Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-68784 | medium | 6.5 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-68781 | medium | 6.5 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-68780 | medium | 6.5 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-68779 | medium | 6.5 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-84428 | high | 7.5 | No | fastify versions before 5.12.2 implement the case-insensitive nature of HTTP header names by lowercasing names in a route's header schema be... | 2026-09-15 |
| CVE-2026-68778 | medium | 6.5 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-68777 | medium | 6.5 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-68776 | medium | 6.5 | No | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-68775 | high | 8.8 | No | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 2026-09-15 |
| CVE-2026-67648 | medium | 6.5 | No | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-86137 | medium | 6.1 | No | In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. | 2026-09-15 |
| CVE-2026-86138 | high | 7.8 | No | In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. | 2026-09-15 |
| CVE-2026-86139 | high | 7.8 | No | In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. | 2026-09-15 |
| CVE-2026-86140 | high | 7.8 | No | In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. | 2026-09-15 |
| CVE-2026-86141 | low | 3.3 | No | xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate... | 2026-09-15 |
| CVE-2026-67645 | medium | 6.5 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-86142 | high | 7.8 | No | In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. | 2026-09-15 |
| CVE-2026-67642 | high | 8.8 | No | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 2026-09-15 |
| CVE-2026-67641 | medium | 6.5 | No | Integer overflow or wraparound in SQL Server allows an authorized attacker to deny service over a network. | 2026-09-15 |
| CVE-2026-43786 | high | 7.8 | No | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26... | 2026-09-15 |