Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-70166 | medium | 6.5 | No | Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network. | 2026-10-16 |
| CVE-2026-85904 | high | 7.0 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an... | 2026-10-16 |
| CVE-2026-85901 | high | 7.8 | No | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85837 | high | 7.8 | No | Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85836 | high | 7.8 | No | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-109347 | high | 7.2 | No | Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO... | 2026-10-16 |
| CVE-2026-109350 | medium | 6.5 | No | Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sendin... | 2026-10-16 |
| CVE-2026-109349 | medium | 6.5 | No | gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts versi... | 2026-10-16 |
| CVE-2026-109348 | medium | 4.3 | No | Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time pa... | 2026-10-16 |
| CVE-2026-109345 | medium | 6.1 | No | DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode ret... | 2026-10-16 |
| CVE-2026-109344 | medium | 6.1 | No | DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detache... | 2026-10-16 |
| CVE-2026-106616 | high | 8.6 | No | ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file s... | 2026-10-16 |
| CVE-2026-106617 | high | 8.8 | No | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curre... | 2026-10-16 |
| CVE-2026-109304 | medium | 4.9 | No | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 contains an arbitrary file read vulnerability because the Twig create() class blockli... | 2026-10-16 |
| CVE-2026-109390 | critical | 9.8 | No | AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on... | 2026-10-16 |
| CVE-2026-103903 | high | 8.8 | No | An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with... | 2026-10-16 |
| CVE-2026-1907 | not reported | — | No | A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode. T... | 2026-10-16 |
| CVE-2026-109080 | medium | 6.5 | No | SQL injection in the bulk license plate search of the Flock Night Shift hosted service allowed an authenticated user to read other customer... | 2026-10-16 |
| CVE-2026-87690 | high | 8.8 | No | The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22).... | 2026-10-16 |
| CVE-2026-108982 | not reported | — | No | VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary s... | 2026-10-16 |