Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-68886 | medium | 5.5 | No | Use after free in Windows Network Connection Broker allows an authorized attacker to disclose information locally. | 2026-09-17 |
| CVE-2026-68873 | medium | 5.5 | No | Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclos... | 2026-09-17 |
| CVE-2026-43690 | medium | 4.7 | No | A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A l... | 2026-09-17 |
| CVE-2026-43719 | medium | 6.5 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS... | 2026-09-17 |
| CVE-2026-75754 | not reported | — | No | Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center a... | 2026-09-17 |
| CVE-2026-16006 | not reported | — | No | Exposure of Sensitive System Information to an Unauthorized Control Sphere in Armoury Crate driver allows a local user to obtain kernel virt... | 2026-09-17 |
| CVE-2026-16005 | not reported | — | No | Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by... | 2026-09-17 |
| CVE-2026-16004 | not reported | — | No | Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuratio... | 2026-09-17 |
| CVE-2026-16003 | not reported | — | No | Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the dri... | 2026-09-17 |
| CVE-2026-12962 | not reported | — | No | A Permissive Cross-domain Security Policy with Untrusted Domains in Armoury Crate allows a remote user to obtain a local user's NTLM hash by... | 2026-09-17 |
| CVE-2026-84512 | high | 8.8 | No | A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe... | 2026-09-17 |
| CVE-2026-83020 | critical | 10.0 | No | Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Support... | 2026-09-17 |
| CVE-2026-73464 | high | 8.8 | No | On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a ma... | 2026-09-17 |
| CVE-2026-73461 | high | 8.0 | No | On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may... | 2026-09-17 |
| CVE-2026-73454 | high | 8.1 | No | On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can... | 2026-09-17 |
| CVE-2026-73453 | critical | 10.0 | No | An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under... | 2026-09-17 |
| CVE-2026-73439 | high | 7.5 | No | On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configur... | 2026-09-17 |
| CVE-2026-73437 | critical | 9.6 | No | On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with... | 2026-09-17 |
| CVE-2026-65398 | high | 7.8 | No | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27... | 2026-09-17 |
| CVE-2026-20306 | critical | 9.1 | No | A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks... | 2026-09-17 |