Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-28653 | high | 7.8 | No | In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation... | 2026-09-15 |
| CVE-2026-28652 | low | 3.1 | No | In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote info... | 2026-09-15 |
| CVE-2026-28638 | low | 3.3 | No | In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lea... | 2026-09-15 |
| CVE-2026-28636 | high | 7.8 | No | In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy.... | 2026-09-15 |
| CVE-2026-28634 | high | 7.8 | No | In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error i... | 2026-09-15 |
| CVE-2026-28633 | medium | 5.5 | No | In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion.... | 2026-09-15 |
| CVE-2026-28631 | high | 7.8 | No | In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead... | 2026-09-15 |
| CVE-2026-76191 | high | 8.2 | No | Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execut... | 2026-09-15 |
| CVE-2026-81381 | high | 7.5 | No | Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a... | 2026-09-15 |
| CVE-2026-87730 | not reported | — | No | Rejected reason: this is rejected | 2026-09-15 |
| CVE-2026-71337 | high | 7.8 | No | Stack-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally. | 2026-09-15 |
| CVE-2026-71340 | high | 7.0 | No | Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally. | 2026-09-15 |
| CVE-2026-76461 | critical | 9.8 | Listed | A vulnerability in the email parsing of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacke... | 2026-09-15 |
| CVE-2026-69846 | high | 8.2 | No | Integer overflow or wraparound in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | 2026-09-15 |
| CVE-2026-69875 | high | 8.0 | No | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges over a network. | 2026-09-15 |
| CVE-2026-69906 | high | 8.2 | No | Heap-based buffer overflow in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | 2026-09-15 |
| CVE-2026-73476 | medium | 5.4 | No | Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects Extern... | 2026-09-15 |
| CVE-2026-82209 | high | 8.2 | No | When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where t... | 2026-09-15 |
| CVE-2026-82208 | high | 7.5 | No | With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silent... | 2026-09-15 |
| CVE-2026-80255 | high | 7.5 | No | A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute c... | 2026-09-15 |