Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-68897 | high | 7.0 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 2026-09-30 |
| CVE-2026-68892 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 2026-09-30 |
| CVE-2026-68891 | medium | 4.7 | No | Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. | 2026-09-30 |
| CVE-2026-68890 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 2026-09-30 |
| CVE-2026-68889 | high | 7.1 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. | 2026-09-30 |
| CVE-2026-81352 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. | 2026-09-30 |
| CVE-2026-54524 | not reported | — | No | Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inj... | 2026-09-30 |
| CVE-2026-54504 | high | 8.8 | No | MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the... | 2026-09-30 |
| CVE-2026-52851 | high | 7.1 | No | Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a per... | 2026-09-30 |
| CVE-2026-52727 | high | 7.2 | No | lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built f... | 2026-09-30 |
| CVE-2026-49292 | none | 0.0 | No | Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/vie... | 2026-09-30 |
| CVE-2026-47252 | critical | 9.0 | No | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS v... | 2026-09-30 |
| CVE-2026-54446 | high | 8.1 | No | NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs... | 2026-09-30 |
| CVE-2026-69197 | not reported | — | No | Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the dir... | 2026-09-30 |
| CVE-2026-77614 | high | 8.8 | No | Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2,... | 2026-09-30 |
| CVE-2026-61793 | not reported | — | No | Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** ro... | 2026-09-30 |
| CVE-2026-61599 | not reported | — | No | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the d... | 2026-09-30 |
| CVE-2026-61596 | high | 7.1 | No | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust... | 2026-09-30 |
| CVE-2026-61589 | medium | 6.3 | No | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the W... | 2026-09-30 |
| CVE-2026-61597 | not reported | — | No | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many... | 2026-09-30 |