CVE-2026 list

CVE-2026 records published in September 2026

Page nine of 15: records 8,001 to 9,000 of the 14,718 published in September 2026, newest first. The first page carries the figures for September 2026.

CVE-2026 records published in September 2026, newest first: records 8,001 to 9,000 of 14,718
CVE Summary CVSS EPSS Published Signals
CVE-2026-73460Arista Networks EOS security Advisory 01607.0CNA v4.00.2%2026-09-15Fix
CVE-2026-73459Arista Networks EOS security Advisory 01607.0CNA v4.00.2%2026-09-15Fix
CVE-2026-73458Arista EOS BFD vulnerability9.2CNA v4.00.4%2026-09-15Fix
CVE-2026-73451Arista EOS SVI security ACLs incorrect initialization6.3CNA v4.00.2%2026-09-15
CVE-2026-73446Arista Networks EOS security Advisory 01607.0CNA v4.00.3%2026-09-15Fix
CVE-2026-73444Arista EOS VRRPv2 IP-AH authentication authentication bypass5.3CNA v4.00.3%2026-09-15Fix
CVE-2026-73437Arista EOS DHCP relay agent vulnerability6.5CNA v4.00.2%2026-09-15Fix
CVE-2026-71163Oracle Access Manager Authentication Engine component unauthorized data access9.9CNA v3.10.4%2026-09-15Fix
CVE-2026-71133Oracle Access Manager Authentication Engine component takeover10.0CNA v3.10.5%2026-09-15Fix
CVE-2026-71047Oracle Identity Manager Core component takeover8.8CNA v3.10.4%2026-09-15Fix
CVE-2026-70915Oracle Identity Manager Core component takeover8.8CNA v3.10.4%2026-09-15Fix
CVE-2026-70913Oracle Identity Manager Core component takeover9.8CNA v3.10.5%2026-09-15Fix
CVE-2026-70757Oracle WebLogic Server Core component takeover9.8CNA v3.10.5%2026-09-15Fix
CVE-2026-70756Oracle WebLogic Server Core component takeover9.8CNA v3.10.5%2026-09-15Fix
CVE-2026-70755Oracle Web Applications Desktop Integrator file download component unauthorized data access6.5CNA v3.10.3%2026-09-15Fix
CVE-2026-70748Oracle WebLogic Server Core component takeover9.8CNA v3.10.5%2026-09-15Fix
CVE-2026-69486Microsoft Edge (Chromium-based) remote code execution8.8CNA v3.10.8%2026-09-15Fix
CVE-2026-69218Http4s Ember HTTP/2: Unbounded continuation frame accumulation7.5CNA v3.10.6%2026-09-15Fix
CVE-2026-69217Http4s: Ember Server accepts duplicate Content-Length headers8.7CNA v3.10.5%2026-09-15Fix
CVE-2026-69216Http4s: Ember chunk parser lenience (TE.TE request smuggling)5.4CNA v3.10.4%2026-09-15Fix
CVE-2026-69215Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin6.8CNA v3.10.5%2026-09-15Fix
CVE-2026-69214Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain6.8CNA v3.10.4%2026-09-15Fix
CVE-2026-69213Http4s Ember HTTP/2: Unbounded outbound frame queue7.5CNA v3.10.6%2026-09-15Fix
CVE-2026-69212Http4s FollowRedirect middleware information disclosure5.9CNA v3.10.3%2026-09-15Exploit codeFix
CVE-2026-69211Http4s Set-Cookie renderer HTTP response splitting4.8CNA v3.10.3%2026-09-15Fix
CVE-2026-69210Http4s: WebSocket decoder accepts negative length, causing infinite decode loop7.5CNA v3.10.6%2026-09-15Fix
CVE-2026-69209Http4s: WebSocket decoder accepts unbounded message sizes7.5CNA v3.10.6%2026-09-15Fix
CVE-2026-69208Http4s: DigestAuth nonce map grows unbounded7.5CNA v3.10.8%2026-09-15Fix
CVE-2026-69206Http4s: DigestAuth allows replay of captured requests5.9CNA v3.10.4%2026-09-15Fix
CVE-2026-69205Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)8.7CNA v3.10.5%2026-09-15Fix
CVE-2026-69204Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)9.2CNA v4.00.6%2026-09-15Fix
CVE-2026-69203Http4s Ember HTTP/2: Does not enforce SETTINGS_MAX_CONCURRENT_STREAMS7.5CNA v3.10.6%2026-09-15Fix
CVE-2026-69202Http4s Ember HTTP/2: Unbounded inbound body buffering7.5CNA v3.10.6%2026-09-15Fix
CVE-2026-69201Http4s: ResourceService and Webjar service path escape via percent-encoded separators5.9CNA v3.10.8%2026-09-15Fix
CVE-2026-68953Missing authentication for critical function in Digital Watchdog VMAX DVR and NVR Product Lineups7.1CNA v4.00.6%2026-09-15Fix
CVE-2026-68950Digital Watchdog VMAX DVR and NVR FTP service hard-coded credentials8.7CNA v4.00.3%2026-09-15Fix
CVE-2026-68534Concrete CMS is vulnerable to stored XSS via unescaped Express entry labels in association selectors2.3CNA v4.00.6%2026-09-15Fix
CVE-2026-68533Concrete CMS CMS conversation attachment upload endpoint missing authorization2.3CNA v4.00.4%2026-09-15Fix
CVE-2026-68532Concrete CMS to is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard action2.3CNA v4.00.3%2026-09-15Fix
CVE-2026-68531Concrete CMS is vulnerable to authenticated denial of service2.1CNA v4.00.5%2026-09-15Fix
CVE-2026-68530Concrete CMS CMS board instance dashboard actions missing authorization2.1CNA v4.00.5%2026-09-15
CVE-2026-68529Concrete CMS CMS Express entries advanced search dashboard action missing authorization2.1CNA v4.00.4%2026-09-15Fix
CVE-2026-68491WebPros SolusVM link following9.4CNA v4.00.5%2026-09-15Fix
CVE-2026-68070Missing authentication for critical function in Digital Watchdog VMAX DVR and NVR Product Lineups8.7CNA v4.00.4%2026-09-15Fix
CVE-2026-66890Digital Watchdog VMAX DVR and NVR FTP service hard-coded credentials9.4CNA v4.00.3%2026-09-15Fix
CVE-2026-66887Missing authorization in Digital Watchdog VMAX DVR and NVR Product Lineups9.4CNA v4.00.3%2026-09-15Fix
CVE-2026-66372Digital Watchdog VMAX DVR and NVR session token generator vulnerability7.6CNA v4.00.3%2026-09-15Fix
CVE-2026-65831ArcadeDB: Privilege escalation7.7CNA v3.10.6%2026-09-15Fix
CVE-2026-63696Dell SmartFabric OS10 Software download without integrity check9.1CNA v3.10.3%2026-09-15Fix
CVE-2026-63695Dell SmartFabric OS10 Software session fixation9.8CNA v3.10.5%2026-09-15Fix
CVE-2026-63443Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write8.3CNA v3.10.8%2026-09-15Fix
CVE-2026-62597Oracle Enterprise Manager Base Platform Event Management component unauthorized data modification6.5CNA v3.10.3%2026-09-15Fix
CVE-2026-62379OpenAM: Unauthenticated remote code execution via Class.forName in AuthXMLUtils.createCustomCallback9.8CNA v3.11.1%2026-09-15Fix
CVE-2026-62280OpenAM reflected XSS in the OAuth2/OIDC `wap` consent page6.1CNA v3.10.3%2026-09-15Fix
CVE-2026-62263OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth bypass9.2CNA v4.00.9%2026-09-15Fix
CVE-2026-61668DIRAC: Pilot code downloaded over unverified HTTPS connection8.1CNA v3.10.4%2026-09-15Fix
CVE-2026-61667DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval9.9CNA v3.11.2%2026-09-15Fix
CVE-2026-61568@zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport9.6CNA v3.10.5%2026-09-15Fix
CVE-2026-61560@zereight/mcp-gitlab's unauthenticated arbitrary file read9.8CNA v3.12.9%2026-09-15NucleiFix
CVE-2026-61559@zereight/mcp-gitlab vulnerable to server-side request forgery9.6CNA v3.10.4%2026-09-15Fix
CVE-2026-61554emp3r0r has an unauthenticated HTTP Polling DoS7.5CNA v3.10.7%2026-09-15Fix
CVE-2026-61549Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend9.0CNA v4.00.3%2026-09-15Fix
CVE-2026-61544libp2p rust-libp2p libp2p-quic: Remote panic via certificate expiry race during QUIC handshake8.2CNA v4.00.3%2026-09-15Fix
CVE-2026-59973FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix8.5CNA v3.10.4%2026-09-15Fix
CVE-2026-59971designcomputer MySQL MCP Server SSE transport missing authentication10.0CNA v3.10.4%2026-09-15Fix
CVE-2026-59965@jhb.software/payload-alt-text-plugin: Alt Text endpoint authorization bypass7.1CNA v3.10.4%2026-09-15Fix
CVE-2026-59341Bitnami Sealed Secrets controller verify and rotate endpoints template injection4.2CNA v3.10.4%2026-09-15
CVE-2026-59160Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /API/run8.8CNA v3.10.5%2026-09-15Fix
CVE-2026-59157ncarlier webhookd HTTP header to shell variable conversion vulnerability6.5CNA v3.10.6%2026-09-15Fix
CVE-2026-58773Google Android link_device.c out-of-bounds write6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58767Google Android arm-smmu-v3.c privilege escalation6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58766Google Android arm-smmu-v3.c privilege escalation7.8CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58765Google Android GPU insecure permissions6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58755Google Android arm-smmu-v3.c privilege escalation6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58751Google Android arm-smmu-v3.c use-after-free6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58747Google Android arm-smmu-v3.c insecure permissions6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58744Google Android multiple locations privilege escalation7.8CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58739Google Android default_msg_handlers.c confused deputy6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58734Google Android google_mba_poll.c out-of-bounds write7.0CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58731Google Android physmem_extmem_linux.c out-of-bounds read6.2CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58728Google Android mmu.h memory corruption7.0CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58726Google Android fsm.c insecure permissions6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58724Google Android multiple locations use-after-free7.0CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58721Google Android multiple locations information disclosure4.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58718Google Android arm-smmu-v3.c privilege escalation6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58716Google Android multiple locations privilege escalation6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58710Google Android film_grain_dec.cc out-of-bounds write8.8CISA ADP v3.10.4%2026-09-15Fix
