Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-83888 | critical | 9.8 | No | Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network. | 2026-10-21 |
| CVE-2026-83893 | medium | 5.5 | No | Exposure of sensitive system information to an unauthorized control sphere in Windows Clipboard User Service allows an authorized attacker t... | 2026-10-21 |
| CVE-2026-110936 | medium | 6.7 | Listed | A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link librar... | 2026-10-21 |
| CVE-2026-96652 | medium | 4.3 | Listed | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in... | 2026-10-21 |
| CVE-2026-96654 | medium | 6.5 | Listed | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other p... | 2026-10-21 |
| CVE-2026-83895 | medium | 6.8 | No | Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an unauthorized attacker to elevate privileges with a physical attack. | 2026-10-21 |
| CVE-2026-96655 | medium | 4.3 | Listed | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/tra... | 2026-10-21 |
| CVE-2026-96656 | high | 7.2 | Listed | Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH... | 2026-10-21 |
| CVE-2026-83896 | high | 7.8 | No | Heap-based buffer overflow in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | 2026-10-21 |
| CVE-2026-83897 | medium | 4.7 | No | Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker t... | 2026-10-21 |
| CVE-2026-83899 | high | 7.0 | No | Improper privilege management in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-21 |
| CVE-2026-83900 | high | 7.0 | No | Use after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. | 2026-10-21 |
| CVE-2026-112861 | medium | 6.3 | No | Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiti... | 2026-10-21 |
| CVE-2026-28318 | high | 7.5 | Listed | SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encod... | 2026-10-21 |
| CVE-2026-112840 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart all... | 2026-10-21 |
| CVE-2026-112829 | medium | 5.3 | No | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.T... | 2026-10-21 |
| CVE-2026-112823 | medium | 4.3 | No | Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP... | 2026-10-21 |
| CVE-2026-112834 | medium | 5.3 | No | Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configur... | 2026-10-21 |
| CVE-2026-111843 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblox rootblox allows St... | 2026-10-21 |
| CVE-2026-108496 | medium | 5.3 | No | Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Contr... | 2026-10-21 |