Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-69984 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-26 |
| CVE-2026-69985 | high | 8.8 | No | Heap-based buffer overflow in Windows Libarchive allows an unauthorized attacker to execute code over a network. | 2026-10-26 |
| CVE-2026-105723 | critical | 9.8 | No | Untrusted pointer dereference in Windows Distributed File System (DFS) allows an unauthorized attacker to elevate privileges over a network. | 2026-10-26 |
| CVE-2026-105722 | high | 7.0 | No | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-93328 | not reported | — | No | Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions... | 2026-10-26 |
| CVE-2026-94402 | medium | 6.1 | No | IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-... | 2026-10-26 |
| CVE-2026-95127 | high | 7.5 | No | An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c | 2026-10-26 |
| CVE-2026-78801 | medium | 4.3 | No | An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to obtain sensitiv... | 2026-10-26 |
| CVE-2026-77058 | not reported | — | No | boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does no... | 2026-10-26 |
| CVE-2026-77056 | not reported | — | No | boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are p... | 2026-10-26 |
| CVE-2026-77054 | not reported | — | No | boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the ful... | 2026-10-26 |
| CVE-2026-76308 | medium | 6.5 | No | In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State T... | 2026-10-26 |
| CVE-2026-76304 | medium | 4.3 | No | In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to edit Automation Brokers could downloa... | 2026-10-26 |
| CVE-2026-116544 | low | 3.7 | No | Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealme... | 2026-10-26 |
| CVE-2026-116540 | medium | 5.9 | No | netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_c... | 2026-10-26 |
| CVE-2026-116262 | medium | 5.4 | No | A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the... | 2026-10-26 |
| CVE-2026-116259 | medium | 5.3 | No | A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the... | 2026-10-26 |
| CVE-2026-116256 | high | 7.3 | No | A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function... | 2026-10-26 |
| CVE-2026-116217 | medium | 6.1 | No | RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthe... | 2026-10-26 |
| CVE-2026-116213 | medium | 4.9 | No | Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme... | 2026-10-26 |