Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85370 | high | 7.0 | No | Use after free in WebDAV allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-84471 | not reported | — | No | The fix for CVE-2026-12996 was incomplete. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authe... | 2026-10-16 |
| CVE-2026-83889 | high | 8.8 | No | Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-83869 | critical | 9.8 | No | Integer underflow (wrap or wraparound) in DNS Server allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-83778 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Internet Messaging API allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-83776 | medium | 6.8 | No | Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker to elevate privileges with a physical attack. | 2026-10-16 |
| CVE-2026-83642 | high | 8.8 | No | Access of resource using incompatible type ('type confusion') in DNS Server allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-78633 | medium | 6.5 | No | The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute. A sub-attribute length of zero ca... | 2026-10-16 |
| CVE-2026-75120 | not reported | — | No | The OpenText™ (EnCase SAFE Agents) component utilized by OpenText™ Endpoint Investigator, OpenText™ Endpoint Forensics & Response, OpenText™... | 2026-10-16 |
| CVE-2026-70244 | medium | 6.5 | No | Out-of-bounds read in DNS Server allows an unauthorized attacker to disclose information over a network. | 2026-10-16 |
| CVE-2026-70096 | critical | 9.8 | No | Heap-based buffer overflow in Windows Rich Text Edit Control allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-59508 | medium | 5.9 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Interuse i-Bos. This issue affects i-... | 2026-10-16 |
| CVE-2026-21118 | not reported | — | No | Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage. | 2026-10-16 |
| CVE-2026-21117 | not reported | — | No | Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information. | 2026-10-16 |
| CVE-2026-19673 | high | 7.1 | No | ethernet_recv() in subsys/net/l2/ethernet/ethernet.c validates only that the first net_buf of a received frame holds a plain 14-byte struct... | 2026-10-16 |
| CVE-2026-15102 | high | 7.5 | No | ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can le... | 2026-10-16 |
| CVE-2026-21116 | not reported | — | No | Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. | 2026-10-16 |
| CVE-2026-21115 | not reported | — | No | Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. | 2026-10-16 |
| CVE-2026-19737 | medium | 5.5 | No | i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DIR_RX and I2S_DIR_TX... | 2026-10-16 |
| CVE-2026-111114 | high | 7.5 | No | The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all... | 2026-10-16 |