Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-69452 | high | 7.1 | No | Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a network. | 2026-10-23 |
| CVE-2026-69471 | high | 7.8 | No | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-23 |
| CVE-2026-69506 | medium | 4.7 | No | Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally. | 2026-10-23 |
| CVE-2026-69521 | high | 8.8 | No | Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network. | 2026-10-23 |
| CVE-2026-12343 | medium | 6.5 | No | IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued... | 2026-10-23 |
| CVE-2026-12350 | medium | 6.5 | No | IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that c... | 2026-10-23 |
| CVE-2026-12660 | low | 2.7 | No | IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation. | 2026-10-23 |
| CVE-2026-12665 | critical | 9.8 | No | IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malforme... | 2026-10-23 |
| CVE-2026-12669 | medium | 4.3 | No | IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data i... | 2026-10-23 |
| CVE-2026-91635 | high | 8.1 | No | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerabil... | 2026-10-23 |
| CVE-2026-91638 | critical | 9.9 | No | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerabilit... | 2026-10-23 |
| CVE-2026-91647 | high | 8.1 | No | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerabil... | 2026-10-23 |
| CVE-2026-91658 | critical | 9.9 | No | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerabilit... | 2026-10-23 |
| CVE-2026-91663 | critical | 9.9 | No | Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerabilit... | 2026-10-23 |
| CVE-2026-12670 | medium | 6.5 | No | IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory... | 2026-10-23 |
| CVE-2026-84682 | not reported | — | No | A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attack... | 2026-10-23 |
| CVE-2026-111653 | medium | 5.3 | No | 53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's pr... | 2026-10-23 |
| CVE-2026-111648 | low | 2.7 | No | BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modi... | 2026-10-23 |
| CVE-2026-109433 | medium | 6.5 | No | Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows aut... | 2026-10-23 |
| CVE-2026-111643 | critical | 9.8 | No | Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary c... | 2026-10-23 |