Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-69997 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-19 |
| CVE-2026-69998 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-19 |
| CVE-2026-69999 | medium | 5.5 | No | Out-of-bounds read in Windows Update allows an authorized attacker to disclose information locally. | 2026-10-19 |
| CVE-2026-70004 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-19 |
| CVE-2026-70013 | high | 8.1 | No | Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | 2026-10-19 |
| CVE-2026-89067 | high | 8.8 | No | Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: bef... | 2026-10-19 |
| CVE-2026-89068 | critical | 9.8 | No | Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before... | 2026-10-19 |
| CVE-2026-89069 | medium | 5.4 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc modul... | 2026-10-19 |
| CVE-2026-89070 | high | 7.5 | No | Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before... | 2026-10-19 |
| CVE-2026-89071 | high | 8.8 | No | Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module)... | 2026-10-19 |
| CVE-2026-89072 | high | 8.8 | No | Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before... | 2026-10-19 |
| CVE-2026-84286 | critical | 9.8 | No | ExLlamaV3’s EXL3 loader uses an untrusted, model-supplied index to select a CUDA kernel without first verifying that the index is within bou... | 2026-10-19 |
| CVE-2026-109744 | high | 8.1 | No | Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153... | 2026-10-19 |
| CVE-2026-109740 | critical | 9.6 | No | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158, Firefox ESR... | 2026-10-19 |
| CVE-2026-109737 | high | 8.1 | No | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and... | 2026-10-19 |
| CVE-2026-109736 | high | 8.1 | No | Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 15... | 2026-10-19 |
| CVE-2026-109734 | high | 8.1 | No | Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thund... | 2026-10-19 |
| CVE-2026-109731 | medium | 5.4 | No | Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbi... | 2026-10-19 |
| CVE-2026-109721 | medium | 5.4 | No | Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thund... | 2026-10-19 |
| CVE-2026-109720 | high | 7.1 | No | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158... | 2026-10-19 |