Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107296 | low | 3.7 | No | msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, decoding a negative signed 64-bit integer modifies the... | 2026-10-14 |
| CVE-2026-107292 | medium | 6.4 | No | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 2.30.0, the Agent.to_w... | 2026-10-14 |
| CVE-2026-107287 | medium | 6.5 | No | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, th... | 2026-10-14 |
| CVE-2026-97801 | high | 7.5 | No | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to perform tampering over a network. | 2026-10-13 |
| CVE-2026-84256 | not reported | — | No | An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to ex... | 2026-10-13 |
| CVE-2026-70279 | critical | 9.3 | No | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized att... | 2026-10-13 |
| CVE-2026-70196 | medium | 5.9 | No | Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 2026-10-13 |
| CVE-2026-70186 | high | 7.5 | No | Deadlock in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 2026-10-13 |
| CVE-2026-70181 | high | 7.5 | No | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 2026-10-13 |
| CVE-2026-69454 | high | 7.5 | No | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose... | 2026-10-13 |
| CVE-2026-69370 | high | 8.8 | No | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to... | 2026-10-13 |
| CVE-2026-108400 | high | 8.8 | No | Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. | 2026-10-13 |
| CVE-2026-108398 | high | 8.8 | No | Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. | 2026-10-13 |
| CVE-2026-105728 | high | 7.5 | No | Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network. | 2026-10-13 |
| CVE-2026-88763 | medium | 5.9 | No | A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between dist... | 2026-10-13 |
| CVE-2026-70049 | high | 8.0 | No | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized... | 2026-10-13 |
| CVE-2026-69877 | medium | 6.5 | No | Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network. | 2026-10-13 |
| CVE-2026-105732 | high | 7.3 | No | Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally. | 2026-10-13 |
| CVE-2026-105731 | medium | 5.5 | No | Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally. | 2026-10-13 |
| CVE-2026-105729 | high | 7.1 | No | Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. | 2026-10-13 |