Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-75351 | high | 7.5 | No | OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a... | 2026-10-16 |
| CVE-2026-107835 | medium | 4.0 | No | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1, internal/cookies.ParseCookies in inter... | 2026-10-16 |
| CVE-2026-107834 | medium | 5.3 | No | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal... | 2026-10-16 |
| CVE-2026-107833 | medium | 5.9 | No | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bo... | 2026-10-16 |
| CVE-2026-107826 | high | 7.5 | No | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, readJSON in internal/bodyproce... | 2026-10-16 |
| CVE-2026-107825 | medium | 4.0 | No | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessURI in internal/corazaw... | 2026-10-16 |
| CVE-2026-26244 | high | 8.8 | No | A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit th... | 2026-10-16 |
| CVE-2026-26245 | high | 8.8 | No | A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit th... | 2026-10-16 |
| CVE-2026-34015 | medium | 6.5 | No | A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit t... | 2026-10-16 |
| CVE-2026-44084 | high | 7.5 | No | An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability... | 2026-10-16 |
| CVE-2026-96244 | high | 7.8 | No | Use after free in Windows Internal System User Profile allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96220 | high | 7.8 | No | Improper control of generation of code ('code injection') in Windows Assigned Access allows an authorized attacker to elevate privileges loc... | 2026-10-16 |
| CVE-2026-87714 | medium | 6.5 | No | Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network. | 2026-10-16 |
| CVE-2026-96223 | high | 7.8 | No | Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-67239 | medium | 5.4 | No | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-c... | 2026-10-16 |
| CVE-2026-67241 | medium | 6.5 | No | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchang... | 2026-10-16 |
| CVE-2026-96935 | medium | 5.5 | No | Exposure of sensitive system information to an unauthorized control sphere in Windows NTFS allows an authorized attacker to disclose informa... | 2026-10-16 |
| CVE-2026-96933 | high | 7.8 | No | Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96932 | high | 7.0 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an autho... | 2026-10-16 |
| CVE-2026-96931 | high | 7.8 | No | Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally. | 2026-10-16 |