Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96949 | high | 7.0 | No | Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96948 | medium | 5.5 | No | Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to... | 2026-10-16 |
| CVE-2026-96947 | high | 7.8 | No | Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96946 | high | 7.8 | No | Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96938 | medium | 6.7 | No | Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96937 | high | 7.0 | No | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96243 | high | 7.8 | No | Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges... | 2026-10-16 |
| CVE-2026-96209 | high | 7.0 | No | Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96118 | high | 7.8 | No | Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-96071 | high | 7.5 | No | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-88226 | medium | 4.6 | No | Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack. | 2026-10-16 |
| CVE-2026-86008 | high | 7.2 | No | Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting... | 2026-10-16 |
| CVE-2026-77829 | medium | 6.4 | No | The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all... | 2026-10-16 |
| CVE-2026-21135 | not reported | — | No | Improper access control in Samsung Internet prior to version 30.0.5.6 allows local attackers to access sensitive information. | 2026-10-16 |
| CVE-2026-21134 | not reported | — | No | Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information. | 2026-10-16 |
| CVE-2026-21133 | not reported | — | No | Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data. | 2026-10-16 |
| CVE-2026-111446 | high | 8.6 | No | Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it... | 2026-10-16 |
| CVE-2026-111388 | medium | 5.4 | No | Frappe Framework before 15.120.0 and 16.x before 16.33.0 does not enforce the per-user restrict_ip allowlist for non-session authentication... | 2026-10-16 |
| CVE-2026-111383 | medium | 6.5 | No | Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent co... | 2026-10-16 |
| CVE-2026-21127 | not reported | — | No | Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive d... | 2026-10-16 |