Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85364 | high | 7.0 | No | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70123 | high | 7.8 | No | Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-85366 | high | 7.8 | No | Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-85367 | high | 7.0 | No | Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70128 | medium | 5.5 | No | Out-of-bounds read in HID Parser Library allows an authorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-70262 | critical | 9.8 | No | Heap-based buffer overflow in WebDAV allows an unauthorized attacker to elevate privileges over a network. | 2026-10-28 |
| CVE-2026-91212 | high | 8.6 | No | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Generic REST). Supported versions tha... | 2026-10-28 |
| CVE-2026-91211 | high | 8.7 | No | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Sup... | 2026-10-28 |
| CVE-2026-90726 | medium | 6.0 | No | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re... | 2026-10-28 |
| CVE-2026-70277 | medium | 5.5 | No | Out-of-bounds read in Windows Fast FAT Driver allows an unauthorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-83526 | high | 8.8 | No | The FV Player 8 plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.1.7 via the check_mimety... | 2026-10-28 |
| CVE-2026-74990 | critical | 9.8 | No | Internally found bugs present in Firefox ESR 115.38, Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed eviden... | 2026-10-28 |
| CVE-2026-74989 | critical | 9.8 | No | Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect an... | 2026-10-28 |
| CVE-2026-74988 | critical | 9.8 | No | Internally found bugs present in Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another secur... | 2026-10-28 |
| CVE-2026-74987 | critical | 9.8 | No | Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corrupt... | 2026-10-28 |
| CVE-2026-74969 | high | 8.8 | No | Race condition, use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Fir... | 2026-10-28 |
| CVE-2026-74949 | high | 8.8 | No | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thun... | 2026-10-28 |
| CVE-2026-74946 | high | 8.8 | No | Information disclosure due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox... | 2026-10-28 |
| CVE-2026-58255 | high | 8.8 | No | Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped AP... | 2026-10-28 |
| CVE-2026-57202 | high | 8.1 | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-10-28 |