On October 26th, news broke saying that people had managed to decrypt the files that make up the game Pokémon X & Y. Since that date pictures of three Pokémon that are not yet are released have been circulating internet. It is not confirmed that these Pokémon are legendary or not, but the best bet would be that they are. A source to Kotaku showed the news source a screenshot that had a Pokedex entry for a rock/fairy Pokémon named Diancie; however, they did not allow Kotaku to release the photo.
Click to enlarge images.
We also have Mega Latias and Mega Latious (Ruby and Sapphire remake?).
During Pokémon Diamond and Pearl, I cheated my way through the game with an Action Replay DS. I had a wild Pokémon modifier code, in which you would recieve 493 Pokeballs in your bag. You would toss the Pokeballs corresponding to the Pokémon number in the Pokedex and when you encounter a wild Pokémon, you would encounter the Pokémon you chose. I remember catching Arceus and Shaymin before they were announced or available. Due to this fact, I am confident that these (new) Pokémon, except for Vivillon, are legendary.