CVE-2026-58704Google Pixel improper authorization8.8CISA ADP v3.10.6%2026-09-15KEVFix
CVE-2026-58701Google Android generic-arm64-smcall.c out-of-bounds write7.0CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58699Google Android vp9hwd_output.cc out-of-bounds read8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58698Google Android ap_pmic_ipc.c insecure permissions6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58695Google Android phy_power.c privilege escalation7.8CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58691Google Android fsm.c insecure permissions8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58683Google Android IP Multimedia subsystem out-of-bounds write8.8CISA ADP v3.10.4%2026-09-15Fix
CVE-2026-58679Google Android gf_ta_test.c heap-based buffer overflow8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58678Google Android Bootloader insecure permissions7.8CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-58502gouef githubtoplanguages Discord notification workflow OS command injection7.1CNA v4.00.5%2026-09-15Fix
CVE-2026-58485ihor-sokoliuk mcp-searxng SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web_url_read`7.1CNA v3.10.2%2026-09-15Fix
CVE-2026-58483ihor-sokoliuk mcp-searxng web_url_read URL reader denial of service7.5CNA v3.10.7%2026-09-15Fix
CVE-2026-58201Lokka: Azure Resource Manager URL path validation issue8.7CNA v4.00.5%2026-09-15Fix
CVE-2026-58200jhb-software payload-plugins improper signature verification7.1CNA v3.10.3%2026-09-15Fix
CVE-2026-58196ToolHive: SSRF in remote MCP server authentication discovery4.7CNA v3.10.4%2026-09-15Fix
CVE-2026-57586CodeRAG Gradle dependency sync OS command injection8.6CNA v3.10.2%2026-09-15Fix
CVE-2026-57442MCPVault: PathFilter restricted directories only denied at vault root, not nested6.9CNA v4.00.2%2026-09-15Fix
CVE-2026-57441Bitbonsai MCPVault PathFilter vulnerability8.4CNA v4.00.2%2026-09-15Fix
CVE-2026-57148praisonai-platform still boots on the hard-coded JWT secret dev-secret-change-me9.8CNA v3.10.6%2026-09-15Fix
CVE-2026-57147MervinPraison praisonai-platform JWT authentication service hard-coded credentials9.8CNA v3.10.8%2026-09-15Fix
CVE-2026-57141PraisonAI: Remote code execution via sandbox escape in `codeMode` tool9.8CNA v3.10.7%2026-09-15Fix
CVE-2026-57140PraisonAI AgentOS exposes unauthenticated agent listing and invocation9.4CNA v3.10.6%2026-09-15Fix
CVE-2026-57139PraisonAI MCPServer exposes unauthenticated HTTP tools/call9.8CNA v3.10.8%2026-09-15Fix
CVE-2026-57138PraisonAI codeMode sandbox escape via function constructor9.9CNA v3.10.7%2026-09-15Fix
CVE-2026-57137PraisonAI AgentLoop onToolCall approval runs after tool execution8.8CNA v3.10.5%2026-09-15Fix
CVE-2026-57136PraisonAI SandboxExecutor allowedCommands bypass via shell chaining8.8CNA v3.10.5%2026-09-15Fix
CVE-2026-57135PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients7.6CNA v3.10.4%2026-09-15Fix
CVE-2026-57134MervinPraison PraisonAI MCPSecurity authentication policy improper authentication8.2CNA v3.10.4%2026-09-15Fix
CVE-2026-57133PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining8.8CNA v3.10.8%2026-09-15Fix
CVE-2026-57112MervinPraison PraisonAI MCP SSE transport missing authentication8.3CNA v3.10.2%2026-09-15Fix
CVE-2026-57042Google Android DreamPickerReceiver.kt insecure permissions6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-57035Google Android multiple locations out-of-bounds write6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-57014Google Android phNxpNciHal_ext.cc out-of-bounds write7.8CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-57012Google Android the Setup Wizard privilege escalation8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-57008Google Android Modem information disclosure7.5CISA ADP v3.10.3%2026-09-15Fix
CVE-2026-57006Google Android acfw_ffa.c information disclosure4.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56997Google Android vp9hwd_headers.cc out-of-bounds write8.8CISA ADP v3.10.4%2026-09-15Fix
CVE-2026-56992Google Android multiple files insecure permissions6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56989Google Android multiple locations out-of-bounds write6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56988Google Android bluetooth_cco.cc use-after-free6.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56986Google Android multiple files out-of-bounds read8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56985Google Android multiple files privilege escalation8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56982Google Android VPU insecure permissions7.8CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56979Google Android multiple locations insecure permissions6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56978Google Android gc.c out-of-bounds read8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56975Google Android Cellular Modem denial of service6.5CISA ADP v3.10.2%2026-09-15Fix
CVE-2026-56974Google Android AudioRtpPayloadEncoderNode.cpp out-of-bounds write8.8CISA ADP v3.10.4%2026-09-15Fix
CVE-2026-56973Google Android multiple locations privilege escalation6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56972Google Android multiple locations out-of-bounds write6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56970Google Android multiple locations insecure permissions8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56967Google Android Cellular Modem out-of-bounds write8.0CISA ADP v3.10.2%2026-09-15Fix
CVE-2026-56964Google Android multiple locations use-after-free6.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56960Google Android multiple locations use-after-free9.8CISA ADP v3.10.4%2026-09-15Fix
CVE-2026-56958Google Android gf_algo.c out-of-bounds read5.5CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56950Google Android mbu_class.rs information disclosure4.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56945Google Android VPU out-of-bounds write7.8CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56942Google Android vp9hwd_headers.cc out-of-bounds write8.8CISA ADP v3.10.4%2026-09-15Fix
CVE-2026-56941Google Android fpc_tee_hal.c use-after-free8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56932Google Android Trusted Execution Environment memory corruption6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56923Google Android tipc_virtio_dev.c memory corruption6.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56922Google Android CPM insecure permissions6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56920Google Android fw_hevc_dec_header.c out-of-bounds write8.8CISA ADP v3.10.4%2026-09-15Fix
CVE-2026-56915Google Android bigo.c privilege escalation6.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56914Google Android multiple locations use-after-free8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56907Google Android VPU privilege escalation6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56892Google Android common.c information disclosure6.2CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56889Google Android multiple locations insecure permissions6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56888Google Android multiple locations insecure permissions6.2CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56882Google Android Cellular Modem information disclosure8.8CISA ADP v3.10.4%2026-09-15Fix
CVE-2026-56881Google Android remap.c insecure permissions8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56879Google Android gmc_mba.c memory corruption6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-56831Shopper: Negative discount values accepted and propagated through order calculation pipeline6.5CNA v3.10.4%2026-09-15Fix
CVE-2026-56830Shopper product media form missing authorization6.5CNA v3.10.4%2026-09-15Fix
CVE-2026-56829Shopper variant stock component missing authorization8.1CNA v3.10.5%2026-09-15Fix
CVE-2026-56827Shopper Filament bulk actions missing authorization8.1CNA v3.10.5%2026-09-15Fix
CVE-2026-56825Shopper: Missing authorization on product removal actions in CollectionProducts component8.1CNA v3.10.5%2026-09-15Fix
CVE-2026-55887MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway8.7CNA v4.00.2%2026-09-15Fix
CVE-2026-55864GeoNetwork: Unauthenticaded server-side request forgery in SLD tool7.8CNA v4.00.6%2026-09-15Fix
CVE-2026-55863motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution5.3CNA v3.10.5%2026-09-15Fix
CVE-2026-55828qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)6.0CNA v4.00.4%2026-09-15Fix
CVE-2026-55776OpenBao Transit secrets engine denial of service6.5CNA v3.10.6%2026-09-15Fix
CVE-2026-55775OpenBao's System Backend allows Unauthorized Management of the containing Namespace2.3CNA v4.00.5%2026-09-15Fix
CVE-2026-55774OpenBao lease revocation API incorrect authorization2.1CNA v4.00.6%2026-09-15Fix
CVE-2026-55770OpenBao: LDAPi ldaputil (wrong escape func)6.8CNA v3.10.5%2026-09-15Fix
CVE-2026-55701OpenTelemetry githubreceiver silently ignores configured required_headers authentication6.9CNA v4.00.7%2026-09-15Fix
CVE-2026-55692StarCitizenWiki mediawiki-extensions-EmbedVideo EmbedVideo Extension: Stored XSS7.5CNA v3.10.5%2026-09-15Fix
CVE-2026-55691StarCitizenWiki mediawiki-extensions-EmbedVideo EmbedVideo extension: Stored XSS8.6CNA v3.10.5%2026-09-15Fix
