Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102460 | medium | 5.9 | No | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], a scope bypass vulnerability exists in Ecli... | 2026-10-20 |
| CVE-2026-102209 | high | 7.0 | No | Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-102210 | critical | 9.8 | No | Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-79611 | medium | 5.5 | No | For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when #DB in intercepted, Sin... | 2026-10-20 |
| CVE-2026-79610 | high | 8.8 | No | XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has y... | 2026-10-20 |
| CVE-2026-79609 | high | 8.8 | No | XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown (CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV... | 2026-10-20 |
| CVE-2026-68573 | critical | 9.8 | No | Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin s... | 2026-10-20 |
| CVE-2026-68572 | high | 7.5 | No | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5... | 2026-10-20 |
| CVE-2026-79608 | critical | 9.8 | No | The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-worked to better integrate with other manipulations of the same MSR. In t... | 2026-10-20 |
| CVE-2026-112377 | high | 7.4 | No | CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attacke... | 2026-10-20 |
| CVE-2026-112019 | medium | 6.1 | No | cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor... | 2026-10-20 |
| CVE-2026-110005 | high | 8.8 | No | The `periphery` agent's container-management functionality of Komodo version 2.2.0 contains an OS command injection vulnerability. An authen... | 2026-10-20 |
| CVE-2026-110249 | high | 8.6 | No | A malicious, compromised, or MITM-controlled Exchange server can return a single well-formed SOAP response containing an element with enough... | 2026-10-20 |
| CVE-2026-102702 | high | 7.5 | No | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437... | 2026-10-20 |
| CVE-2026-102700 | medium | 4.7 | No | With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered an omitted NULL point... | 2026-10-20 |
| CVE-2026-107460 | critical | 9.1 | No | Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating c... | 2026-10-20 |
| CVE-2026-102699 | high | 7.5 | No | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] 1) XSA-437... | 2026-10-20 |
| CVE-2026-102211 | high | 7.0 | No | Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-98158 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: ppp_async: drop the errored frame instead of resetting its headroom pp... | 2026-10-20 |
| CVE-2026-98157 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation... | 2026-10-20 |