Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115973 | high | 7.3 | No | A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendRese... | 2026-10-29 |
| CVE-2026-115970 | high | 7.3 | No | A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the comp... | 2026-10-29 |
| CVE-2026-116018 | medium | 4.3 | No | ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark... | 2026-10-29 |
| CVE-2026-100132 | medium | 4.3 | No | Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could lev... | 2026-10-29 |
| CVE-2026-83785 | high | 7.0 | No | Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-83786 | medium | 4.7 | No | Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally. | 2026-10-29 |
| CVE-2026-83787 | medium | 5.5 | No | Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. | 2026-10-29 |
| CVE-2026-83788 | medium | 4.6 | No | Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack. | 2026-10-29 |
| CVE-2026-78674 | high | 8.8 | No | The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can le... | 2026-10-29 |
| CVE-2026-6647 | high | 7.4 | No | In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismat... | 2026-10-29 |
| CVE-2026-3583 | low | 3.1 | No | When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the... | 2026-10-29 |
| CVE-2026-11854 | medium | 6.1 | No | The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitizatio... | 2026-10-29 |
| CVE-2025-14260 | high | 8.3 | No | Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to resource location withou... | 2026-10-29 |
| CVE-2026-5702 | not reported | — | No | Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clickin... | 2026-10-29 |
| CVE-2026-5700 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user... | 2026-10-29 |
| CVE-2026-5699 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user... | 2026-10-29 |
| CVE-2026-5698 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user... | 2026-10-29 |
| CVE-2026-5697 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user... | 2026-10-29 |
| CVE-2026-7190 | not reported | — | No | A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in t... | 2026-10-29 |
| CVE-2026-118304 | high | 8.8 | No | Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code ins... | 2026-10-29 |