Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114190 | medium | 5.9 | No | Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache litespeed-cache allows Retri... | 2026-10-26 |
| CVE-2026-114179 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-... | 2026-10-26 |
| CVE-2026-114178 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cach... | 2026-10-26 |
| CVE-2026-112869 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours... | 2026-10-26 |
| CVE-2026-112866 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Product Filter by WBW woo-pr... | 2026-10-26 |
| CVE-2026-112844 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-s... | 2026-10-26 |
| CVE-2026-111402 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newslet... | 2026-10-26 |
| CVE-2026-110892 | medium | 6.5 | No | Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security L... | 2026-10-26 |
| CVE-2026-83927 | high | 7.8 | No | Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges local... | 2026-10-26 |
| CVE-2026-83928 | high | 8.8 | No | Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a net... | 2026-10-26 |
| CVE-2026-83929 | high | 8.8 | No | Out-of-bounds write in Windows GDI allows an unauthorized attacker to execute code over a network. | 2026-10-26 |
| CVE-2026-83930 | high | 7.0 | No | Use after free in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-83931 | high | 7.8 | No | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. | 2026-10-26 |
| CVE-2026-83932 | high | 7.8 | No | Heap-based buffer overflow in Windows Group Policy allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-12293 | critical | 9.8 | No | Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152. | 2026-10-26 |
| CVE-2026-68820 | high | 7.0 | Listed | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-20349 | high | 8.6 | Listed | A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure F... | 2026-10-26 |
| CVE-2026-64849 | critical | 9.3 | Listed | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior... | 2026-10-26 |
| CVE-2026-19490 | critical | 9.8 | Listed | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway:... | 2026-10-26 |
| CVE-2026-71362 | critical | 9.1 | Listed | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage... | 2026-10-26 |