Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105727 | high | 8.8 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to... | 2026-10-13 |
| CVE-2026-105726 | medium | 5.5 | No | Out-of-bounds read in Microsoft Defender allows an authorized attacker to disclose information locally. | 2026-10-13 |
| CVE-2026-103572 | high | 8.8 | No | Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an... | 2026-10-13 |
| CVE-2026-102851 | medium | 6.1 | No | Incorrect privilege assignment in Visual Studio Code allows an authorized attacker to bypass a security feature locally. | 2026-10-13 |
| CVE-2026-102232 | high | 7.0 | No | Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 2026-10-13 |
| CVE-2026-102229 | medium | 6.8 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to disclo... | 2026-10-13 |
| CVE-2026-100205 | high | 7.1 | No | Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. | 2026-10-13 |
| CVE-2026-92702 | critical | 9.1 | No | Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifyAttestationReportTLS in the AMD SEV-SNP verifier se... | 2026-10-13 |
| CVE-2026-92701 | critical | 9.1 | No | Cocos AI is a confidential computing system for AI. In Cocos AI 0.8.2 and earlier, VerifTeeAttestation in the Intel TDX aTLS verifier receiv... | 2026-10-13 |
| CVE-2026-86063 | not reported | — | No | Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a... | 2026-10-13 |
| CVE-2026-85891 | high | 7.5 | No | Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a... | 2026-10-13 |
| CVE-2026-85835 | medium | 5.5 | No | Buffer over-read in Servicing Stack Updates allows an authorized attacker to disclose information locally. | 2026-10-13 |
| CVE-2026-84320 | medium | 6.3 | No | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBa... | 2026-10-13 |
| CVE-2026-84319 | high | 8.3 | No | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx direc... | 2026-10-13 |
| CVE-2026-83844 | high | 8.1 | No | Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. | 2026-10-13 |
| CVE-2026-83746 | high | 8.1 | No | Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network. | 2026-10-13 |
| CVE-2026-70343 | high | 8.8 | No | Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an unauthorized attacker to execute code over a network. | 2026-10-13 |
| CVE-2026-70297 | high | 8.8 | No | Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network. | 2026-10-13 |
| CVE-2026-70264 | medium | 5.5 | No | Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to disclose information l... | 2026-10-13 |
| CVE-2026-70187 | high | 8.1 | No | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. | 2026-10-13 |