2026 CVE Vulnerabilities
46,943 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-45453 | MEDIUM | 5.4 | 0.5% | Jun 9, 2026 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo... |
| CVE-2026-45446 | MEDIUM | 4.8 | 0.2% | Jun 9, 2026 | Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD ... |
| CVE-2026-44821 | MEDIUM | 5.5 | 0.5% | Jun 9, 2026 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
| CVE-2026-44814 | MEDIUM | 5.5 | 0.3% | Jun 9, 2026 | Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
| CVE-2026-44805 | MEDIUM | 5.5 | 0.4% | Jun 9, 2026 | Use after free in Windows Network Controller (NC) Host Agent allows an authorized attacker to deny service locally. |
| CVE-2026-42973 | MEDIUM | 5.5 | 0.4% | Jun 9, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker t... |
| CVE-2026-42972 | MEDIUM | 5.5 | 0.5% | Jun 9, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Hyper-V allows an authorized attacker to disclose ... |
| CVE-2026-42971 | MEDIUM | 5.5 | 0.5% | Jun 9, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker t... |
| CVE-2026-42970 | MEDIUM | 5.5 | 0.4% | Jun 9, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker t... |
| CVE-2026-42969 | MEDIUM | 5.5 | 0.4% | Jun 9, 2026 | Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locall... |
| CVE-2026-42968 | MEDIUM | 5.5 | 0.4% | Jun 9, 2026 | Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally. |
| CVE-2026-42915 | MEDIUM | 5.5 | 0.4% | Jun 9, 2026 | Incorrect calculation of buffer size in Windows VMSwitch allows an authorized attacker to deny service locally. |
| CVE-2026-42914 | MEDIUM | 5.3 | 0.8% | Jun 9, 2026 | Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network. |
| CVE-2026-42907 | MEDIUM | 6.5 | 0.8% | Jun 9, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose in... |
| CVE-2026-42906 | MEDIUM | 5.5 | 0.4% | Jun 9, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose in... |
| CVE-2026-42903 | MEDIUM | 6.5 | 0.9% | Jun 9, 2026 | Null pointer dereference in Windows Kerberos allows an authorized attacker to deny service over a network. |
| CVE-2026-42771 | MEDIUM | 6.2 | 0.2% | Jun 9, 2026 | Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, s... |
| CVE-2026-42769 | MEDIUM | 5.3 | 0.3% | Jun 9, 2026 | Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Mana... |
| CVE-2026-42767 | MEDIUM | 5.9 | 0.3% | Jun 9, 2026 | Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer derefere... |
| CVE-2026-42766 | MEDIUM | 5.9 | 0.6% | Jun 9, 2026 | Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decr... |
| CVE-2026-42599 | MEDIUM | 6.1 | 0.2% | Jun 9, 2026 | Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes f... |
| CVE-2026-42573 | MEDIUM | 6.1 | 0.3% | Jun 9, 2026 | Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its ... |
| CVE-2026-3088 | MEDIUM | 6.5 | 0.4% | Jun 9, 2026 | Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted reque... |
| CVE-2026-35188 | MEDIUM | 5 | 0.2% | Jun 9, 2026 | Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_requ... |
| CVE-2026-34692 | MEDIUM | 5.4 | 0.2% | Jun 9, 2026 | Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now