Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-69973 | medium | 6.5 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Libarchive allows an unauthorized attacker to perf... | 2026-10-26 |
| CVE-2026-69974 | medium | 4.7 | No | Out-of-bounds read in Desktop Window Manager allows an authorized attacker to disclose information locally. | 2026-10-26 |
| CVE-2026-69976 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-26 |
| CVE-2026-69977 | high | 7.0 | No | Use after free in Quality Windows Audio/Video Experience (QWAVE) service allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-69978 | medium | 5.5 | No | Null pointer dereference in Windows VMSwitch allows an authorized attacker to deny service locally. | 2026-10-26 |
| CVE-2026-69979 | medium | 5.5 | No | Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally. | 2026-10-26 |
| CVE-2026-69982 | medium | 5.9 | No | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to bypass a security feature over a netw... | 2026-10-26 |
| CVE-2026-69984 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-26 |
| CVE-2026-69985 | high | 8.8 | No | Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network. | 2026-10-26 |
| CVE-2026-105723 | critical | 9.8 | No | Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network. | 2026-10-26 |
| CVE-2026-105722 | high | 7.0 | No | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-93328 | not reported | — | No | Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions... | 2026-10-26 |
| CVE-2026-94402 | medium | 6.1 | No | IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-... | 2026-10-26 |
| CVE-2026-95127 | high | 7.5 | No | An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c | 2026-10-26 |
| CVE-2026-78801 | medium | 4.3 | No | An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitiv... | 2026-10-26 |
| CVE-2026-77058 | not reported | — | No | boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does no... | 2026-10-26 |
| CVE-2026-77056 | not reported | — | No | boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are p... | 2026-10-26 |
| CVE-2026-77054 | not reported | — | No | boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the ful... | 2026-10-26 |
| CVE-2026-76308 | medium | 6.5 | No | In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State T... | 2026-10-26 |
| CVE-2026-76304 | medium | 4.3 | No | In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could downloa... | 2026-10-26 |