Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2018-25308 | high | 8.8 | No | BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerability that allows authenticated users to delete arb... | 2026-10-29 |
| CVE-2017-20238 | high | 7.1 | No | Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability th... | 2026-10-29 |
| CVE-2026-69966 | high | 7.8 | No | Integer overflow or wraparound in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-69967 | medium | 5.5 | No | Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to disclose information locally. | 2026-10-29 |
| CVE-2026-70198 | high | 7.0 | No | Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-83666 | high | 7.0 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS)... | 2026-10-29 |
| CVE-2026-83667 | medium | 6.5 | No | Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network. | 2026-10-29 |
| CVE-2026-83670 | high | 7.5 | No | Out-of-bounds read in Function Discovery Service (fdwsd.dll) allows an unauthorized attacker to disclose information over a network. | 2026-10-29 |
| CVE-2026-83674 | high | 8.1 | No | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | 2026-10-29 |
| CVE-2026-83688 | high | 8.8 | No | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-29 |
| CVE-2026-83693 | critical | 9.8 | No | Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network. | 2026-10-29 |
| CVE-2026-83694 | high | 7.0 | No | Out-of-bounds read in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-110073 | medium | 5.4 | No | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker... | 2026-10-29 |
| CVE-2026-110074 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-10-29 |
| CVE-2026-110075 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-10-29 |
| CVE-2026-96512 | high | 7.8 | No | A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing... | 2026-10-29 |
| CVE-2026-72770 | medium | 6.5 | No | n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows auth... | 2026-10-29 |
| CVE-2026-72769 | high | 8.1 | No | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able... | 2026-10-29 |
| CVE-2026-72768 | high | 8.3 | No | n8n versions before 2.32.1 contain a server-side request forgery protection bypass vulnerability in the MCP Client node that allows authenti... | 2026-10-29 |
| CVE-2026-72767 | high | 8.8 | No | n8n before 1.123.67, 2.x before 2.31.5, and 2.32.x before 2.32.1 contain a remote code execution vulnerability in the Git node. Authenticate... | 2026-10-29 |