CVE-2026-55690StarCitizenWiki mediawiki-extensions-EmbedVideo EmbedVideo Extension: Stored XSS7.5CNA v3.10.5%2026-09-15Fix
CVE-2026-55650Outerbase Studio: Stored XSS in Text widget leads to authentication token exposure4.4CNA v3.10.2%2026-09-15
CVE-2026-55636Capsule: Incomplete fix of singular/plural typo leaves namespaces/finalize unprotected5.7CNA v3.10.4%2026-09-15Fix
CVE-2026-55630Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan and TestCase)0.0CNA v3.10.4%2026-09-15Fix
CVE-2026-55617Hydro: Insufficient session expiration when recreating sessions6.9CNA v4.00.5%2026-09-15Fix
CVE-2026-55591signalk-server Signal K Server: Server-side request forgery via Remote Connection endpoints5.8CNA v3.10.3%2026-09-15Fix
CVE-2026-55375canto-saas-api OAuth token request information disclosure5.3CNA v3.10.4%2026-09-15Fix
CVE-2026-55374jleehr canto-saas-api Request::buildRequestUrl server-side request forgery4.8CNA v3.10.4%2026-09-15Fix
CVE-2026-55366Google Android IP Multimedia subsystem authentication bypass9.8CISA ADP v3.10.5%2026-09-15Fix
CVE-2026-55365Google Android remap.c out-of-bounds write6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-55359Google Android multiple locations insecure permissions7.8CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-55351Google Android VPU out-of-bounds write7.8CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-55343Google Android ImsMediaAudioPlayer.cpp out-of-bounds write8.0CISA ADP v3.10.3%2026-09-15Fix
CVE-2026-55332Google Android multiple locations out-of-bounds write6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-55331Google Android IP Multimedia subsystem out-of-bounds write8.8CISA ADP v3.10.4%2026-09-15Fix
CVE-2026-55323Google Android gf_base.c out-of-bounds write7.8CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-55318Google Android multiple locations use-after-free8.8CISA ADP v3.10.3%2026-09-15Fix
CVE-2026-55317Google Android printf.c out-of-bounds write6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-55306Google Android Cellular Modem denial of service7.5CISA ADP v3.10.4%2026-09-15Fix
CVE-2026-55304Google Android remap.c privilege escalation6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-55302Google Android multiple locations insecure permissions6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-55301Google Android wave6.c out-of-bounds write8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-55226Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator5.4CNA v3.10.3%2026-09-15Fix
CVE-2026-55225Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`8.0CNA v3.10.3%2026-09-15Fix
CVE-2026-55211surfio IRAP header size fields cause out-of-bounds reads9.8CNA v3.00.7%2026-09-15Fix
CVE-2026-55178GeoLens dataset authorization checks missing authorization7.5CNA v3.10.6%2026-09-15Fix
CVE-2026-55158Conflibot: Command injection via crafted pull request branch names under pull_request_target9.1CNA v3.10.8%2026-09-15Fix
CVE-2026-55149Vouch Proxy: Unbounded Multipart Cookie Allocation DoS7.5CNA v3.10.7%2026-09-15Fix
CVE-2026-54724Kiwi TCMS: Open redirect via unvalidated next parameter in account confirmation endpoint6.1CNA v3.10.3%2026-09-15Fix
CVE-2026-54689mcp-searxng hardened-mode SSRF bypasses permit internal URL access6.3CNA v3.10.2%2026-09-15Fix
CVE-2026-54688ihor-sokoliuk mcp-searxng URL reader tool server-side request forgery6.5CNA v3.10.5%2026-09-15Fix
CVE-2026-54637Dragonfly scheduler v1 gRPC unauthenticated SSRF5.5CNA v4.00.8%2026-09-15Fix
CVE-2026-54561MCP Memory Keeper context import file path handling path traversal6.2CNA v3.10.2%2026-09-15Fix
CVE-2026-54549pipeboard-co meta-ads-mcp Meta Ads MCP: Server-side request forgery in `upload_ad_image`8.3CNA v3.10.4%2026-09-15Fix
CVE-2026-54547Pipeboard Meta Ads MCP HTTP auth injection middleware improper authentication7.4CNA v3.10.5%2026-09-15Fix
CVE-2026-54544Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints7.2CNA v3.10.4%2026-09-15Fix
CVE-2026-54503plone.app.textfield RichText output sanitization stored cross-site scripting4.3CNA v3.10.4%2026-09-15Fix
CVE-2026-54450Stacklok ToolHive private IP address guard server-side request forgery2.9CNA v4.00.3%2026-09-15Fix
CVE-2026-54337Fireshare has unauthenticated argument injection to arbitrary file write/Overwrite9.8CNA v3.10.6%2026-09-15Exploit codeFix
CVE-2026-54254Cyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites5.9CNA v4.00.5%2026-09-15Fix
CVE-2026-54251netty-incubator-codec-ohttp gateway decryption path memory leak8.7CNA v4.00.5%2026-09-15Fix
CVE-2026-54168Pipelines-as-Code GitHub App installation token missing authorization6.5CNA v3.10.6%2026-09-15Fix
CVE-2026-54167Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise host header8.2CNA v3.10.3%2026-09-15Fix
CVE-2026-54077ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users7.1CNA v3.10.4%2026-09-15Fix
CVE-2026-54076ArcadeDB: Read-only users can mutate database schema (incomplete fix of)8.1CNA v3.10.5%2026-09-15Fix
CVE-2026-54050Sakai Profile Image Deletion has an IDOR6.5CNA v3.10.3%2026-09-15Fix
CVE-2026-53966XWiki Platform: Privilege escalation from edit to script right through Live Data editing7.1CNA v4.00.8%2026-09-15Fix
CVE-2026-53957Contentful MCP Server export_space and import_space tools server-side request forgery7.7CNA v3.10.4%2026-09-15Fix
CVE-2026-53954Bugsink: DOS using large numbers of event tags4.3CNA v3.10.6%2026-09-15Fix
CVE-2026-53941Inspektor Gadget uprobe ld.so.cache parser denial of service6.9CNA v4.00.5%2026-09-15Fix
CVE-2026-53710IBM mcp-context-forge MCP Context Forge: RestrictedPython sandbox bypass10.0CNA v3.11.1%2026-09-15Fix
CVE-2026-53660OpenAM Insecure SSO Cookie Initialization7.4CNA v4.00.4%2026-09-15Fix
CVE-2026-53658hyperledger fabric-ca Fabric CA: LDAP injection via Unescaped Username in GetUser Filter6.3CNA v4.00.5%2026-09-15Fix
CVE-2026-53459Bambuddy authentication authentication bypass9.3CNA v4.00.8%2026-09-15Fix
CVE-2026-52828Kimai: ExportTemplate CRUD missing authorization Check allows Unauthorized TEAMLEAD Access5.3CNA v4.00.5%2026-09-15Fix
CVE-2026-52827Kimai: Two-factor authentication bypass on the Kimai API7.1CNA v4.00.6%2026-09-15Fix
CVE-2026-52826Kimai rate edit endpoints insecure direct object reference5.3CNA v4.00.4%2026-09-15Fix
CVE-2026-52825Kimai team member and activity assignment improper authorization5.3CNA v4.00.4%2026-09-15Fix
CVE-2026-52824Kimai: Default APP_SECRET in Docker Image enables Cookie Forgery and account takeover9.1CNA v4.01.3%2026-09-15NucleiFix
CVE-2026-52823Kimai: Login CSRF in the Timesheet Stop and Restart API endpoints allows Unauthorized State Changes5.3CNA v4.00.3%2026-09-15Fix
CVE-2026-52822Kimai timesheet restart and duplicate improper authorization5.3CNA v4.00.5%2026-09-15Fix
CVE-2026-52821Kimai: Improper authorization5.3CNA v4.00.4%2026-09-15Fix
CVE-2026-52820Kimai timesheet project assignment insecure direct object reference5.3CNA v4.00.4%2026-09-15Fix
CVE-2026-52819Kimai timesheets API incorrect authorization6.3CNA v4.00.5%2026-09-15Fix
CVE-2026-52724Kuma kuma-dp TLS verification improper certificate validation5.8CNA v4.00.4%2026-09-15Fix
CVE-2026-52484MitraStar GPT-2742GX4X5v6-SV device-management-utilities-internet.cgi OS command injection8.8CISA ADP v3.10.6%2026-09-15
CVE-2026-51134C-MOR Video Surveillance show-movies.pml path traversal7.5CISA ADP v3.11.7%2026-09-15Exploit code
CVE-2026-51133za-internet C-MOR Video Surveillance ptzpreset.pml cross-site scripting6.1CISA ADP v3.10.9%2026-09-15Exploit code
CVE-2026-50166Kuma: Kumactl connects to control plane without verifying TLS certificate when no CA is configured5.5CNA v4.00.3%2026-09-15Fix
CVE-2026-50024GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration5.3CNA v3.10.5%2026-09-15Fix
CVE-2026-49446Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel6.1CNA v3.10.3%2026-09-15Fix
CVE-2026-49254Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /API/v1/oauth2.9CNA v4.00.5%2026-09-15Fix
CVE-2026-48987pyLoad: Unbounded Memory Growth leading to DoS and potential DDoS in EventManager6.5CNA v3.10.4%2026-09-15Fix
CVE-2026-48785Apptainer: Incorrect path matching for limit container paths directive4.8CNA v3.10.2%2026-09-15Fix
CVE-2026-48737pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs4.9CNA v3.10.3%2026-09-15Fix
CVE-2026-48722Nextflow: Incorrect default permissions in the nextflow auth login command5.5CNA v3.10.1%2026-09-15Fix
CVE-2026-48717OpenAM OAuth authorization bypass via PKCE Challenge9.1CNA v4.00.5%2026-09-15Fix
CVE-2026-47780free5GC UDR EE subscription handlers improper input validation6.9CNA v4.00.5%2026-09-15
CVE-2026-47426OpenAM OAuth Client Impersonation via JWKS Resolver Cache7.6CNA v4.00.6%2026-09-15Fix
CVE-2026-47424OpenAM authenticated RCE via Groovy sandbox escape7.5CNA v4.00.5%2026-09-15Fix
CVE-2026-47215Singularity: Incorrect path matching for limit container paths directive4.8CNA v3.10.2%2026-09-15Fix
CVE-2026-46623OpenAM account takeover via unverified password change in OAuth2 module7.4CNA v4.00.7%2026-09-15Fix
CVE-2026-46619OpenAM authentication bypass via MSISDN LDAP injection9.3CNA v4.01.0%2026-09-15Fix
CVE-2026-46498OpenAM arbitrary OAuth Token Minting via Push Registration7.6CNA v4.00.4%2026-09-15Fix
CVE-2026-46495OpenDJ Pre-Auth RCE via Java deserialization in JMX RMI9.2CNA v4.01.1%2026-09-15Fix
CVE-2026-46488motionEye: Authentication possible via password hash9.1CNA v4.00.5%2026-09-15Fix
CVE-2026-45794OpenAM Unsafe Java deserialization via SNS7.7CNA v4.00.6%2026-09-15Fix
