Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-21335 | high | 7.8 | Listed | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | 2026-09-24 |
| CVE-2025-23006 | critical | 9.8 | Listed | Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and... | 2026-09-24 |
| CVE-2025-21391 | high | 7.1 | Listed | Windows Storage Elevation of Privilege Vulnerability | 2026-09-24 |
| CVE-2025-0108 | critical | 9.1 | Listed | An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management... | 2026-09-24 |
| CVE-2025-26633 | high | 7.0 | Listed | Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. | 2026-09-24 |
| CVE-2025-24993 | high | 7.8 | Listed | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. | 2026-09-24 |
| CVE-2025-30066 | high | 8.6 | Listed | tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were af... | 2026-09-24 |
| CVE-2024-48248 | high | 8.6 | Listed | NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may l... | 2026-09-24 |
| CVE-2025-42599 | critical | 9.8 | Listed | Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted requ... | 2026-09-24 |
| CVE-2025-43200 | medium | 4.2 | Listed | This issue was addressed with improved checks. This issue is fixed in iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iOS 18.3... | 2026-09-24 |
| CVE-2025-8875 | high | 7.8 | Listed | Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025... | 2026-09-24 |
| CVE-2025-48384 | high | 8.0 | Listed | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and... | 2026-09-24 |
| CVE-2025-32432 | critical | 10.0 | Listed | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to bef... | 2026-09-24 |
| CVE-2026-80097 | high | 8.6 | No | Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-69299 | high | 7.0 | No | Use after free in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-85706 | critical | 10.0 | Listed | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.... | 2026-09-24 |
| CVE-2008-4128 | high | 8.1 | Listed | Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Serv... | 2026-09-24 |
| CVE-2026-91960 | medium | 6.5 | No | FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers t... | 2026-09-24 |
| CVE-2026-91959 | medium | 6.5 | No | FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Att... | 2026-09-24 |
| CVE-2026-91958 | medium | 6.6 | No | FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing... | 2026-09-24 |