Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-60839 | medium | 5.5 | No | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected... | 2026-10-27 |
| CVE-2026-103555 | high | 7.0 | No | Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | 2026-10-27 |
| CVE-2026-103575 | high | 8.8 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-27 |
| CVE-2026-103576 | medium | 6.5 | No | Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perfo... | 2026-10-27 |
| CVE-2026-103577 | high | 7.5 | No | Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network. | 2026-10-27 |
| CVE-2026-105003 | high | 7.8 | No | Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally. | 2026-10-27 |
| CVE-2026-116674 | medium | 6.5 | No | systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, O... | 2026-10-27 |
| CVE-2026-109431 | high | 8.1 | No | Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resourc... | 2026-10-27 |
| CVE-2026-87694 | high | 7.8 | No | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-27 |
| CVE-2026-87695 | high | 7.8 | No | Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges lo... | 2026-10-27 |
| CVE-2026-87696 | high | 7.5 | No | Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a net... | 2026-10-27 |
| CVE-2026-87698 | medium | 5.5 | No | Out-of-bounds read in Windows Remote Access Service Infrastructure allows an authorized attacker to disclose information locally. | 2026-10-27 |
| CVE-2026-87699 | high | 7.8 | No | Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally. | 2026-10-27 |
| CVE-2026-15999 | high | 7.5 | No | Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle... | 2026-10-27 |
| CVE-2026-16000 | high | 7.5 | No | Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2... | 2026-10-27 |
| CVE-2026-16001 | high | 7.5 | No | Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngine constructed withou... | 2026-10-27 |
| CVE-2026-63566 | high | 7.5 | No | Memory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake, DtlsReassembler) in Legion of the Bounc... | 2026-10-27 |
| CVE-2026-63567 | high | 7.5 | No | Observable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has... | 2026-10-27 |
| CVE-2026-99090 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: serialize vblank counter reads against GPU reset The vblan... | 2026-10-27 |
| CVE-2026-107458 | not reported | — | No | Rejected reason: This CVE has been rejected by Upstream, as they failed to create a meaningful exploit | 2026-10-27 |