CVE-2026-45579DIRAC: RCE in RequestManager due to eval on untrusted input9.9CNA v3.10.9%2026-09-15Fix
CVE-2026-45052OpenAM Pre-auth User Profile tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery endpoints9.3CNA v4.00.8%2026-09-15Fix
CVE-2026-45051OpenAM Pre-auth RCE via Java deserialization in WebAuthn Authenticator Storage9.2CNA v4.00.7%2026-09-15Fix
CVE-2026-45048OpenAM authenticated privilege escalation via Raw token disclosure Session RPC8.5CNA v3.10.4%2026-09-15Fix
CVE-2026-44793OpenAM: Pre-authentication reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path7.0CNA v4.00.6%2026-09-15Fix
CVE-2026-44778inspektor-gadget inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF2.9CNA v4.00.6%2026-09-15Fix
CVE-2026-44300OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/injection8.8CNA v4.00.8%2026-09-15Fix
CVE-2026-44282decidim election question titles allow stored script execution4.8CNA v3.10.4%2026-09-15Fix
CVE-2026-44203OpenAM: Pre-auth reflected XSS in OAuth2 / OIDC response_mode=form_post8.3CNA v4.00.6%2026-09-15Fix
CVE-2026-44202OpenAM authenticated server-side request forgery (SSRF) via `/sessionservice`5.3CNA v4.00.4%2026-09-15Fix
CVE-2026-44163fluent-plugin-opentelemetry has denial of service5.3CNA v3.10.4%2026-09-15Fix
CVE-2026-41573OpenAM LDAP injection via `_queryId` parameter7.1CNA v4.00.5%2026-09-15Fix
CVE-2026-40058Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon sensor for Windows8.8CNA v3.10.1%2026-09-15Fix
CVE-2026-39919Ghostscript heap buffer overflow via JPEG 2000 Output Adapter9.3CNA v4.00.8%2026-09-15Fix
CVE-2026-39040BharatMLStack Trufflebox UI expression viewer cross-site scripting5.4CISA ADP v3.10.2%2026-09-15
CVE-2026-39039BharatMLStack Trufflebox UI session storage information disclosure5.3CISA ADP v3.10.4%2026-09-15KCV
CVE-2026-39038BharatMLStack Trufflebox UI numeric table cross-site scripting6.1CISA ADP v3.10.3%2026-09-15KCV
CVE-2026-37152TOTOLINK X5000R hard-coded credentials9.8CISA ADP v3.10.5%2026-09-15
CVE-2026-32599Netmaker has a boolean‑based SQL injection5.3CNA v4.00.4%2026-09-15Fix
CVE-2026-25827Keyfactor SignServer information disclosure2.3CISA ADP v3.10.2%2026-09-15
CVE-2026-25826Keyfactor SignServer PKCS11CryptoToken information disclosure4.9CISA ADP v3.10.4%2026-09-15
CVE-2026-25825Keyfactor SignServer SignerStatusReportWorker path traversal2.7CISA ADP v3.10.3%2026-09-15
CVE-2026-21588Atlassian Confluence Data Center denial of service7.1CNA v4.00.3%2026-09-15Fix
CVE-2026-21587Atlassian Jira Service Management Data Center improper authorization7.1CNA v4.00.3%2026-09-15Fix
CVE-2026-21586Atlassian Confluence Data Center improper authorization7.1CNA v4.00.3%2026-09-15Fix
CVE-2026-19886OriginLab Origin Viewer OGM File Parsing memory corruption remote code execution7.8CNA v3.00.2%2026-09-15
CVE-2026-19885OriginLab Origin Viewer OGWU File Parsing out-of-bounds write remote code execution7.8CNA v3.00.2%2026-09-15
CVE-2026-19781Ashlar-Vellum Cobalt VS File Parsing heap-based buffer overflow remote code execution7.8CNA v3.00.2%2026-09-15
CVE-2026-19780Koha Eval code injection remote code execution8.8CNA v3.00.6%2026-09-15
CVE-2026-19774BlueZ A2DP stack-based buffer overflow remote code execution7.1CNA v3.00.3%2026-09-15Fix
CVE-2026-19773libwebsockets HTTP/2 HPACK Path Header Parsing out-of-bounds write remote code execution9.8CNA v3.00.6%2026-09-15Fix
CVE-2026-19655Arista EOS DHCP relay option 82 handling vulnerability7.1CNA v4.00.2%2026-09-15Fix
CVE-2026-19641Arista EOS password authentication vulnerability6.9CNA v4.00.3%2026-09-15
CVE-2026-19515WSO2 Integrator: MI for Visual Studio Code unit test execution OS command injection7.0CNA v3.10.1%2026-09-15Fix
CVE-2026-19504Fabric.js loadFromJSON server-side request forgery4.0CNA v3.00.1%2026-09-15
CVE-2026-19407GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK7.7CNA v4.00.5%2026-09-15Fix
CVE-2026-18426Concrete CMS Express Form block missing authorization2.0CNA v4.00.2%2026-09-15
CVE-2026-18425Concrete CMS dashboard sitemap reorder missing authorization2.1CNA v4.00.1%2026-09-15
CVE-2026-18424Concrete CMS remote file import server-side request forgery2.1CNA v4.00.2%2026-09-15
CVE-2026-18423Concrete CMS Express saved search presets insecure direct object reference2.1CNA v4.00.2%2026-09-15
CVE-2026-18422Concrete CMS multilingual page assignment missing authorization2.1CNA v4.00.4%2026-09-15
CVE-2026-18421Concrete CMS Boards data source dashboard missing authorization2.1CNA v4.00.3%2026-09-15Fix
CVE-2026-18232WP Directory Kit WordPress plugin unauthenticated Unpublished Listing disclosure via map_infowindow5.3CISA ADP v3.10.2%2026-09-15
CVE-2026-18115Concrete CMS REST API user endpoints missing authorization7.4CNA v4.00.3%2026-09-15Fix
CVE-2026-18113Concrete CMS to is vulnerable to stored XSS in the Top Navigation Bar block7.5CNA v4.00.3%2026-09-15Fix
CVE-2026-18111Concrete CMS user creation and group assignment privilege escalation8.5CNA v4.00.2%2026-09-15
CVE-2026-18110Concrete CMS user selector autocomplete endpoint missing authorization8.7CNA v4.00.3%2026-09-15NucleiExploit code
CVE-2026-18063Job Postings WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-09-15Fix
CVE-2026-17495moment vulnerable to path traversal via crafted non-string locale name5.9CNA v3.10.4%2026-09-15Fix
CVE-2026-16593WP Directory Kit WordPress plugin SQL injection6.8CISA ADP v3.10.2%2026-09-15Fix
CVE-2026-16592WP Directory Kit WordPress plugin Contributor+ Non-Public Listing field disclosure via shortcodes2.7CISA ADP v3.10.2%2026-09-15Fix
CVE-2026-16141OpenBMC IPMI authentication bypass via Default userKey and Stale Challenge Value8.1CNA v3.10.4%2026-09-15
CVE-2026-16140OpenBMC IPMI privilege escalation via Retargeted RAKP 18.8CNA v3.10.3%2026-09-15
CVE-2026-157583D FlipBook WordPress plugin unauthenticated sensitive information exposure in id parameter5.3CNA v3.10.3%2026-09-15Fix
CVE-2026-15640Delinea Secret Server (On-Prem) authentication bypass via SAML Response Manipulation9.5CNA v4.00.3%2026-09-15Fix
CVE-2026-15639Delinea Secret Server (On-Prem) reflected cross-site scripting9.3CNA v4.00.4%2026-09-15Fix
CVE-2026-15638Delinea Secret Server (On-Prem) Cryptographic Padding Oracle9.1CNA v4.00.2%2026-09-15Fix
CVE-2026-15609Bridge - Creative Multipurpose WordPress theme stored cross-site scripting6.4CNA v3.10.2%2026-09-15Fix
CVE-2026-15402Eventin WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-09-15Fix
CVE-2026-14805Consulting - Business, Finance WordPress theme privilege escalation8.8CNA v3.10.3%2026-09-15Fix
CVE-2026-13327Devolutions Server improper certificate validation8.3CISA ADP v3.10.1%2026-09-15
CVE-2026-13210Incorrect authorization in GitLab7.7CNA v3.10.2%2026-09-15Fix
CVE-2026-12910Missing authentication for critical function in GitLab5.4CNA v3.10.2%2026-09-15Fix
CVE-2026-12752Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 20267.1CNA v3.10.4%2026-09-15Fix
CVE-2026-12751IBM Cloud Pak for Business Automation HTML injection5.4CNA v3.10.2%2026-09-15Fix
CVE-2026-12750IBM Cloud Pak for Business Automation web UI stored cross-site scripting6.4CNA v3.10.2%2026-09-15Fix
CVE-2026-12749IBM Cloud Pak for Business Automation web UI stored cross-site scripting6.4CNA v3.10.2%2026-09-15Fix
CVE-2026-12742Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 20265.4CNA v3.10.2%2026-09-15Fix
CVE-2026-12728IBM MQ Java messaging is vulnerable to remote code execution8.8CNA v3.10.4%2026-09-15Fix
CVE-2026-12667IBM MQ .NET client is vulnerable to XML external entity injection7.1CNA v3.10.3%2026-09-15Fix
CVE-2026-12666IBM MQ Java messaging is vulnerable to XML external entity injection8.1CNA v3.10.3%2026-09-15Fix
CVE-2026-12358IBM Verify Identity Access request resource validation uncontrolled recursion7.5CISA ADP v3.10.4%2026-09-15Fix
CVE-2026-12355IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution8.1CNA v3.10.4%2026-09-15Fix
CVE-2026-12354IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution7.5CNA v3.10.3%2026-09-15Fix
CVE-2026-12351IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection9.8CNA v3.10.5%2026-09-15Fix
CVE-2026-12150IBM MQ queue manager is vulnerable to denial of service7.0CNA v3.10.2%2026-09-15Fix
CVE-2026-12101IBM Verify Identity Access authentication bypass8.1CISA ADP v3.10.3%2026-09-15Fix
CVE-2026-11934IBM Verify Identity Access improper authorization7.2CISA ADP v3.10.3%2026-09-15Fix
CVE-2026-11929IBM Verify Identity Access reverse proxy weak cryptographic algorithm7.5CISA ADP v3.10.2%2026-09-15Fix
CVE-2026-11928IBM Verify Identity Access out-of-bounds write9.8CISA ADP v3.10.3%2026-09-15Fix
CVE-2026-11927IBM Verify Identity Access reverse proxy vulnerability6.5CISA ADP v3.10.2%2026-09-15Fix
CVE-2026-11926IBM Verify Identity Access denial of service7.5CISA ADP v3.10.3%2026-09-15Fix
CVE-2026-11921IBM Verify Identity Access management password change insufficiently protected credentials9.1CISA ADP v3.10.2%2026-09-15Fix
CVE-2026-11918IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures5.4CNA v3.10.2%2026-09-15Fix
CVE-2026-11864IBM Cloud Pak for Business Automation XPath injection6.5CNA v3.10.2%2026-09-15Fix
CVE-2026-11729IBM MQ Java messaging is vulnerable to remote code execution8.5CNA v3.10.3%2026-09-15Fix
CVE-2026-11728IBM MQ .NET client is vulnerable to remote code execution8.1CNA v3.10.4%2026-09-15Fix
CVE-2026-10144Rsbuild command injection via openBrowser URL Handling7.1CNA v4.01.6%2026-09-15Fix
CVE-2026-1759Secomea GateManager improper handling of insufficient permissions6.5CNA v3.10.3%2026-09-15
