Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87999 | high | 7.1 | No | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web an... | 2026-09-16 |
| CVE-2026-73022 | high | 7.0 | No | Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | 2026-09-16 |
| CVE-2026-87818 | medium | 6.5 | No | GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths a... | 2026-09-16 |
| CVE-2026-72928 | high | 7.5 | No | Use after free in Windows DNS allows an authorized attacker to execute code over a network. | 2026-09-16 |
| CVE-2026-77500 | high | 7.8 | No | Release of invalid pointer or reference in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | 2026-09-16 |
| CVE-2026-77899 | high | 7.0 | No | Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally. | 2026-09-16 |
| CVE-2026-71332 | high | 7.0 | No | Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally. | 2026-09-16 |
| CVE-2026-68842 | medium | 5.5 | No | Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to d... | 2026-09-16 |
| CVE-2026-65407 | medium | 5.5 | No | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 2... | 2026-09-16 |
| CVE-2026-65412 | medium | 6.5 | No | A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS... | 2026-09-16 |
| CVE-2026-65413 | medium | 5.5 | No | An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tah... | 2026-09-16 |
| CVE-2026-84543 | high | 7.5 | No | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8,... | 2026-09-16 |
| CVE-2026-86894 | high | 7.5 | No | A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbo... | 2026-09-16 |
| CVE-2026-84541 | medium | 5.5 | No | An input validation issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, mac... | 2026-09-16 |
| CVE-2026-90511 | medium | 6.3 | No | A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown... | 2026-09-16 |
| CVE-2026-90506 | medium | 5.0 | No | A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function o... | 2026-09-16 |
| CVE-2026-90501 | medium | 6.3 | No | A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file... | 2026-09-16 |
| CVE-2026-90496 | medium | 4.7 | No | A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_o... | 2026-09-16 |
| CVE-2026-84534 | medium | 5.5 | No | A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS G... | 2026-09-16 |
| CVE-2026-65390 | high | 8.8 | No | An integer overflow was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS... | 2026-09-16 |