Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115415 | medium | 6.5 | No | Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote acto... | 2026-10-29 |
| CVE-2026-114349 | not reported | — | No | When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the decompressed stream and allocate... | 2026-10-29 |
| CVE-2026-111073 | not reported | — | No | The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against telemetry.max.bytes (de... | 2026-10-29 |
| CVE-2026-118029 | medium | 5.9 | No | Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler) before 3.16.1 might allow... | 2026-10-29 |
| CVE-2026-115942 | not reported | — | No | A misconfigured wildcard TLS certificate causes a stack read overflow. This issue does not affect any wildcard certificate issued to the RF... | 2026-10-29 |
| CVE-2026-114230 | not reported | — | No | When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows au... | 2026-10-29 |
| CVE-2026-105042 | not reported | — | No | A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. This issue affects Apache... | 2026-10-29 |
| CVE-2026-105031 | not reported | — | No | When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rath... | 2026-10-29 |
| CVE-2026-85867 | high | 7.8 | No | Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-85868 | high | 7.0 | No | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-85869 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-85870 | high | 7.0 | No | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-85871 | high | 7.8 | No | Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-85872 | high | 7.8 | No | Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-114400 | high | 7.5 | No | Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket atta... | 2026-10-29 |
| CVE-2026-79656 | medium | 6.0 | No | A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC access, refresh and... | 2026-10-29 |
| CVE-2026-110183 | medium | 4.3 | No | PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original d... | 2026-10-29 |
| CVE-2026-110182 | medium | 4.3 | No | PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal t... | 2026-10-29 |
| CVE-2026-110181 | medium | 6.5 | No | PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL ana... | 2026-10-29 |
| CVE-2026-105620 | medium | 6.5 | No | PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later... | 2026-10-29 |