Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-69809 | high | 7.5 | No | Missing release of memory after effective lifetime in Active Directory Domain Services allows an unauthorized attacker to deny service over... | 2026-09-24 |
| CVE-2026-69801 | high | 7.8 | No | Heap-based buffer overflow in Windows Audio Service allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-69799 | high | 7.8 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker t... | 2026-09-24 |
| CVE-2026-69563 | high | 7.0 | No | Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-58874 | high | 7.8 | No | In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead... | 2026-09-24 |
| CVE-2026-69553 | high | 7.5 | No | Missing authorization in Windows Hyper-V allows an authorized attacker to elevate privileges over a network. | 2026-09-24 |
| CVE-2026-69544 | high | 7.8 | No | Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-69542 | high | 7.8 | No | Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-69540 | high | 7.0 | No | Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-68844 | high | 7.8 | No | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally. | 2026-09-24 |
| CVE-2026-68877 | high | 7.8 | No | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally. | 2026-09-24 |
| CVE-2026-68896 | high | 7.8 | No | Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-58941 | high | 7.8 | No | In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local es... | 2026-09-24 |
| CVE-2026-19201 | high | 7.5 | No | An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 all... | 2026-09-24 |
| CVE-2026-69280 | high | 7.0 | No | Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-81161 | low | 3.3 | No | Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affec... | 2026-09-24 |
| CVE-2026-97226 | medium | 6.3 | No | A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/sr... | 2026-09-24 |
| CVE-2026-91133 | medium | 6.5 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unesc... | 2026-09-24 |
| CVE-2026-93425 | critical | 9.9 | No | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the use... | 2026-09-24 |
| CVE-2026-91121 | medium | 5.0 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames u... | 2026-09-24 |