Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-24423 | not reported | — | Listed | SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could al... | — |
| CVE-2025-11953 | not reported | — | Listed | React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST r... | — |
| CVE-2026-21514 | not reported | — | Listed | Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker t... | — |
| CVE-2026-21519 | not reported | — | Listed | Microsoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges loca... | — |
| CVE-2026-21533 | not reported | — | Listed | Microsoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to... | — |
| CVE-2026-21510 | not reported | — | Listed | Microsoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security... | — |
| CVE-2026-21525 | not reported | — | Listed | Microsoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny ser... | — |
| CVE-2026-21513 | not reported | — | Listed | Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a secur... | — |
| CVE-2025-40536 | not reported | — | Listed | SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to cer... | — |
| CVE-2025-15556 | not reported | — | Listed | Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to i... | — |
| CVE-2024-43468 | not reported | — | Listed | Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sen... | — |
| CVE-2026-20700 | not reported | — | Listed | Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerabili... | — |
| CVE-2026-1731 | not reported | — | Listed | BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation cou... | — |
| CVE-2026-2441 | not reported | — | Listed | Google Chromium CSS contains a use-after-free vulnerability that could allow a remote attacker to potentially exploit heap corruption via a... | — |
| CVE-2008-0015 | not reported | — | Listed | Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by const... | — |
| CVE-2024-7694 | not reported | — | Listed | TeamT5 ThreatSonar Anti-Ransomware contains an unrestricted upload of file with dangerous type vulnerability. ThreatSonar Anti-Ransomware do... | — |
| CVE-2020-7796 | not reported | — | Listed | Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is en... | — |
| CVE-2026-22769 | not reported | — | Listed | Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated... | — |
| CVE-2025-68461 | not reported | — | Listed | RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document. | — |
| CVE-2025-49113 | not reported | — | Listed | RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users becaus... | — |