Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107820 | medium | 5.3 | No | x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugger's full functionality over HTTP. Prior... | 2026-10-16 |
| CVE-2026-96183 | medium | 5.5 | No | Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to disclose i... | 2026-10-16 |
| CVE-2026-67415 | medium | 4.9 | No | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled ru... | 2026-10-16 |
| CVE-2026-88071 | high | 7.8 | No | Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-88074 | high | 7.8 | No | Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges lo... | 2026-10-16 |
| CVE-2026-88075 | high | 8.8 | No | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized... | 2026-10-16 |
| CVE-2026-88079 | high | 7.0 | No | Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-88092 | critical | 9.4 | No | Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform... | 2026-10-16 |
| CVE-2026-67419 | medium | 6.5 | No | RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to... | 2026-10-16 |
| CVE-2026-88099 | medium | 5.9 | No | Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network. | 2026-10-16 |
| CVE-2026-88100 | high | 7.8 | No | Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-88102 | critical | 9.8 | No | Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-96320 | critical | 9.8 | No | Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | 2026-10-16 |
| CVE-2026-69227 | critical | 9.8 | No | A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This co... | 2026-10-16 |
| CVE-2026-69226 | medium | 6.5 | No | A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account... | 2026-10-16 |
| CVE-2026-67420 | medium | 6.5 | No | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refres... | 2026-10-16 |
| CVE-2026-17525 | medium | 5.2 | No | Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5. | 2026-10-16 |
| CVE-2026-106496 | medium | 6.5 | No | Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by... | 2026-10-16 |
| CVE-2026-106497 | medium | 4.3 | No | Backstage is an open framework for building developer portals. Prior to 3.9.1, the @backstage/plugin-catalog-backend package is affected by... | 2026-10-16 |
| CVE-2026-106498 | high | 7.7 | No | Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-... | 2026-10-16 |