Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-12749 | medium | 5.4 | No | IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed... | 2026-09-23 |
| CVE-2026-78227 | medium | 6.5 | No | NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--wit... | 2026-09-23 |
| CVE-2026-91963 | medium | 6.5 | No | FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malici... | 2026-09-23 |
| CVE-2026-69528 | high | 7.8 | No | Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally. | 2026-09-23 |
| CVE-2026-69517 | high | 7.0 | No | Use after free in Windows Wireless Networking allows an authorized attacker to elevate privileges locally. | 2026-09-23 |
| CVE-2026-69512 | high | 8.8 | No | Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network. | 2026-09-23 |
| CVE-2026-91962 | medium | 6.3 | No | FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN me... | 2026-09-23 |
| CVE-2026-69508 | high | 7.8 | No | Stack-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. | 2026-09-23 |
| CVE-2026-91961 | medium | 6.5 | No | FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBu... | 2026-09-23 |
| CVE-2026-80225 | high | 7.5 | No | In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where th... | 2026-09-23 |
| CVE-2026-81349 | high | 7.2 | No | Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker... | 2026-09-23 |
| CVE-2026-81380 | medium | 5.9 | No | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unaut... | 2026-09-23 |
| CVE-2026-81634 | high | 7.5 | No | In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow durin... | 2026-09-23 |
| CVE-2026-82717 | critical | 9.8 | No | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain... | 2026-09-23 |
| CVE-2026-82720 | medium | 5.9 | No | NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--wit... | 2026-09-23 |
| CVE-2026-83998 | high | 8.8 | No | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-09-23 |
| CVE-2026-54648 | medium | 6.5 | No | CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PER... | 2026-09-23 |
| CVE-2026-54646 | high | 7.2 | No | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablenam... | 2026-09-23 |
| CVE-2026-54643 | medium | 5.4 | No | CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the... | 2026-09-23 |
| CVE-2026-54608 | not reported | — | No | MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.ph... | 2026-09-23 |