Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106931 | high | 7.8 | Listed | SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with r... | 2026-10-21 |
| CVE-2026-107209 | high | 7.5 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMa... | 2026-10-21 |
| CVE-2026-107210 | medium | 5.3 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted hi... | 2026-10-21 |
| CVE-2026-83856 | high | 8.1 | No | Out-of-bounds read in Windows Event Logging Service allows an unauthorized attacker to execute code over a network. | 2026-10-21 |
| CVE-2026-83857 | high | 7.8 | No | Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | 2026-10-21 |
| CVE-2026-83859 | high | 7.8 | No | Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally. | 2026-10-21 |
| CVE-2026-83860 | high | 7.5 | No | Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network. | 2026-10-21 |
| CVE-2026-83861 | high | 7.8 | No | Heap-based buffer overflow in Windows Remote Desktop Protocol allows an authorized attacker to elevate privileges locally. | 2026-10-21 |
| CVE-2026-107389 | medium | 5.5 | No | music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the Matroska and WebM EBML parser decodes an attacker... | 2026-10-21 |
| CVE-2026-83864 | medium | 5.5 | No | Improper access control in Windows NTFS allows an authorized attacker to disclose information locally. | 2026-10-21 |
| CVE-2026-83865 | medium | 4.7 | No | Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally. | 2026-10-21 |
| CVE-2026-83866 | high | 7.0 | No | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | 2026-10-21 |
| CVE-2026-109945 | medium | 5.9 | No | FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_... | 2026-10-21 |
| CVE-2026-105301 | not reported | — | No | Rejected reason: This candidate was rejected after further investigation determined that it is not a security vulnerability. The client cert... | 2026-10-21 |
| CVE-2026-70095 | high | 7.5 | No | Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network. | 2026-10-21 |
| CVE-2026-70097 | medium | 5.6 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Virtualization-Based Security (VBS) E... | 2026-10-21 |
| CVE-2026-70102 | high | 7.8 | No | Use after free in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally. | 2026-10-21 |
| CVE-2026-70103 | high | 7.8 | No | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | 2026-10-21 |
| CVE-2026-70104 | high | 7.8 | No | Untrusted pointer dereference in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 2026-10-21 |
| CVE-2026-109946 | medium | 6.5 | No | FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width rea... | 2026-10-21 |