Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-112776 | critical | 9.8 | No | Craft CMS from 5.0.0 before 5.11.0 contains an authorization bypass vulnerability that allows site-scoped GraphQL tokens to mutate other sit... | 2026-10-20 |
| CVE-2026-112771 | medium | 6.5 | No | Craft CMS 4.0.0 before 4.18.8 and 5.0.0 before 5.11.0 contains a Twig sandbox allowlist bypass because the column, contains, filterByValue,... | 2026-10-20 |
| CVE-2026-112769 | not reported | — | No | Parse Server before 8.6.98 and 9.0.0 before 9.10.3-alpha.1 does not enforce the create and addField class-level permissions of the _Session... | 2026-10-20 |
| CVE-2026-112048 | medium | 6.1 | No | libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior... | 2026-10-20 |
| CVE-2026-112014 | medium | 5.5 | No | LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypte... | 2026-10-20 |
| CVE-2026-112004 | low | 3.1 | No | Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in... | 2026-10-20 |
| CVE-2026-111999 | high | 7.5 | No | Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to... | 2026-10-20 |
| CVE-2026-111723 | high | 8.8 | No | LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts t... | 2026-10-20 |
| CVE-2026-111713 | medium | 5.4 | No | tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while... | 2026-10-20 |
| CVE-2026-109587 | high | 8.8 | No | Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged... | 2026-10-20 |
| CVE-2026-100200 | high | 7.0 | No | Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2023-4659 | critical | 9.8 | No | Cross-Site Request Forgery vulnerability, whose exploitation could allow an attacker to perform different actions on the platform as an admi... | 2026-10-20 |
| CVE-2026-100201 | high | 7.0 | No | Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-100202 | critical | 9.8 | No | Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-100203 | high | 7.0 | No | Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-100215 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally. | 2026-10-20 |
| CVE-2026-100216 | high | 7.0 | No | Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-100217 | high | 7.8 | No | Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-100218 | high | 8.1 | No | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-100220 | high | 8.8 | No | Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network. | 2026-10-20 |