Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91120 | medium | 5.4 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in la... | 2026-09-24 |
| CVE-2026-91123 | high | 7.2 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not... | 2026-09-24 |
| CVE-2026-91122 | high | 8.7 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowe... | 2026-09-24 |
| CVE-2026-84302 | medium | 4.2 | No | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated wi... | 2026-09-24 |
| CVE-2026-78512 | high | 8.8 | No | Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-09-24 |
| CVE-2026-69732 | high | 8.1 | No | Heap-based buffer overflow in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over a network. | 2026-09-24 |
| CVE-2026-47132 | medium | 5.4 | No | phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in... | 2026-09-24 |
| CVE-2026-69535 | high | 7.8 | No | Numeric truncation error in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-69534 | high | 7.8 | No | Improper neutralization of special elements used in a command ('command injection') in Windows Program Compatibility Assistant Service allow... | 2026-09-24 |
| CVE-2026-69531 | medium | 5.5 | No | Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech allows an authorized attacker to perform tampering locally. | 2026-09-24 |
| CVE-2026-69300 | high | 7.0 | No | Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-69383 | high | 7.0 | No | External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-94604 | not reported | — | No | Rejected reason: This CVE is a duplicate of another CVE. | 2026-09-24 |
| CVE-2026-58820 | high | 7.8 | No | In multiple locations, there is a possible memory safety issue due to integer overflow. This could lead to local escalation of privilege wit... | 2026-09-24 |
| CVE-2026-58822 | critical | 9.8 | No | In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code executi... | 2026-09-24 |
| CVE-2026-58823 | high | 7.8 | No | In stpropnci_process_std of stpropnci_std.cc, there is a possible memory safety issue due to a missing bounds check. This could lead to loca... | 2026-09-24 |
| CVE-2026-58839 | high | 7.8 | No | In forEachLine of MountRegistry.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local escalation of... | 2026-09-24 |
| CVE-2026-58846 | high | 7.8 | No | In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check. This could lead to local escalation of... | 2026-09-24 |
| CVE-2026-58848 | high | 7.0 | No | In multiple functions of alloc.c, there is a possible unauthorized read/write access due to a race condition. This could lead to local escal... | 2026-09-24 |
| CVE-2026-93759 | high | 8.6 | No | Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-... | 2026-09-24 |