Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108132 | high | 7.0 | No | Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. | 2026-10-23 |
| CVE-2026-108135 | high | 7.0 | No | Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges... | 2026-10-23 |
| CVE-2026-115754 | medium | 4.7 | No | serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script... | 2026-10-23 |
| CVE-2026-16762 | not reported | — | No | An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate CPU consumption during... | 2026-10-23 |
| CVE-2026-115657 | not reported | — | No | When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before 5.8.4 log configured cre... | 2026-10-23 |
| CVE-2026-53942 | critical | 9.9 | No | Conda Organization Infrastructure is a centralized location for infrastructure codes. Prior to commit 9c0f238, a GitHub Actions Pwn Request... | 2026-10-23 |
| CVE-2026-55889 | not reported | — | No | XDG Desktop Portal is a desktop integration portal. Prior to version 1.22.1, malicious sandboxed applications can use the FileTransfer.Retri... | 2026-10-23 |
| CVE-2026-86020 | medium | 4.6 | No | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet for... | 2026-10-23 |
| CVE-2026-54615 | not reported | — | No | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the... | 2026-10-23 |
| CVE-2026-108136 | high | 7.8 | No | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-23 |
| CVE-2026-108396 | high | 7.0 | No | Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privile... | 2026-10-23 |
| CVE-2026-19754 | not reported | — | No | Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated... | 2026-10-23 |
| CVE-2026-113876 | medium | 4.3 | No | SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could... | 2026-10-23 |
| CVE-2026-113875 | low | 3.1 | No | On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be abl... | 2026-10-23 |
| CVE-2026-113874 | high | 8.1 | No | SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not... | 2026-10-23 |
| CVE-2026-113873 | high | 7.5 | No | SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that ex... | 2026-10-23 |
| CVE-2026-111633 | high | 8.6 | No | ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer token... | 2026-10-23 |
| CVE-2026-111628 | medium | 5.0 | No | 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects b... | 2026-10-23 |
| CVE-2026-111623 | medium | 5.6 | No | Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain vali... | 2026-10-23 |
| CVE-2026-111618 | medium | 5.3 | No | CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoi... | 2026-10-23 |