CVE-2026-26030

CriticalCVSS 9.9/10Last modified Jun 17, 2026

Description

Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users should upgrade this version or higher. As a workaround, avoid using `InMemoryVectorStore` for production scenarios.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-260315.3Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to 2.44.0, security issue was i CVE-2026-260325.4The PackagerResolver of Apache Ivy is able to download online artifacts and to (re)package them in a format defined by a packager.xml file. CVE-2026-260338.4UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Unquoted Search Path or Element (CWE-428) vulnerability, which CVE-2026-260348.5UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that allo CVE-2026-260359.8An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, For CVE-2026-26045.6A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D CVE-2026-260457.2A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during proce CVE-2026-260467.2A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow c CVE-2026-260476.5A denial-of-service vulnerability was identified in Moodle’s TeX formula editor. When rendering TeX content using mimetex, insufficient exec CVE-2026-260487.5The Wi-Fi router is vulnerable to de-authentication attacks due to the absence of management frame protection, allowing forged deauthentica CVE-2026-260495.7The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to a CVE-2026-26055.3Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.