Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88172 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | 2026-10-14 |
| CVE-2026-76264 | medium | 4.3 | No | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could... | 2026-10-14 |
| CVE-2026-76265 | medium | 6.5 | No | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.7... | 2026-10-14 |
| CVE-2026-76266 | high | 7.7 | No | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account runn... | 2026-10-14 |
| CVE-2026-76267 | medium | 4.3 | No | In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject... | 2026-10-14 |
| CVE-2026-76268 | critical | 9.8 | No | In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Tra... | 2026-10-14 |
| CVE-2026-76269 | medium | 6.5 | No | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could... | 2026-10-14 |
| CVE-2026-84312 | high | 7.1 | No | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a c... | 2026-10-14 |
| CVE-2026-108932 | medium | 4.3 | No | A vulnerability was determined in Netcore NR268 1.7.121109. This impacts the function eval of the file filter_hosts_dump.cgi of the componen... | 2026-10-14 |
| CVE-2026-102596 | medium | 4.3 | No | Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled thro... | 2026-10-14 |
| CVE-2023-54412 | medium | 6.5 | No | Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows an... | 2026-10-14 |
| CVE-2023-54407 | medium | 4.9 | No | Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored i... | 2026-10-14 |
| CVE-2021-35942 | critical | 9.1 | No | The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) wh... | 2026-10-14 |
| CVE-2021-33574 | critical | 9.8 | No | The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attr... | 2026-10-14 |
| CVE-2021-32292 | critical | 9.8 | No | An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the aux... | 2026-10-14 |
| CVE-2021-22945 | critical | 9.1 | No | When sending data to an MQTT server, libcurl <= 7.73.0 and 7.78.0 could in some circumstances erroneously keep a pointer to an already freed... | 2026-10-14 |
| CVE-2026-76270 | medium | 6.5 | No | In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 m... | 2026-10-14 |
| CVE-2026-76271 | medium | 6.5 | No | In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk role... | 2026-10-14 |
| CVE-2026-76272 | medium | 4.3 | No | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could... | 2026-10-14 |
| CVE-2026-76273 | medium | 4.3 | No | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use... | 2026-10-14 |