Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2016-20084 | high | 7.2 | No | WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to... | 2026-10-29 |
| CVE-2017-20243 | high | 8.2 | No | WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attack... | 2026-10-29 |
| CVE-2018-25308 | high | 8.8 | No | BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerability that allows authenticated users to delete arb... | 2026-10-29 |
| CVE-2017-20238 | high | 7.1 | No | Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability th... | 2026-10-29 |
| CVE-2026-69966 | high | 7.8 | No | Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-69967 | medium | 5.5 | No | Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally. | 2026-10-29 |
| CVE-2026-70198 | high | 7.0 | No | Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-83666 | high | 7.0 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS)... | 2026-10-29 |
| CVE-2026-83667 | medium | 6.5 | No | Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network. | 2026-10-29 |
| CVE-2026-83670 | high | 7.5 | No | Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network. | 2026-10-29 |
| CVE-2026-83674 | high | 8.1 | No | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | 2026-10-29 |
| CVE-2026-83688 | high | 8.8 | No | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-29 |
| CVE-2026-83693 | critical | 9.8 | No | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | 2026-10-29 |
| CVE-2026-83694 | high | 7.0 | No | Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-110073 | medium | 5.4 | No | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker... | 2026-10-29 |
| CVE-2026-110074 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-10-29 |
| CVE-2026-110075 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-10-29 |
| CVE-2026-83596 | high | 8.8 | No | A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. | 2026-10-29 |
| CVE-2026-96275 | high | 8.8 | No | A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extrac... | 2026-10-29 |
| CVE-2026-96512 | high | 7.8 | No | A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing... | 2026-10-29 |