Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-80274 | high | 7.5 | No | If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer a... | 2026-10-26 |
| CVE-2026-77119 | medium | 5.9 | No | A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a... | 2026-10-26 |
| CVE-2026-76163 | high | 7.5 | No | If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may... | 2026-10-26 |
| CVE-2026-19666 | high | 7.5 | No | On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolve... | 2026-10-26 |
| CVE-2026-81736 | high | 7.5 | No | If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend... | 2026-10-26 |
| CVE-2026-77692 | high | 7.5 | No | An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then... | 2026-10-26 |
| CVE-2026-19941 | medium | 5.9 | No | An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the sam... | 2026-10-26 |
| CVE-2026-19662 | medium | 5.9 | No | An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for... | 2026-10-26 |
| CVE-2025-69904 | medium | 4.9 | No | Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipul... | 2026-10-26 |
| CVE-2025-67066 | critical | 9.8 | No | SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /... | 2026-10-26 |
| CVE-2026-34621 | high | 8.6 | Listed | Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Att... | 2026-10-26 |
| CVE-2026-32202 | medium | 4.3 | Listed | Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. | 2026-10-26 |
| CVE-2026-39808 | critical | 9.8 | Listed | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 th... | 2026-10-26 |
| CVE-2026-112393 | critical | 9.8 | No | Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc w... | 2026-10-26 |
| CVE-2026-112394 | high | 8.2 | No | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRa... | 2026-10-26 |
| CVE-2026-112396 | high | 7.5 | No | Pillow is a Python imaging library. From 11.3.0 until 13.0.0, Pillow has a heap use-after-free when libtiff rejects a tag while encoding TIF... | 2026-10-26 |
| CVE-2026-112392 | high | 7.5 | No | Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image... | 2026-10-26 |
| CVE-2026-85909 | medium | 5.5 | No | Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally. | 2026-10-26 |
| CVE-2026-85910 | medium | 5.5 | No | Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally. | 2026-10-26 |
| CVE-2026-85911 | high | 7.8 | No | Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally. | 2026-10-26 |