CVE-2026-1758Secomea GateManager session fixation8.3CNA v3.10.2%2026-09-15
CVE-2026-0200Google Android Cellular Modem out-of-bounds write8.8CISA ADP v3.10.3%2026-09-15Fix
CVE-2026-0199Google Android gf_ta_test.c out-of-bounds write7.8CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-0197Google Android VPU information disclosure4.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-0194Google Android multiple locations insecure permissions8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-0192Google Android Bootloader privilege escalation6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-0189Google Android init.c insecure permissions8.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-0187Google Android image-auth-srv.c privilege escalation6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-0186Google Android init.c privilege escalation6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-0183Google Android CPM information disclosure4.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-0179Google Android Bootloader insecure permissions6.7CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-0177Google Android crypto-aes.c out-of-bounds read4.4CISA ADP v3.10.1%2026-09-15Fix
CVE-2026-0171Google Android multiple locations out-of-bounds write8.8CISA ADP v3.10.3%2026-09-15Fix
CVE-2026-0170Google Android vp9hwd_headers.cc out-of-bounds write8.8CISA ADP v3.10.3%2026-09-15Fix
CVE-2026-0159Google Android Cellular Modem out-of-bounds write8.8CISA ADP v3.10.3%2026-09-15Fix
CVE-2026-91201DocsGPT OAuth token disclosure via Wildcard postMessage5.3CNA v4.00.2%2026-09-14
CVE-2026-91200DevSpace path traversal via tar extraction8.7CNA v4.00.7%2026-09-14
CVE-2026-91199Refly server-side request forgery via scrape endpoint5.3CNA v4.00.3%2026-09-14
CVE-2026-91198GrowthBook information disclosure via Public endpoints6.9CNA v4.00.4%2026-09-14
CVE-2026-91197Flowable flowable-engine XXE via ProcessDiagramLayoutFactory7.1CNA v4.00.5%2026-09-14
CVE-2026-91181Mattermost Data Retention Teams endpoint leaks Private Team Invite ID6.5CNA v3.10.4%2026-09-14Fix
CVE-2026-91146Takahe cross-site scripting via javascript: URL Scheme5.3CNA v4.00.3%2026-09-14
CVE-2026-91145Activiti Expression injection via Mail Task7.1CNA v4.00.4%2026-09-14
CVE-2026-91144ZFile Share Entry Filter Bypass via Download endpoint8.7CNA v4.00.5%2026-09-14
CVE-2026-91143goproxy authentication bypass via CONNECT6.9CNA v4.00.5%2026-09-14
CVE-2026-91081Docs SSRF via Unauthenticated cors-proxy endpoint6.9CNA v4.00.4%2026-09-14
CVE-2026-91080webhook memory exhaustion via Oversized Request Body8.7CNA v4.00.7%2026-09-14
CVE-2026-91079hcengineering platform Huly Platform SSRF via Print service6.3CNA v4.00.4%2026-09-14
CVE-2026-91021Trilium Notes webView note share renderer stored cross-site scripting5.4CISA ADP v3.10.2%2026-09-14
CVE-2026-90996Sssd: Sssd: Denial of service in nss responder via crafted zero-length requests4.0CNA v3.10.1%2026-09-14
CVE-2026-90995Sssd: Sssd: Local denial of service due to null pointer dereference in pam responder5.5CNA v3.10.1%2026-09-14
CVE-2026-90994Red Hat Enterprise Linux 10 sssd: Sssd: Denial of service via malformed pam v1 requests4.0CNA v3.10.2%2026-09-14
CVE-2026-90961MISP LdapAuth and LinOTPAuth authentication bypass via Empty or Non-String Credentials9.3CNA v4.00.6%2026-09-14Fix
CVE-2026-90957MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures5.1CNA v4.00.4%2026-09-14Fix
CVE-2026-90955MISP CLI Shell Audit Logs Lose User Identity and CLI Marker after First Lazy Model Load4.6CNA v4.00.2%2026-09-14Fix
CVE-2026-90949GIMP PSP file loader out-of-bounds write7.8CNA v3.10.3%2026-09-14Fix
CVE-2026-90948Red Hat Enterprise Linux 8 gimp: Gimp: Heap-based buffer overflow in ico loader7.8CNA v3.10.2%2026-09-14Fix
CVE-2026-90947Red Hat Enterprise Linux 8 gimp: Gimp: Out-of-bounds write in lighting effects plugin7.8CNA v3.10.1%2026-09-14Fix
CVE-2026-90946DeepWiki-Open through commit d92819a arbitrary file read via /ws/chat WebSocket8.7CNA v4.00.5%2026-09-14
CVE-2026-90945Crawlab authentication bypass via Hard-coded JWT Secret9.3CNA v4.00.8%2026-09-14
CVE-2026-90944Krayin CRM unauthenticated email injection via inbound-parse8.8CNA v4.00.7%2026-09-14
CVE-2026-90943parallax filament-comments stored XSS via Comment Body9.3CNA v4.00.4%2026-09-14
CVE-2026-90942Casdoor Private key exposure via Certificate endpoints9.3CNA v4.00.3%2026-09-14
CVE-2026-90941novel-plus missing authorization on the Admin Book Download endpoint5.3CNA v4.00.4%2026-09-14Fix
CVE-2026-90940novel-plus Default Cache Management Password in the Front portal6.9CNA v4.00.5%2026-09-14Fix
CVE-2026-90939novel-plus missing authorization on the Admin /sys/user/list endpoint7.1CNA v4.00.5%2026-09-14Fix
CVE-2026-90938LangBot Unauthenticated Plugin Registration via WebSocket8.8CNA v4.00.6%2026-09-14Fix
CVE-2026-90937froxlor nginx/Apache Configuration injection via subdomain redirect URL9.4CNA v4.00.5%2026-09-14Fix
CVE-2026-90936Froxlor information disclosure via customer_email.php5.3CNA v4.00.3%2026-09-14Fix
CVE-2026-90935Froxlor authorization bypass via Mysqls.add API5.3CNA v4.00.3%2026-09-14Fix
CVE-2026-90934EspoCRM Field-level Security Bypass via Attendees8.7CNA v4.00.3%2026-09-14Fix
CVE-2026-90933laradashboard missing authorization via License API7.1CNA v4.00.3%2026-09-14
CVE-2026-90932LaraDashboard path traversal RCE8.6CNA v4.00.8%2026-09-14
CVE-2026-90931LaraDashboard stored XSS via SVG upload5.1CNA v4.00.2%2026-09-14
CVE-2026-90930filebrowser File Browser path traversal via Symlink Alias7.6CNA v4.00.5%2026-09-14
CVE-2026-90929filebrowser File Browser Directory Deletion via upload failure Cleanup7.2CNA v4.00.4%2026-09-14Fix
CVE-2026-90928filebrowser file Browser memory exhaustion via subtitle endpoint7.1CNA v4.00.4%2026-09-14
CVE-2026-90927filebrowser denial of service via unbounded WebSocket message7.1CNA v4.00.4%2026-09-14
CVE-2026-90919LightLLM unauthenticated remote code execution via Config Server Pickle deserialization9.3CNA v4.01.1%2026-09-14
CVE-2026-90898Bifrost unauthenticated remote code execution via MCP stdio client registration9.8CNA v3.12.3%2026-09-14Reported exploitedNucleiFix
CVE-2026-90896MarcosCamara01 Ecommerce Template checkout session lookup handler missing authentication8.2CNA v4.00.7%2026-09-14Fix
CVE-2026-90895MISP Interactive CLI Shell: Authorization bypass, credential exposure, and Terminal injection8.4CNA v4.00.1%2026-09-14Fix
CVE-2026-90894Parallels Desktop local privilege escalation via appliance extract argument injection7.8CNA v3.10.2%2026-09-14Fix
CVE-2026-90893MISP UserSettingsController cross-site request forgery5.1CNA v4.00.3%2026-09-14Fix
CVE-2026-90891ASRock｜ASRock Polychrome SYNC/RGB software utility improper access control6.8CNA v4.00.1%2026-09-14Fix
CVE-2026-90890ASRock｜ASRock Polychrome SYNC/RGB software utility untrusted pointer dereference6.8CNA v4.00.1%2026-09-14Fix
CVE-2026-90842PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file6.3CNA v4.00.3%2026-09-14
CVE-2026-90841PHPGurukul Blood Donor Management System Report Endpoint Report.php SQL injection6.9CNA v4.00.4%2026-09-14
CVE-2026-90840PHPGurukul Blood Donor Management System admin dashboard controller improper authentication6.9CNA v4.00.7%2026-09-14
CVE-2026-90835michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross-site scripting5.1CNA v4.00.3%2026-09-14
CVE-2026-90831GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_delref memory corruption4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90830GNU Binutils Section Merge merge.c _bfd_write_merged_section null pointer dereference4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90829GNU Binutils SHT_GROUP Section elf.c bfd_elf_set_group_contents null pointer dereference4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90828GNU Binutils ELF Orphan Section ldelf.c elf_orphan_compatible null pointer dereference6.6v3.10.2%2026-09-14Fix
CVE-2026-90827GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use-after-free4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90826GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds2.4CNA v4.00.2%2026-09-14Fix
CVE-2026-90825GPAC MP4Box base_scenegraph.c gf_node_unregister use-after-free4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90824GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90820a2aproject a2a-java authorization request handler missing authorization5.3CNA v4.00.4%2026-09-14Fix
CVE-2026-90819a2aproject a2a-java authorization header construction HTTP response splitting6.9CNA v4.00.7%2026-09-14Fix
CVE-2026-90818netease-youdao LobsterAI browser network configuration server-side request forgery5.3CNA v4.00.5%2026-09-14
CVE-2026-90816FFmpeg Duration hlsproto.c parse_playlist denial of service5.3CNA v4.00.6%2026-09-14Fix
CVE-2026-90815FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of-bounds5.3CNA v4.00.4%2026-09-14Fix
CVE-2026-90814cosmicstack-labs mercury-agent GitHub API github.ts githubRequest server-side request forgery5.3CNA v4.00.4%2026-09-14
CVE-2026-90813cosmicstack-labs mercury-agent shell command execution vulnerability5.3CNA v4.00.6%2026-09-14
CVE-2026-90812cosmicstack-labs mercury-agent shell command permission vulnerability5.3CNA v4.00.4%2026-09-14
CVE-2026-90811cosmicstack-labs mercury-agent shell permission manifest information disclosure4.8CNA v4.00.1%2026-09-14
CVE-2026-90810cosmicstack-labs mercury-agent shell command permission check improper authorization5.3CNA v4.00.4%2026-09-14
