Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

Vulnerabilities

Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.

Archives: September 2026 October 2026 CISA KEV / threat intelligence

CVESeverityCVSSKEVDescriptionModified (UTC)
CVE-2026-85874 high 7.8 No Use after free in Windows Message Queuing Queue Manager allows an authorized attacker to execute code locally. 2026-10-29
CVE-2026-85879 high 7.0 No Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally... 2026-10-29
CVE-2026-85884 high 7.8 No Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate pr... 2026-10-29
CVE-2026-83845 high 8.4 No Improper privilege management in Windows Internet (wininet.dll) allows an authorized attacker to perform spoofing locally. 2026-10-29
CVE-2026-83848 high 7.8 No Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. 2026-10-29
CVE-2026-83849 medium 5.5 No Out-of-bounds read in Windows Hello allows an authorized attacker to disclose information locally. 2026-10-29
CVE-2026-83850 high 7.8 No Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. 2026-10-29
CVE-2026-83851 high 8.8 No Heap-based buffer overflow in Windows Partition Management Driver allows an unauthorized attacker to elevate privileges over a network. 2026-10-29
CVE-2026-54862 medium 6.5 No Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and... 2026-10-29
CVE-2026-48195 medium 6.5 No Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows... 2026-10-29
CVE-2026-42707 medium 4.3 No Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured... 2026-10-29
CVE-2026-56056 medium 6.5 No Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-... 2026-10-29
CVE-2026-52709 medium 6.5 No Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gal... 2026-10-29
CVE-2026-48196 medium 6.5 No Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows... 2026-10-29
CVE-2026-42703 medium 6.5 No Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Leve... 2026-10-29
CVE-2026-39741 medium 5.3 No Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configur... 2026-10-29
CVE-2026-39735 medium 6.5 No Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Leve... 2026-10-29
CVE-2026-24533 medium 6.5 No Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons all... 2026-10-29
CVE-2026-22386 medium 4.3 No Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Le... 2026-10-29
CVE-2026-118094 medium 6.5 No Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allo... 2026-10-29