Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85376 | high | 7.8 | No | Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85377 | high | 7.8 | No | Access of resource using incompatible type ('type confusion') in Windows CD-ROM Driver allows an authorized attacker to elevate privileges l... | 2026-10-16 |
| CVE-2026-85791 | high | 7.0 | No | Heap-based buffer overflow in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85792 | critical | 9.8 | No | Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | 2026-10-16 |
| CVE-2026-85793 | medium | 5.5 | No | Exposure of sensitive system information to an unauthorized control sphere in Windows Sysmain Service allows an authorized attacker to discl... | 2026-10-16 |
| CVE-2026-111728 | medium | 5.4 | No | Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LA... | 2026-10-16 |
| CVE-2026-111369 | high | 7.1 | No | ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any c... | 2026-10-16 |
| CVE-2026-111368 | medium | 6.4 | No | ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows co... | 2026-10-16 |
| CVE-2026-111366 | high | 7.2 | No | cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside... | 2026-10-16 |
| CVE-2026-111365 | medium | 6.0 | No | cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete... | 2026-10-16 |
| CVE-2026-111364 | medium | 6.5 | No | MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated... | 2026-10-16 |
| CVE-2026-111358 | medium | 5.4 | No | SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attac... | 2026-10-16 |
| CVE-2026-111356 | high | 7.4 | No | MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to tak... | 2026-10-16 |
| CVE-2026-111355 | medium | 6.3 | No | zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataSc... | 2026-10-16 |
| CVE-2026-111354 | low | 3.1 | No | crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by sup... | 2026-10-16 |
| CVE-2026-111350 | medium | 5.0 | No | Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to... | 2026-10-16 |
| CVE-2026-111349 | medium | 5.3 | No | Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to... | 2026-10-16 |
| CVE-2026-111346 | medium | 5.4 | No | ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and ov... | 2026-10-16 |
| CVE-2026-111345 | medium | 4.3 | No | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by su... | 2026-10-16 |
| CVE-2026-111330 | medium | 5.9 | No | JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 diges... | 2026-10-16 |