Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96209 | high | 7.0 | No | Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96118 | high | 7.8 | No | Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96071 | high | 7.5 | No | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-88226 | medium | 4.6 | No | Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack. | 2026-10-16 |
| CVE-2026-86008 | high | 7.2 | No | Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting... | 2026-10-16 |
| CVE-2026-77829 | medium | 6.4 | No | The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all... | 2026-10-16 |
| CVE-2026-21135 | not reported | — | No | Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information. | 2026-10-16 |
| CVE-2026-21134 | not reported | — | No | Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information. | 2026-10-16 |
| CVE-2026-21133 | not reported | — | No | Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data. | 2026-10-16 |
| CVE-2026-111446 | high | 8.6 | No | Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it... | 2026-10-16 |
| CVE-2026-111388 | medium | 5.4 | No | Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication... | 2026-10-16 |
| CVE-2026-111383 | medium | 6.5 | No | Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent co... | 2026-10-16 |
| CVE-2026-21127 | not reported | — | No | Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive d... | 2026-10-16 |
| CVE-2026-21126 | not reported | — | No | Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers... | 2026-10-16 |
| CVE-2026-21123 | not reported | — | No | Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to acces... | 2026-10-16 |
| CVE-2026-21121 | not reported | — | No | Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs. | 2026-10-16 |
| CVE-2026-111351 | medium | 4.2 | No | metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-pr... | 2026-10-16 |
| CVE-2026-111331 | medium | 6.3 | No | Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins... | 2026-10-16 |
| CVE-2026-108131 | high | 7.5 | No | No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | 2026-10-16 |
| CVE-2026-105228 | not reported | — | No | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft. | 2026-10-16 |