Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109772 | critical | 9.1 | No | Same-origin policy bypass in the DevTools component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 2026-10-26 |
| CVE-2026-107084 | high | 8.8 | No | Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_hi... | 2026-10-26 |
| CVE-2026-105626 | high | 7.5 | No | HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to e... | 2026-10-26 |
| CVE-2026-105608 | high | 8.8 | No | HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration. This may allow a user w... | 2026-10-26 |
| CVE-2026-69850 | high | 7.8 | No | Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2014-125135 | high | 7.3 | No | A security vulnerability has been detected in OctoPrint 1.0.0/1.1.0. Affected is an unknown function of the component Flask Secret Key Handl... | 2026-10-26 |
| CVE-2026-69856 | high | 7.0 | No | Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-69884 | high | 7.8 | No | Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-108457 | high | 8.1 | No | Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. | 2026-10-26 |
| CVE-2026-108460 | high | 8.1 | No | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | 2026-10-26 |
| CVE-2026-108461 | high | 7.0 | No | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-108462 | medium | 5.5 | No | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose infor... | 2026-10-26 |
| CVE-2026-108463 | high | 8.8 | No | Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network. | 2026-10-26 |
| CVE-2026-109943 | medium | 6.5 | No | FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned Polygo... | 2026-10-26 |
| CVE-2026-108465 | high | 7.0 | No | Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-108466 | medium | 5.3 | No | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network. | 2026-10-26 |
| CVE-2026-108468 | high | 7.0 | No | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-109944 | medium | 6.5 | No | FreeRDP 3.0.0 before 3.32.0 does not remove card handles when Emulate_SCardReleaseContext releases a smartcard-emulation context, so Emulate... | 2026-10-26 |
| CVE-2026-108471 | high | 8.8 | No | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges loc... | 2026-10-26 |
| CVE-2026-49785 | high | 7.8 | No | Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally. | 2026-10-26 |