Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-67237 | critical | 9.3 | No | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorizat... | 2026-10-20 |
| CVE-2026-70411 | medium | 6.5 | No | Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the... | 2026-10-20 |
| CVE-2026-73179 | high | 8.1 | No | Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a re... | 2026-10-20 |
| CVE-2026-78384 | high | 7.5 | No | CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand... | 2026-10-20 |
| CVE-2026-79650 | medium | 6.1 | No | Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occu... | 2026-10-20 |
| CVE-2026-86463 | high | 7.5 | No | Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck t... | 2026-10-20 |
| CVE-2026-97468 | critical | 9.1 | No | Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens under a non-cryptographic 32-bit hash of th... | 2026-10-20 |
| CVE-2026-97791 | high | 7.5 | No | In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS. T... | 2026-10-20 |
| CVE-2026-102855 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108426 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108427 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108428 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108429 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108430 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108431 | high | 8.8 | No | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108432 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108433 | high | 7.8 | No | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature lo... | 2026-10-20 |
| CVE-2026-108434 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 2026-10-20 |
| CVE-2026-108435 | medium | 6.5 | No | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 2026-10-20 |
| CVE-2026-108436 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 2026-10-20 |