Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-23760 | not reported | — | Listed | SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The f... | — |
| CVE-2018-14634 | not reported | — | Listed | Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user wit... | — |
| CVE-2026-24858 | not reported | — | Listed | Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could... | — |
| CVE-2026-1281 | not reported | — | Listed | Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote c... | — |
| CVE-2025-40551 | not reported | — | Listed | SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would al... | — |
| CVE-2019-19006 | not reported | — | Listed | Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authenticati... | — |
| CVE-2025-64328 | not reported | — | Listed | Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection... | — |
| CVE-2021-39935 | not reported | — | Listed | GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users t... | — |
| CVE-2026-24423 | not reported | — | Listed | SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could al... | — |
| CVE-2025-11953 | not reported | — | Listed | React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST r... | — |
| CVE-2026-21514 | not reported | — | Listed | Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker t... | — |
| CVE-2026-21519 | not reported | — | Listed | Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges loca... | — |
| CVE-2026-21533 | not reported | — | Listed | Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to... | — |
| CVE-2026-21510 | not reported | — | Listed | Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security... | — |
| CVE-2026-21525 | not reported | — | Listed | Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny ser... | — |
| CVE-2026-21513 | not reported | — | Listed | Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a secur... | — |
| CVE-2025-40536 | not reported | — | Listed | SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to cer... | — |
| CVE-2025-15556 | not reported | — | Listed | Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to i... | — |
| CVE-2024-43468 | not reported | — | Listed | Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sen... | — |
| CVE-2026-20700 | not reported | — | Listed | Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerabili... | — |