Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-21137 | not reported | — | No | Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege. | 2026-10-14 |
| CVE-2026-21125 | not reported | — | No | Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to p... | 2026-10-14 |
| CVE-2026-21124 | not reported | — | No | Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers... | 2026-10-14 |
| CVE-2026-21122 | not reported | — | No | Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code. | 2026-10-14 |
| CVE-2026-21120 | not reported | — | No | Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privi... | 2026-10-14 |
| CVE-2026-21114 | not reported | — | No | Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code. | 2026-10-14 |
| CVE-2026-69922 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 2026-10-14 |
| CVE-2026-70214 | medium | 5.5 | No | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 2026-10-14 |
| CVE-2026-7876 | critical | 9.1 | No | IBM Aspera HSTS for CP4I 1.5.1 through 1.5.19 is affected by an authentication bypass vulnerability. A transfer client may be able to take a... | 2026-10-14 |
| CVE-2026-45495 | critical | 9.8 | No | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 2026-10-14 |
| CVE-2026-8757 | critical | 9.1 | No | A vulnerability was found in adenhq hive up to 0.11.0. This affects the function _read_events_tail of the file core/framework/server/routes_... | 2026-10-14 |
| CVE-2026-8751 | critical | 9.8 | No | A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/jav... | 2026-10-14 |
| CVE-2025-64721 | critical | 10.0 | No | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.6 and below, the... | 2026-10-14 |
| CVE-2026-48027 | critical | 9.8 | Listed | Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC a... | 2026-10-14 |
| CVE-2026-102867 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 2026-10-14 |
| CVE-2026-14507 | high | 7.7 | No | IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper mem... | 2026-10-14 |
| CVE-2026-14508 | critical | 9.1 | No | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could all... | 2026-10-14 |
| CVE-2026-14509 | medium | 5.9 | No | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could all... | 2026-10-14 |
| CVE-2026-102859 | medium | 4.6 | No | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized att... | 2026-10-14 |
| CVE-2026-70259 | medium | 6.5 | No | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | 2026-10-14 |