Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-69950 | high | 7.8 | No | Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-69949 | high | 7.8 | No | Heap-based buffer overflow in Windows Client for NFS allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-110648 | high | 7.8 | No | @offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by sup... | 2026-10-16 |
| CVE-2026-110643 | critical | 9.8 | No | transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted... | 2026-10-16 |
| CVE-2026-110638 | critical | 9.8 | No | doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted docume... | 2026-10-16 |
| CVE-2026-110618 | high | 8.1 | No | SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network... | 2026-10-16 |
| CVE-2026-110608 | medium | 5.4 | No | BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and rece... | 2026-10-16 |
| CVE-2026-109358 | high | 7.8 | No | Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd... | 2026-10-16 |
| CVE-2026-69947 | medium | 6.8 | No | Heap-based buffer overflow in Windows Overlay Filter allows an unauthorized attacker to execute code with a physical attack. | 2026-10-16 |
| CVE-2026-69945 | high | 8.8 | No | Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96916 | high | 7.8 | No | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85336 | medium | 5.5 | No | Out-of-bounds read in Windows Device Association Service allows an authorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-69940 | medium | 6.5 | No | Out-of-bounds read in Windows Client for NFS allows an unauthorized attacker to disclose information over a network. | 2026-10-16 |
| CVE-2026-109439 | critical | 9.8 | No | Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remo... | 2026-10-16 |
| CVE-2026-110603 | medium | 6.3 | No | LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointer... | 2026-10-16 |
| CVE-2026-109339 | medium | 4.9 | No | SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host... | 2026-10-16 |
| CVE-2026-85372 | high | 7.0 | No | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85373 | high | 7.8 | No | Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally... | 2026-10-16 |
| CVE-2026-85374 | medium | 5.5 | No | Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-85375 | high | 7.8 | No | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | 2026-10-16 |