Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-97854 | critical | 9.8 | No | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may b... | 2026-10-29 |
| CVE-2026-109822 | medium | 6.5 | No | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configura... | 2026-10-29 |
| CVE-2026-103665 | high | 7.8 | No | The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the... | 2026-10-29 |
| CVE-2026-114358 | not reported | — | No | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery fu... | 2026-10-29 |
| CVE-2026-85867 | high | 7.8 | No | Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-85868 | high | 7.0 | No | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-85869 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-85870 | high | 7.0 | No | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-85871 | high | 7.8 | No | Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-85872 | high | 7.8 | No | Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-114400 | high | 7.5 | No | Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket atta... | 2026-10-29 |
| CVE-2026-83652 | high | 7.8 | No | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. | 2026-10-29 |
| CVE-2026-111419 | high | 8.6 | No | A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorizati... | 2026-10-29 |
| CVE-2026-111418 | high | 7.5 | No | A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-fo... | 2026-10-29 |
| CVE-2026-111417 | high | 7.5 | No | A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token... | 2026-10-29 |
| CVE-2026-39742 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Block... | 2026-10-29 |
| CVE-2026-114401 | medium | 5.3 | No | Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by... | 2026-10-29 |
| CVE-2026-115303 | low | 3.7 | No | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before co... | 2026-10-29 |
| CVE-2026-89216 | high | 8.6 | No | The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows u... | 2026-10-29 |
| CVE-2026-88928 | medium | 6.5 | No | The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint w... | 2026-10-29 |