Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-49921 | critical | 9.8 | No | In multiple locations, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with... | 2026-09-24 |
| CVE-2026-49927 | high | 7.8 | No | In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege... | 2026-09-24 |
| CVE-2026-49932 | high | 7.8 | No | In parseParts of PduParser.java, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation o... | 2026-09-24 |
| CVE-2026-55256 | medium | 6.5 | No | In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to... | 2026-09-24 |
| CVE-2026-92756 | medium | 5.5 | No | Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption se... | 2026-09-24 |
| CVE-2026-92758 | medium | 5.5 | No | If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in... | 2026-09-24 |
| CVE-2026-92757 | medium | 5.5 | No | Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable... | 2026-09-24 |
| CVE-2026-69386 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | 2026-09-24 |
| CVE-2026-45515 | high | 7.8 | No | In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overf... | 2026-09-24 |
| CVE-2026-45519 | low | 3.3 | No | In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This co... | 2026-09-24 |
| CVE-2026-69388 | high | 7.0 | No | Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-45520 | high | 7.8 | No | In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local esc... | 2026-09-24 |
| CVE-2026-45521 | low | 3.3 | No | In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local in... | 2026-09-24 |
| CVE-2026-45525 | low | 3.3 | No | In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information... | 2026-09-24 |
| CVE-2026-45527 | medium | 4.3 | No | In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way to cause a temporary denial of service due to an integer ove... | 2026-09-24 |
| CVE-2026-97182 | high | 7.3 | No | A security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file application/src... | 2026-09-24 |
| CVE-2026-96764 | medium | 4.3 | No | A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex... | 2026-09-24 |
| CVE-2026-96551 | medium | 4.3 | No | A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the... | 2026-09-24 |
| CVE-2026-86867 | medium | 6.5 | No | Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect... | 2026-09-24 |
| CVE-2026-85682 | high | 8.8 | No | The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the... | 2026-09-24 |