Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-70062 | high | 8.1 | No | Double free in Windows Libarchive allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-70063 | medium | 4.7 | No | Out-of-bounds read in Windows Kernel allows an authorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-70064 | high | 7.8 | No | Integer underflow (wrap or wraparound) in Windows Kerberos allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70066 | high | 7.0 | No | Use after free in Windows DHCP Server allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70067 | high | 7.0 | No | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70068 | high | 8.8 | No | Heap-based buffer overflow in Windows Client-Side Caching (CSC) Service allows an unauthorized attacker to elevate privileges over a network... | 2026-10-28 |
| CVE-2026-70069 | high | 8.8 | No | Stack-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-70072 | medium | 6.5 | No | Allocation of resources without limits or throttling in Windows Netlogon allows an authorized attacker to deny service over a network. | 2026-10-28 |
| CVE-2026-70076 | high | 7.0 | No | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70077 | medium | 4.7 | No | Use after free in Windows Kernel allows an authorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-70084 | medium | 5.5 | No | Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-70086 | high | 7.0 | No | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70089 | high | 8.8 | No | Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-70090 | medium | 5.5 | No | Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-92098 | medium | 6.1 | No | The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_prin... | 2026-10-28 |
| CVE-2026-81212 | critical | 10.0 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant'... | 2026-10-28 |
| CVE-2026-59185 | high | 8.5 | No | identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/... | 2026-10-28 |
| CVE-2026-59172 | high | 7.8 | No | Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint ` walks upward from the linted file... | 2026-10-28 |
| CVE-2026-76058 | medium | 5.3 | No | The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. T... | 2026-10-28 |
| CVE-2026-118164 | medium | 6.4 | No | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting... | 2026-10-28 |