Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85328 | high | 7.0 | No | Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85799 | high | 8.1 | No | Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-108039 | high | 7.5 | No | By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document. A very large req... | 2026-10-16 |
| CVE-2026-69902 | medium | 6.7 | No | Untrusted pointer dereference in Windows NTFS allows an authorized attacker to execute code locally. | 2026-10-16 |
| CVE-2026-85800 | high | 7.8 | No | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85914 | high | 7.0 | No | Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85915 | high | 7.8 | No | Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85916 | medium | 5.5 | No | Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose info... | 2026-10-16 |
| CVE-2026-69898 | high | 7.8 | No | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85918 | high | 7.0 | No | Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85920 | high | 7.0 | No | Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-69886 | critical | 9.8 | No | Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-85922 | high | 7.4 | No | Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network. | 2026-10-16 |
| CVE-2026-85802 | high | 7.0 | No | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85925 | high | 8.2 | No | Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges o... | 2026-10-16 |
| CVE-2026-85323 | medium | 6.8 | No | Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network. | 2026-10-16 |
| CVE-2026-70033 | high | 7.5 | No | Missing release of memory after effective lifetime in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a... | 2026-10-16 |
| CVE-2026-85803 | high | 7.0 | No | Use after free in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-70021 | high | 7.0 | No | Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-85804 | high | 7.8 | No | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. | 2026-10-16 |