Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-69889 | high | 7.0 | No | Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. | 2026-09-16 |
| CVE-2026-64717 | medium | 6.3 | No | A race condition was addressed with improved state handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6... | 2026-09-16 |
| CVE-2026-69881 | high | 7.5 | No | Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network. | 2026-09-16 |
| CVE-2026-69874 | medium | 6.4 | No | Untrusted pointer dereference in Windows ALPC allows an authorized attacker to elevate privileges locally. | 2026-09-16 |
| CVE-2026-64714 | medium | 5.5 | No | A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, macOS Golden G... | 2026-09-16 |
| CVE-2026-69866 | high | 7.0 | No | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | 2026-09-16 |
| CVE-2026-81910 | medium | 6.5 | No | Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values... | 2026-09-16 |
| CVE-2026-69864 | high | 7.8 | No | Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. | 2026-09-16 |
| CVE-2026-69862 | medium | 5.5 | No | Out-of-bounds read in Windows Wireless Wide Area Network Service allows an authorized attacker to disclose information locally. | 2026-09-16 |
| CVE-2026-69858 | high | 8.1 | No | Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | 2026-09-16 |
| CVE-2026-90553 | high | 7.8 | No | vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trust_remote_code... | 2026-09-16 |
| CVE-2026-90555 | medium | 6.5 | No | vLLM versions before 0.28.0 fail to validate audio sample rate headers in the transcription endpoint, allowing authenticated clients to bypa... | 2026-09-16 |
| CVE-2026-64756 | medium | 5.5 | No | A path handling issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequo... | 2026-09-16 |
| CVE-2026-64761 | high | 7.5 | No | A privacy issue was addressed with improved handling of user preferences. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to... | 2026-09-16 |
| CVE-2026-64790 | high | 7.8 | No | A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 2... | 2026-09-16 |
| CVE-2026-65380 | medium | 5.5 | No | An issue existed in the handling of snapshots. The issue was resolved with improved permissions logic. This issue is fixed in macOS Golden G... | 2026-09-16 |
| CVE-2026-90876 | high | 7.3 | No | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is an unknown functiona... | 2026-09-16 |
| CVE-2026-90854 | high | 7.3 | No | A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown funct... | 2026-09-16 |
| CVE-2026-90843 | high | 8.3 | No | A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the functio... | 2026-09-16 |
| CVE-2026-90831 | medium | 5.3 | No | A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the file bfd/elf-strtab.c... | 2026-09-16 |