Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-83697 | medium | 4.7 | No | Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to perform tamperi... | 2026-10-30 |
| CVE-2026-83695 | medium | 5.5 | No | Use of uninitialized resource in Windows Event Logging Service allows an authorized attacker to disclose information locally. | 2026-10-30 |
| CVE-2026-83722 | high | 7.0 | No | Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally. | 2026-10-30 |
| CVE-2026-106632 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-10-30 |
| CVE-2026-106633 | medium | 5.4 | No | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker... | 2026-10-30 |
| CVE-2026-87865 | high | 7.4 | No | When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to report a key *mismat... | 2026-10-30 |
| CVE-2026-87864 | high | 8.1 | No | Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while transmitting line-ending ex... | 2026-10-30 |
| CVE-2026-87863 | high | 8.1 | No | An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later fails to process. On... | 2026-10-30 |
| CVE-2026-87862 | high | 8.1 | No | Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent... | 2026-10-30 |
| CVE-2026-87861 | critical | 9.1 | No | When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection previously authenticated via... | 2026-10-30 |
| CVE-2026-86415 | high | 7.5 | No | libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schann... | 2026-10-30 |
| CVE-2026-86414 | critical | 9.1 | No | An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself,... | 2026-10-30 |
| CVE-2026-86413 | critical | 9.1 | No | When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its creden... | 2026-10-30 |
| CVE-2026-81726 | high | 7.0 | No | NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operati... | 2026-10-30 |
| CVE-2026-112192 | not reported | — | No | MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumpti... | 2026-10-30 |
| CVE-2026-110681 | high | 8.1 | No | Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread. A parse... | 2026-10-30 |
| CVE-2026-110680 | high | 7.5 | No | Cpanel::JSON::XS versions from 4.20 before 4.80 for Perl write out of bounds when a tied or shared hash grows during canonical encoding in e... | 2026-10-30 |
| CVE-2024-9287 | high | 7.8 | No | A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not q... | 2026-10-30 |
| CVE-2026-76418 | high | 8.6 | Listed | A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Fi... | 2026-10-30 |
| CVE-2026-104795 | high | 8.8 | No | The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. W... | 2026-10-30 |