary code with kernel-level permissions.

• CVE-2026-52951HIGH 7.8

  A race condition exists in the Linux kernel's Direct Rendering Manager (DRM) Xe driver when handling DMA buffer imports from other GPUs. The vulnerability occurs because the driver attaches a buffer object to a DMA buffer before fully initializing it, creating a window where external drivers (like AMD's amdgpu) can trigger callbacks that access an incomplete or freed buffer object. This can result in null pointer dereferences and use-after-free conditions, potentially crashing the system. The issue primarily affects systems importing GPU memory from AMD GPUs.

• CVE-2026-52959HIGH 7.8

  A vulnerability in the Linux kernel's SEV-SNP guest implementation allows a malicious hypervisor to trigger memory corruption by manipulating buffer size information during certificate retrieval operations. When a guest requests an extended security report, the host can send back an error with a crafted buffer size that doesn't match the actual memory allocation. The kernel then uses this attacker-controlled size to deallocate memory incorrectly, potentially corrupting the page allocator and enabling further exploitation. This is a local privilege escalation vector available to any process running with sufficient privileges on an affected guest system.

• CVE-2026-52962HIGH 7.8

  A memory management flaw in the Linux kernel's Ceph filesystem driver causes buffer objects to persist in memory without being properly released. When extended attributes are set on files, a retry mechanism can cause a buffer reference to be overwritten without freeing the old buffer first, leading to a memory leak. While the leak itself may seem benign, it occurs in kernel-controlled memory management and could enable privilege escalation or denial-of-service conditions on affected systems.

• CVE-2026-52969HIGH 7.8

  A flaw in the Linux kernel's KVM (Kernel Virtual Machine) hypervisor allows a local user with access to /dev/kvm to trigger an out-of-bounds memory access. The vulnerability exists in the dirty ring mechanism—a performance optimization that tracks which guest memory pages have been modified. An attacker can craft specially-formed entries in the shared memory region backing the dirty ring to cause an integer overflow, bypass a bounds check, and access memory outside the intended slot boundaries. On affected systems using shadow paging (legacy MMU or write-tracked memory slots), this can lead to privilege escalation or denial of service.

• CVE-2026-52971HIGH 7.8

  A race condition vulnerability exists in the Linux kernel's Elastic Network Adapter (ENA) driver's precision hardware clock (PHC) implementation. The issue occurs when the driver checks whether the PHC is active and caches a memory pointer without holding a required lock. If the PHC is destroyed at precisely the wrong moment, the pointer becomes invalid, but the code continues to use it, resulting in a use-after-free condition. An unprivileged local user with the ability to load/unload kernel modules or trigger PHC operations could potentially crash the system or execute code with kernel privileges.

• CVE-2026-52973HIGH 7.8

  A vulnerability in the Linux kernel's futex (fast userspace mutex) subsystem can allow a local attacker with user privileges to corrupt memory and crash the system. The issue arises from overly restrictive checks in how the kernel allocates shared futex hash tables when processes clone and share memory. By exploiting how the kernel tracks futex references, an attacker can trigger use-after-free conditions that lead to kernel panics or potential privilege escalation. The fix loosens the clone detection logic to properly handle all memory-sharing scenarios, not just traditional pthreads.