Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111216 | high | 7.2 | No | Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges... | 2026-10-26 |
| CVE-2026-111124 | high | 7.1 | No | CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to... | 2026-10-26 |
| CVE-2026-110875 | medium | 6.1 | No | AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] arr... | 2026-10-26 |
| CVE-2026-110870 | medium | 5.3 | No | Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322... | 2026-10-26 |
| CVE-2026-110865 | high | 7.1 | No | Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by p... | 2026-10-26 |
| CVE-2026-110860 | medium | 6.1 | No | GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and do... | 2026-10-26 |
| CVE-2026-96867 | high | 7.8 | No | Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally. | 2026-10-26 |
| CVE-2026-105010 | critical | 9.8 | No | Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network. | 2026-10-26 |
| CVE-2026-96868 | high | 7.0 | No | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-105009 | high | 7.5 | No | Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally. | 2026-10-26 |
| CVE-2026-96910 | medium | 5.5 | No | Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally. | 2026-10-26 |
| CVE-2026-105895 | critical | 9.9 | No | Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the cont... | 2026-10-26 |
| CVE-2026-103567 | medium | 5.5 | No | Buffer over-read in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. | 2026-10-26 |
| CVE-2026-99098 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size I... | 2026-10-26 |
| CVE-2026-99097 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()... | 2026-10-26 |
| CVE-2026-99096 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: io_uring/register: don't exempt disabled rings from task restrictions... | 2026-10-26 |
| CVE-2026-99093 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: mm: don't schedule deferred kernel page table freeing while booting Bo... | 2026-10-26 |
| CVE-2026-99092 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: riscv: patch: fix handling of bpf-jit execmem addresses Commit 8718e5a... | 2026-10-26 |
| CVE-2026-96581 | not reported | — | No | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take ov... | 2026-10-26 |
| CVE-2026-98943 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-26 |