Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102188 | medium | 6.8 | No | Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack. | 2026-10-20 |
| CVE-2026-107807 | high | 8.8 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential throug... | 2026-10-20 |
| CVE-2026-107808 | high | 8.1 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a... | 2026-10-20 |
| CVE-2026-86918 | medium | 4.3 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27,... | 2026-10-20 |
| CVE-2026-8355 | medium | 5.4 | No | IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with... | 2026-10-20 |
| CVE-2026-86913 | medium | 5.4 | No | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27,... | 2026-10-20 |
| CVE-2026-85511 | medium | 4.2 | No | A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection wo... | 2026-10-20 |
| CVE-2026-84613 | medium | 6.5 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS... | 2026-10-20 |
| CVE-2026-112779 | critical | 9.8 | No | Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the... | 2026-10-20 |
| CVE-2026-112774 | high | 7.2 | No | Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii beh... | 2026-10-20 |
| CVE-2026-111862 | critical | 9.8 | No | Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated betwe... | 2026-10-20 |
| CVE-2026-109126 | high | 8.8 | No | IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain el... | 2026-10-20 |
| CVE-2026-107809 | high | 8.8 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an... | 2026-10-20 |
| CVE-2026-107810 | high | 8.1 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before... | 2026-10-20 |
| CVE-2026-107811 | high | 8.8 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /a... | 2026-10-20 |
| CVE-2026-86962 | medium | 5.5 | No | A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, ma... | 2026-10-20 |
| CVE-2026-86957 | medium | 6.5 | No | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, ma... | 2026-10-20 |
| CVE-2026-86953 | medium | 4.6 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27,... | 2026-10-20 |
| CVE-2026-86921 | medium | 6.2 | No | A permissions issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Gol... | 2026-10-20 |
| CVE-2026-107400 | high | 8.8 | No | IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper a... | 2026-10-20 |