Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96926 | medium | 5.5 | No | Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | 2026-10-16 |
| CVE-2026-96927 | medium | 5.5 | No | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-85812 | medium | 5.5 | No | Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information loca... | 2026-10-16 |
| CVE-2026-96928 | high | 7.8 | No | Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96929 | high | 7.8 | No | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85814 | critical | 9.8 | No | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-85815 | medium | 5.5 | No | Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-96939 | high | 7.0 | No | Time-of-check time-of-use (toctou) race condition in Servicing Stack Updates allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96943 | high | 8.8 | No | Integer overflow or wraparound in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-97788 | high | 7.5 | No | Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a networ... | 2026-10-16 |
| CVE-2026-97789 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-96321 | medium | 5.5 | No | Out-of-bounds read in Remote Desktop Display Driver allows an authorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-96843 | high | 7.8 | No | Heap-based buffer overflow in WebDAV allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96844 | high | 8.0 | No | Integer underflow (wrap or wraparound) in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges over an adjacent ne... | 2026-10-16 |
| CVE-2026-96846 | medium | 5.5 | No | Out-of-bounds read in WebDAV allows an authorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-96847 | high | 7.8 | No | Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96848 | medium | 5.5 | No | Buffer over-read in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-96849 | medium | 5.5 | No | Use of uninitialized resource in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-96850 | medium | 5.5 | No | Use of uninitialized resource in Windows Modern Device Management (MDM) allows an authorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-96851 | medium | 5.5 | No | Buffer over-read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. | 2026-10-16 |