Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108437 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108438 | medium | 6.5 | No | Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 2026-10-20 |
| CVE-2026-108439 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108440 | high | 8.8 | No | Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108441 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-108442 | high | 8.8 | No | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-10-20 |
| CVE-2026-111283 | critical | 9.0 | No | BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated atta... | 2026-10-20 |
| CVE-2023-6394 | critical | 9.1 | No | A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQ... | 2026-10-20 |
| CVE-2026-83531 | high | 8.8 | No | Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statem... | 2026-10-20 |
| CVE-2026-103849 | critical | 10.0 | No | Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in ar... | 2026-10-20 |
| CVE-2026-97394 | high | 7.5 | No | kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.143.0, openapi3filter accepts OpenAPI 3.1 array schemas without... | 2026-10-20 |
| CVE-2026-88753 | high | 7.5 | No | A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through... | 2026-10-20 |
| CVE-2026-77467 | not reported | — | No | Lychee is a free, open-source photo-management tool. Prior to 7.7.0, Lychee enables ImageMagick PDF support with Ghostscript but does not ap... | 2026-10-20 |
| CVE-2026-61610 | not reported | — | No | Lychee is a free, open-source photo-management tool. Prior to 7.6.1, when photos_star_visibility is set to anonymous, POST /api/v2/Photo::hi... | 2026-10-20 |
| CVE-2026-58391 | medium | 5.4 | No | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category name... | 2026-10-20 |
| CVE-2026-58390 | high | 8.0 | No | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/o... | 2026-10-20 |
| CVE-2026-59994 | medium | 4.3 | No | EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email... | 2026-10-20 |
| CVE-2026-77427 | medium | 5.9 | No | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. From 3.9.0 until 3.22.0, pristine ma... | 2026-10-20 |
| CVE-2026-47168 | critical | 9.1 | No | EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted se... | 2026-10-20 |
| CVE-2026-57493 | medium | 6.8 | No | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.16.0, FileRise stores the... | 2026-10-20 |