CVE-2026-90809HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection6.9CNA v4.00.6%2026-09-14
CVE-2026-90808HKUDS nanobot ExecTool shell.py ExecTool._spawn incomplete blacklist5.3CNA v4.00.4%2026-09-14
CVE-2026-90807nanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link following5.3CNA v4.00.4%2026-09-14
CVE-2026-90806DjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization5.3CNA v4.00.4%2026-09-14Fix
CVE-2026-90805subhajitkhan online-clinic-management-system doctorlogin.php SQL injection6.9CNA v4.00.4%2026-09-14
CVE-2026-90804GNU Binutils Eh Frame Section elf-eh-frame.c _bfd_elf_write_section_eh_frame buffer overflow6.1v3.10.2%2026-09-14Fix
CVE-2026-90803GNU Binutils ld elf64-x86-64.c elf_x86_64_relocate_section buffer overflow6.8v3.10.2%2026-09-14Fix
CVE-2026-90802GNU Binutils ld libbfd.c bfd_putl64 null pointer dereference4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90801GNU Binutils ld cache.c cache_bwrite buffer overflow6.6v3.10.2%2026-09-14Fix
CVE-2026-90796itsourcecode Leave Management System index.php SQL injection5.3CNA v4.00.3%2026-09-14
CVE-2026-90795itsourcecode Loan Management System navbar.php cross-site scripting5.3CNA v4.00.5%2026-09-14
CVE-2026-90794GPAC MP4Box vrml_tools.c gf_sg_script_load use-after-free5.3CNA v4.00.5%2026-09-14Fix
CVE-2026-90793GPAC MP4Box base_scenegraph.c gf_node_get_name use-after-free5.3CNA v4.00.6%2026-09-14Fix
CVE-2026-90792GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference5.3CNA v4.00.7%2026-09-14Fix
CVE-2026-90791GPAC MP4Box base_scenegraph.c gf_node_unregister use-after-free5.3CNA v4.00.5%2026-09-14Fix
CVE-2026-90790a2aproject a2a-python push notification sender server-side request forgery5.3CNA v4.00.4%2026-09-14Fix
CVE-2026-90789itsourcecode Leave Management System login.php SQL injection6.9CNA v4.00.4%2026-09-14
CVE-2026-90788magicblack MacCMS10 template .%40template%40default%40html%40label.html os command injection5.1CNA v4.02.2%2026-09-14
CVE-2026-90787Soarkey StudentManagement registration workflow privilege escalation6.9CNA v4.00.5%2026-09-14
CVE-2026-90786Dvidelabs flatcc Duplicate Symbol semantics.c align_order_members assertion6.9CNA v4.00.7%2026-09-14
CVE-2026-90785Dvidelabs flatcc Struct Analysis semantics.c analyze_struct assertion6.9CNA v4.00.7%2026-09-14
CVE-2026-90784Dvidelabs flatcc semantics.c fb_clear_parser memory leak6.9CNA v4.00.7%2026-09-14
CVE-2026-90716marcobambini Gravity Number gravity_parser.c parse_number_expression out-of-bounds5.1CNA v4.00.4%2026-09-14Fix
CVE-2026-90715marcobambini Gravity udp json-parser gravity_json.c integer overflow6.9CNA v4.00.6%2026-09-14Fix
CVE-2026-90714marcobambini Gravity JSON parser gravity_json.c memory corruption5.3CNA v4.00.5%2026-09-14Fix
CVE-2026-90713Vllm-project vLLM tiktoken vocab file mod.rs new denial of service4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90712Gitlawb openclaude xAI OAuth Callback xaiOAuthCallback.ts waitForCallback denial of service5.3CNA v4.00.6%2026-09-14
CVE-2026-90710taisan tarzan-cms theme download function server-side request forgery6.9CNA v4.00.5%2026-09-14
CVE-2026-90709Yot CMS Admin console admin.php eval code injection5.1CNA v4.00.4%2026-09-14
CVE-2026-90708Yot CMS Cookie global.php login SQL injection6.9CNA v4.00.4%2026-09-14
CVE-2026-90707Open5GS AMF discovery fallback use-after-free6.9CNA v4.00.5%2026-09-14
CVE-2026-90706D-Link DWR-M921 formWsc os command injection5.1CNA v4.02.3%2026-09-14
CVE-2026-90705D-Link DWR-M921 Boa Dispatch Table formsysCmd os command injection5.1CNA v4.02.3%2026-09-14
CVE-2026-90704D-Link DWR-M921 formDiskPartition system command injection5.1CNA v4.02.3%2026-09-14
CVE-2026-90703D-Link DWR-M921 formDiskCreateShare system os command injection9.4CNA v4.03.6%2026-09-14Fix
CVE-2026-90702D-Link DWR-M921 formDiskFormat system os command injection9.4CNA v4.03.6%2026-09-14Fix
CVE-2026-90701subhajitkhan online-clinic-management-system listdoctor.php SQL injection6.9CNA v4.00.4%2026-09-14
CVE-2026-90700itsourcecode Sales and Inventory System pro_edit1.php SQL injection5.3CNA v4.00.3%2026-09-14
CVE-2026-90699D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection9.4CNA v4.03.3%2026-09-14Fix
CVE-2026-90698memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-bounds6.9CNA v4.00.9%2026-09-14Fix
CVE-2026-90697SourceCodester Inventory Management System invoice.php authorization5.3CNA v4.00.4%2026-09-14
CVE-2026-90696SourceCodester Inventory Management System product management cross-site scripting5.1CNA v4.00.3%2026-09-14
CVE-2026-90695SourceCodester Inventory Management System vendor management cross-site scripting5.1CNA v4.00.3%2026-09-14
CVE-2026-90694SourceCodester Inventory Management System customer management cross-site scripting5.1CNA v4.00.3%2026-09-14
CVE-2026-90693D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow9.4CNA v4.00.9%2026-09-14
CVE-2026-90692D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow9.4CNA v4.00.9%2026-09-14
CVE-2026-906910x4m4 HexStrike AI API files endpoint hexstrike_server.py FileOperationsManager path traversal6.9CNA v4.00.6%2026-09-14
CVE-2026-906900x4m4 HexStrike AI API tools endpoint hexstrike_server.py subprocess.Popen os command injection6.9CNA v4.02.1%2026-09-14
CVE-2026-90689Tenda W20E formDelWebAuthWhiteUser stack-based overflow8.7CNA v4.00.9%2026-09-14
CVE-2026-90688Tenda W20E HTTP formIPMacBindAdd stack-based overflow7.1CNA v4.00.7%2026-09-14
CVE-2026-90687GPAC MP4Box base_scenegraph.c gf_node_changed_internal use-after-free5.3CNA v4.00.5%2026-09-14Fix
CVE-2026-90686GPAC MP4Box loader_bt.c gf_bt_report memory corruption6.9CNA v4.00.9%2026-09-14Fix
CVE-2026-90685GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion2.4CNA v4.00.2%2026-09-14Fix
CVE-2026-90684GPAC MP4Box base_scenegraph.c gf_node_get_field_count assertion2.4CNA v4.00.2%2026-09-14Fix
CVE-2026-90683GPAC MP4Box base_scenegraph.c gf_node_unregister assertion4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90682Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo heap-based overflow4.8CNA v4.00.2%2026-09-14
CVE-2026-90681Matthias-Wandel jhead EXIF Parsing exif.c Get16u out-of-bounds4.8CNA v4.00.2%2026-09-14
CVE-2026-90680D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow9.4CNA v4.00.9%2026-09-14
CVE-2026-90623andreashappe cochise SSH Host Key ssh_connection.py asyncssh.connect certificate validation6.3CNA v4.00.3%2026-09-14
CVE-2026-90622GNU LibreDWG Layer Encoding dwg.spec DWG_TABLE null pointer dereference4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90621ipa-lab HackingBuddyGPT ssh_run_command.py ssh_run_command os command injection5.3CNA v4.01.8%2026-09-14
CVE-2026-906200x4m4 HexStrike AI API command endpoint hexstrike_server.py missing authentication6.9CNA v4.00.7%2026-09-14
CVE-2026-906190x4m4 HexStrike AI Execute endpoint hexstrike_server.py os command injection6.9CNA v4.02.1%2026-09-14
CVE-2026-90618GH05TCREW PentestAgent LocalRuntime runtime.py LocalRuntime.execute_command os command injection6.9CNA v4.02.1%2026-09-14
CVE-2026-90617GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection6.9CNA v4.02.1%2026-09-14
CVE-2026-90615SourceCodester Class and Exam Timetabling System subject1.php cross-site scripting5.3CNA v4.00.5%2026-09-14
CVE-2026-90614FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization5.3CNA v4.00.4%2026-09-14
CVE-2026-90613GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertion4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90612GPAC MP4Box scene_dump.c gf_sm_dump_command_list assertion4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90611GPAC MP4Box loader_xmt.c xmt_parse_element assertion4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90610GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90609GPAC MP4Box vrml_tools.c null pointer dereference4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-90608Totolink A3002MU boa formPortFw buffer overflow9.4CNA v4.00.9%2026-09-14
CVE-2026-90607Totolink A3002MU boa formNewSchedule buffer overflow9.4CNA v4.00.9%2026-09-14
CVE-2026-90463Red Hat Enterprise Linux 10 sssd: Local OOB read in nss service request parsers4.0CNA v3.10.2%2026-09-14
CVE-2026-89321Eclipse Open VSX decompression bomb4.3CNA v3.10.4%2026-09-14Fix
CVE-2026-89180Thinking Software Technology｜EFence SQL injection8.7CNA v4.00.6%2026-09-14Fix
CVE-2026-89023ThemeAtelier Domain For Sale missing authorization via REST API8.8CNA v4.00.4%2026-09-14Fix
CVE-2026-89021MikroTik RouterOS path traversal via Container OCI/tar Image Extraction6.9CNA v4.00.4%2026-09-14Fix
CVE-2026-89020MikroTik RouterOS stack buffer overflow via TFTP URL Path5.3CNA v4.00.5%2026-09-14Fix
CVE-2026-88932multer vulnerable to denial of service via orphaned disk writes on aborted uploads5.3CNA v3.10.5%2026-09-14Fix
CVE-2026-88853Joomla extension regularlabs.com Privileged stored XSS7.5CNA v4.00.4%2026-09-14
CVE-2026-88852Joomla extension regularlabs.com Privileged stored XSS7.5CNA v4.00.4%2026-09-14
CVE-2026-88819Eclipse Data Plane Core authentication bypass by spoofing6.3CNA v4.00.2%2026-09-14
