Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-69544 | high | 7.8 | No | Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-69542 | high | 7.8 | No | Heap-based buffer overflow in Windows Camera Frame Server Monitor allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-69540 | high | 7.0 | No | Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-68844 | high | 7.8 | No | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally. | 2026-09-24 |
| CVE-2026-68877 | high | 7.8 | No | Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally. | 2026-09-24 |
| CVE-2026-68896 | high | 7.8 | No | Absolute path traversal in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-58941 | high | 7.8 | No | In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local es... | 2026-09-24 |
| CVE-2026-19201 | high | 7.5 | No | An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 all... | 2026-09-24 |
| CVE-2026-69280 | high | 7.0 | No | Use after free in Windows Push Notifications allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-81161 | low | 3.3 | No | Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affec... | 2026-09-24 |
| CVE-2026-97226 | medium | 6.3 | No | A vulnerability has been found in DbGate up to 7.2.5/7.3.1-premium-beta.1. This impacts the function fs.readFile of the file packages/api/sr... | 2026-09-24 |
| CVE-2026-91133 | medium | 6.5 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, authenticated users could supply unesc... | 2026-09-24 |
| CVE-2026-93425 | critical | 9.9 | No | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the use... | 2026-09-24 |
| CVE-2026-91121 | medium | 5.0 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames u... | 2026-09-24 |
| CVE-2026-91120 | medium | 5.4 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in la... | 2026-09-24 |
| CVE-2026-91123 | high | 7.2 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not... | 2026-09-24 |
| CVE-2026-91122 | high | 8.7 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowe... | 2026-09-24 |
| CVE-2026-84302 | medium | 4.2 | No | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated wi... | 2026-09-24 |
| CVE-2026-78512 | high | 8.8 | No | Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | 2026-09-24 |
| CVE-2026-69732 | high | 8.1 | No | Heap-based buffer overflow in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over a network. | 2026-09-24 |