Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-68832 | high | 7.8 | No | Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-68831 | medium | 5.5 | No | Files or directories accessible to external parties in Windows Defender Firewall Service allows an authorized attacker to disclose informati... | 2026-09-24 |
| CVE-2026-68830 | medium | 5.5 | No | Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized at... | 2026-09-24 |
| CVE-2026-68827 | high | 8.0 | No | Integer underflow (wrap or wraparound) in Windows GDI+ allows an authorized attacker to elevate privileges over a network. | 2026-09-24 |
| CVE-2026-63416 | low | 3.7 | No | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxySe... | 2026-09-24 |
| CVE-2026-62801 | medium | 6.5 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthorized attacker to bypa... | 2026-09-24 |
| CVE-2026-62369 | high | 8.1 | No | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 un... | 2026-09-24 |
| CVE-2026-62759 | high | 7.5 | No | Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network. | 2026-09-24 |
| CVE-2026-62706 | high | 8.8 | No | Out-of-bounds read in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | 2026-09-24 |
| CVE-2026-62694 | high | 7.0 | No | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-61852 | not reported | — | No | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.... | 2026-09-24 |
| CVE-2026-59815 | medium | 4.3 | No | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's It... | 2026-09-24 |
| CVE-2026-61749 | medium | 6.5 | No | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can... | 2026-09-24 |
| CVE-2026-61748 | medium | 4.3 | No | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/... | 2026-09-24 |
| CVE-2026-62182 | high | 8.8 | No | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.21.0 un... | 2026-09-24 |
| CVE-2026-61681 | medium | 4.1 | No | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeCon... | 2026-09-24 |
| CVE-2026-61629 | high | 7.5 | No | nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware in nginx-ignition's... | 2026-09-24 |
| CVE-2026-58271 | medium | 6.8 | No | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/app/sync... | 2026-09-24 |
| CVE-2026-58269 | high | 8.1 | No | Sync-in Server is an open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.4.0, `POST /api/auth/tok... | 2026-09-24 |
| CVE-2026-55105 | high | 7.7 | No | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, package... | 2026-09-24 |