CVE-2026-87802Apache Syncope: SRA OAuth2 JWT signature verification bypass9.1CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-87785Apache Syncope: JWT subject spoofing9.1CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-87779Apache Syncope: AES Secret key disclosure via log output7.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-86924Apple macOS memory corruption5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86917Apple macOS improper handling of insufficient permissions7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86911Apple macOS clickjacking5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86910Apple macOS path traversal5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86909Apple macOS logic flaw4.4CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86905Apple macOS improper access control5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-86904Apple watchOS personal information exposure7.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-86903Apple macOS out-of-bounds read5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86902Apple macOS path traversal5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86901Apple macOS out-of-bounds write7.1CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86900Apple macOS out-of-bounds read6.5CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-86898Apple Safari cross-site scripting5.4CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86897Apple Safari missing authorization5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86895Apple tvOS information disclosure7.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-86894Apple macOS logic flaw7.5CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-86893Apple tvOS improper privilege management3.3CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-86892Apple visionOS resource exhaustion5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86891Apple macOS improper authorization3.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86890Apple iOS and iPadOS improper authentication4.6CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86889Apple macOS improper certificate validation4.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86888Apple macOS improper privilege management3.3CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-86887Apple visionOS information disclosure3.3CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86886Apple watchOS path traversal5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86885Apple iOS and iPadOS improper input validation6.5CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-86884Apple macOS improper privilege management5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-86883Apple visionOS information disclosure5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86882Apple macOS out-of-bounds write6.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-86881Apple macOS improper certificate validation9.1CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-86879Apple iOS and iPadOS denial of service6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-86878Apple iOS and iPadOS insecure permissions5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86876Apple macOS out-of-bounds write5.2CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-86870Apple macOS heap-based buffer overflow6.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-86869Apple macOS out-of-bounds write6.5CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-86836Eclipse Ankaios incorrect default permissions8.4CNA v4.00.1%2026-09-14
CVE-2026-86830Incorrect privilege assignment in Temporary Elevated Access Management for AWS IAM Identity Center8.6CNA v4.00.7%2026-09-14Fix
CVE-2026-86460Apache Syncope: Cypher injection via FIQL Search on Neo4j Persistence9.8CISA ADP v3.10.6%2026-09-14Fix
CVE-2026-86349Mattermost Server Algorithmic DoS via Unbounded Markdown Block Nesting4.3CNA v3.10.4%2026-09-14Fix
CVE-2026-86348Mattermost MS Calendar plugin denial of service4.3CNA v3.10.4%2026-09-14Fix
CVE-2026-85921Microsoft Windows Secure Kernel Mode elevation of privilege8.2CNA v3.10.3%2026-09-14Fix
CVE-2026-85892Microsoft Edge (Chromium-based) elevation of privilege7.8CNA v3.10.2%2026-09-14Fix
CVE-2026-85196Articles Anywhere and Users Anywhere for Joomla cross-site scripting5.3CNA v4.00.4%2026-09-14
CVE-2026-85195Joomla extension regularlabs.com Privileged stored XSS7.5CNA v4.00.4%2026-09-14
CVE-2026-85192Conditional Content Pro extension for Joomla code injection9.4CNA v4.00.7%2026-09-14
CVE-2026-85191Joomla extension regularlabs.com Privileged stored XSS7.5CNA v4.00.4%2026-09-14
CVE-2026-85190Joomla extension regularlabs.com Privileged stored XSS7.5CNA v4.00.4%2026-09-14
CVE-2026-85189Joomla extension regularlabs.com Privileged stored XSS7.5CNA v4.00.4%2026-09-14
CVE-2026-85188Joomla extensions Conditions editor information disclosure6.9CNA v4.00.4%2026-09-14
CVE-2026-85125YAMAP -Social Trekking GPS App improper verification of communication source5.1CNA v4.00.3%2026-09-14
CVE-2026-84636Apple tvOS improper authorization5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84635Apple Safari type confusion6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84632Apple macOS buffer overflow7.3CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84631Apple macOS improper handling of insufficient permissions7.8CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84630Apple macOS race condition4.7CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84629Apple tvOS missing authorization7.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84628Apple macOS incorrect authorization5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84626Apple macOS information disclosure3.3CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84625Apple macOS insecure permissions9.1CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-84624Apple macOS path traversal5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84623Apple iOS and iPadOS improper authentication7.5CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-84622Apple macOS uninitialized resource use6.2CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84621Apple macOS improper authorization5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84620Apple macOS integer overflow7.3CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84619Apple macOS out-of-bounds write6.1CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84618Apple macOS incorrect authorization5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84617Apple macOS incorrect authorization5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84616Apple macOS confused deputy5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84615Apple tvOS improper authorization5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84612Apple macOS incorrect authorization5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84611Apple macOS out-of-bounds write7.3CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84609Apple macOS buffer overflow9.8CISA ADP v3.10.7%2026-09-14Fix
CVE-2026-84607Apple macOS race condition7.8CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84606Apple macOS improper authentication7.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84603Apple visionOS improper privilege management5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84602Apple macOS type confusion5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84601Apple macOS incorrect authorization5.5v3.10.1%2026-09-14Fix
CVE-2026-84600Apple macOS improper authorization5.4CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-84598Apple iOS and iPadOS path traversal7.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-84597Apple macOS out-of-bounds read6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84596Apple macOS out-of-bounds read6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84593Apple iOS and iPadOS use-after-free5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84589Apple macOS incorrect authorization5.5v3.10.1%2026-09-14Fix
CVE-2026-84588Apple macOS out-of-bounds write6.5CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-84587Apple macOS improper privilege management5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84586Apple macOS information disclosure5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84585Apple macOS insecure permissions5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84584Apple macOS link following8.4v3.10.1%2026-09-14Fix
CVE-2026-84583Apple macOS insecure permissions5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84581Apple macOS buffer overflow8.4CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84580Apple macOS missing authorization8.4v3.10.1%2026-09-14Fix
CVE-2026-84578Apple macOS logic flaw8.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84577Apple macOS buffer overflow8.2CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84576Apple macOS information disclosure5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84575Apple macOS out-of-bounds write7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84574Apple macOS insecure permissions4.4CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84573Apple macOS information disclosure5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84572Apple macOS out-of-bounds read7.1CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84571Apple macOS buffer overflow4.3CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84570Apple macOS logic flaw4.4CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84569Apple macOS missing authorization5.5v3.10.1%2026-09-14Fix
CVE-2026-84568Apple macOS path traversal7.8CISA ADP v3.10.2%2026-09-14Exploit codeFix
CVE-2026-84567Apple macOS use-after-free5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84566Apple macOS denial of service7.8v3.10.2%2026-09-14Fix
