Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-82157 | high | 8.3 | No | Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerability. An unauthentica... | 2026-09-25 |
| CVE-2026-19072 | critical | 9.9 | No | Velociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt.... | 2026-09-25 |
| CVE-2026-94493 | critical | 10.0 | No | A vulnerability was detected in Gigatech PDV5701 1.0.31_240305_112640. This issue affects some unknown processing of the file /index.html of... | 2026-09-24 |
| CVE-2026-94540 | high | 7.7 | No | DesktopSMS 1.11.0 by MrPear contains an unauthorized access vulnerability that allows local attackers to transmit SMS, retrieve SMS-derived... | 2026-09-24 |
| CVE-2026-94532 | medium | 6.5 | No | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to... | 2026-09-24 |
| CVE-2026-94572 | not reported | — | No | In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control charact... | 2026-09-24 |
| CVE-2026-94495 | high | 7.1 | No | jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to mod... | 2026-09-24 |
| CVE-2026-94426 | low | 3.5 | No | A vulnerability was determined in xuxueli xxl-job up to 3.5.0. The impacted element is an unknown function of the file /jobgroup/insert. Thi... | 2026-09-24 |
| CVE-2026-93433 | medium | 5.5 | No | A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Sm... | 2026-09-24 |
| CVE-2026-94411 | high | 8.8 | No | jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to gra... | 2026-09-24 |
| CVE-2026-91166 | medium | 5.7 | No | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/s... | 2026-09-24 |
| CVE-2026-88978 | medium | 4.3 | No | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC... | 2026-09-24 |
| CVE-2026-85360 | high | 7.0 | No | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-84001 | high | 7.5 | No | Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny service over a network. | 2026-09-24 |
| CVE-2026-85880 | high | 7.8 | Listed | Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-84000 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally. | 2026-09-24 |
| CVE-2026-83996 | high | 8.8 | No | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-83995 | high | 7.8 | No | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-83992 | high | 8.8 | No | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | 2026-09-24 |
| CVE-2026-83989 | high | 7.5 | No | Out-of-bounds read in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to deny service over a network. | 2026-09-24 |