Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102189 | high | 7.0 | No | Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-102191 | high | 7.0 | No | Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-102192 | high | 7.5 | No | Integer underflow (wrap or wraparound) in Windows Failover Cluster allows an unauthorized attacker to deny service over a network. | 2026-10-20 |
| CVE-2026-102193 | high | 7.0 | No | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-102194 | high | 7.0 | No | Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-98155 | high | 7.1 | No | In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Alth... | 2026-10-20 |
| CVE-2026-102195 | high | 7.0 | No | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-71169 | high | 7.0 | No | Dell Application Store, versions prior to 26.05.0.7, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low p... | 2026-10-20 |
| CVE-2026-64610 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache servi... | 2026-10-20 |
| CVE-2026-63619 | critical | 9.1 | No | Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. I... | 2026-10-20 |
| CVE-2026-16753 | high | 8.8 | No | Incorrect authorization in the library-query execution endpoint in Lowcoder version, up to and including 2.4.10, allows an authenticated adm... | 2026-10-20 |
| CVE-2026-113676 | medium | 4.3 | No | Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read... | 2026-10-20 |
| CVE-2026-113609 | low | 3.3 | No | Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based... | 2026-10-20 |
| CVE-2026-112785 | medium | 4.3 | No | OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate s... | 2026-10-20 |
| CVE-2026-112782 | high | 7.5 | No | Grav 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 contains a resource exhaustion vulnerability that allows anonymous visitors to bypas... | 2026-10-20 |
| CVE-2026-112777 | high | 7.2 | No | Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a blocklist bypass in the Twig create() function because its class-name checks ar... | 2026-10-20 |
| CVE-2026-112772 | high | 8.8 | No | Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape th... | 2026-10-20 |
| CVE-2026-112252 | high | 7.3 | No | A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5... | 2026-10-20 |
| CVE-2026-112247 | medium | 4.3 | No | A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System up to 3.5. This... | 2026-10-20 |
| CVE-2026-111757 | medium | 5.3 | No | Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a... | 2026-10-20 |