CVE-2026-84565Apple macOS out-of-bounds read7.1v3.10.1%2026-09-14Fix
CVE-2026-84564Apple macOS uninitialized variable use4.3CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84563Apple macOS type confusion7.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84562Apple macOS race condition4.7CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84561Apple macOS double free9.8CISA ADP v3.10.7%2026-09-14Fix
CVE-2026-84560Apple macOS incorrect authorization6.1CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84559Apple macOS insecure permissions5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84558Apple macOS double free5.5v3.10.1%2026-09-14Fix
CVE-2026-84556Apple macOS improper authorization5.5v3.10.1%2026-09-14Fix
CVE-2026-84555Apple macOS information disclosure5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84554Apple macOS integer overflow5.9CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-84553Apple macOS resource exhaustion7.5CISA ADP v3.10.7%2026-09-14Fix
CVE-2026-84552Apple macOS out-of-bounds read5.5v3.10.2%2026-09-14Fix
CVE-2026-84551Apple macOS missing authorization4.4v3.10.1%2026-09-14Fix
CVE-2026-84550Apple macOS race condition4.7v3.10.1%2026-09-14Fix
CVE-2026-84549Apple macOS out-of-bounds read7.5v3.10.6%2026-09-14Fix
CVE-2026-84548Apple macOS integer overflow7.1v3.10.1%2026-09-14Fix
CVE-2026-84546Apple macOS out-of-bounds write8.4CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84544Apple macOS integer overflow7.5v3.10.4%2026-09-14Fix
CVE-2026-84543Apple macOS out-of-bounds read7.5CISA ADP v3.10.4%2026-09-14Exploit codeFix
CVE-2026-84541Apple macOS path traversal5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84540Apple macOS incorrect authorization5.5NVD v3.10.1%2026-09-14Fix
CVE-2026-84538Apple macOS denial of service6.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-84537Apple macOS denial of service6.6CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84536Apple macOS integer overflow6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84535Apple macOS sandbox escape8.2CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84534Apple macOS path traversal5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84533Apple macOS missing integrity check5.3v3.10.1%2026-09-14Fix
CVE-2026-84532Apple macOS out-of-bounds read5.4CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84531Apple macOS out-of-bounds write6.2CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84530Apple macOS information disclosure3.3CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84527Apple macOS sensitive information in log files5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84526Apple macOS out-of-bounds write4.3CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84525Apple macOS sensitive information in log files5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84524Apple macOS out-of-bounds read4.3CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84523Apple macOS out-of-bounds write5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84522Apple macOS race condition5.9v3.10.2%2026-09-14Fix
CVE-2026-84521Apple macOS use-after-free5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84520Apple macOS buffer overflow9.8CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84519Apple macOS out-of-bounds write6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84518Apple Safari external control of critical state data4.3CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-84517Apple macOS integer overflow5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84516Apple macOS out-of-bounds read8.1CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84515Apple macOS out-of-bounds write7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84514Apple macOS missing authorization5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84513Apple macOS sensitive information in log files5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84512Apple macOS buffer overflow8.8CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-84511Apple macOS out-of-bounds write7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84510Apple macOS heap-based buffer overflow6.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-84509Apple macOS out-of-bounds read6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-84507Apple macOS race condition7.8CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84506Apple macOS use-after-free7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84505Apple macOS out-of-bounds write7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84497Apple macOS buffer overflow7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84492Apple macOS race condition4.7CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84491Apple macOS insecure permissions5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-84489Apple macOS buffer overflow5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-84487Apple macOS integer overflow6.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-84445gRPC-Go: Denial of service8.7CNA v4.00.6%2026-09-14Fix
CVE-2026-84179Apache Storm topology page API information disclosure6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-82920Mattermost ABAC parent policy bypass via policy update endpoint5.5CNA v3.10.3%2026-09-14Fix
CVE-2026-82796Contec SV-CPT-MC310 cross-site scripting5.1CNA v4.00.2%2026-09-14Fix
CVE-2026-82795Contec SV-CPT-MC310 cross-site scripting5.1CNA v4.00.2%2026-09-14Fix
CVE-2026-82794Contec SV-CPT-MC310 OS command injection8.7CNA v4.01.9%2026-09-14Fix
CVE-2026-82793Contec CAN-2-WF unrestricted file upload8.6CNA v4.00.6%2026-09-14Fix
CVE-2026-82792Contec CAN-2-WF cross-site scripting4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-82791Contec CAN-2-WF OS command improper neutralization8.7CNA v4.01.9%2026-09-14Fix
CVE-2026-82790Contec PC-HELPER Wireless I/O DIO-0404RY-LWF-US cross-site scripting4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-82789Contec CONPROSYS HMI System (CHS) dynamically evaluated code improper neutralization8.7CNA v4.00.5%2026-09-14Fix
CVE-2026-82788Contec CPSL-08P1EN cross-site scripting5.1CNA v4.00.3%2026-09-14Fix
CVE-2026-82787Contec CPSL-08P1EN missing authentication8.7CNA v4.00.7%2026-09-14Fix
CVE-2026-82786Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* insufficiently protected credentials8.2CNA v4.00.3%2026-09-14Fix
CVE-2026-82785Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* stack-based buffer overflow5.3CNA v4.00.5%2026-09-14Fix
CVE-2026-82784Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* missing authentication6.9CNA v4.00.3%2026-09-14Fix
CVE-2026-82783Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* plaintext password storage4.1CNA v4.00.2%2026-09-14Fix
CVE-2026-82782Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* CONPROSYS nano Series out-of-bounds write5.3CNA v4.00.5%2026-09-14Fix
CVE-2026-82781Contec Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* cross-site scripting5.1CNA v4.00.2%2026-09-14Fix
CVE-2026-82780Contec CPS-TM341G5MB-ADSC1-931 CONPROSYS TM Series unrestricted file upload8.7CNA v4.00.6%2026-09-14Fix
CVE-2026-82779Contec CPS-TM341G5MB-ADSC1-931 OS command improper neutralization8.7CNA v4.01.9%2026-09-14Fix
CVE-2026-82778Contec Integrated Type CPS-PC341[][]-*-9201 CONPROSYS PAC Series directory listing5.3CNA v4.00.4%2026-09-14Fix
CVE-2026-82777Contec Integrated Type CPS-PC341[][]-*-9201 OS command improper neutralization8.7CNA v4.01.9%2026-09-14Fix
CVE-2026-82776Contec Integrated Type CPS-PC341[][]-*-9201 CONPROSYS PAC Series cross-site scripting5.1CNA v4.00.3%2026-09-14Fix
CVE-2026-82775Contec M2M Gateway Integrated Type CPS-MG341* An directory listing5.3CNA v4.00.4%2026-09-14Fix
CVE-2026-82774Contec M2M Gateway Integrated Type CPS-MG341* OS command improper neutralization8.7CNA v4.01.9%2026-09-14Fix
CVE-2026-82773Contec M2M Gateway Integrated Type CPS-MG341* cross-site scripting5.1CNA v4.00.3%2026-09-14Fix
CVE-2026-82772Contec ECE1000 buffer overflow8.7CNA v4.00.7%2026-09-14Fix
CVE-2026-82771Contec ECE1000 cross-site scripting4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-82770Contec RP-WAH-SR1 buffer overflow8.7CNA v4.00.7%2026-09-14Fix
CVE-2026-82769Contec RP-WAH-SR1 cross-site scripting4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-82768Contec SGA1000 path traversal8.6CNA v4.00.5%2026-09-14Fix
CVE-2026-82767Contec SGA1000 cross-site scripting4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-82766Contec SGA1000 OS command improper neutralization8.7CNA v4.01.9%2026-09-14Fix
CVE-2026-82765Contec FXA5000 path traversal8.6CNA v4.00.5%2026-09-14Fix
CVE-2026-82764Contec FXA5000 multiple cross-site request forgery5.1CNA v4.00.2%2026-09-14Fix
CVE-2026-82763Contec FXA5000 cross-site scripting4.8CNA v4.00.2%2026-09-14Fix
CVE-2026-82762Contec FXA5000 OS command improper neutralization8.7CNA v4.01.9%2026-09-14Fix
CVE-2026-82519Really Simple Security authorization bypass via profile-page update handler2.3CNA v4.00.4%2026-09-14Fix
CVE-2026-82441Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster denial of service9.1CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-82439Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC9.8CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-82438Apache Storm Webapp: Authenticated API Responses Exposed to arbitrary Web Origins8.1CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-82437Apache Storm Logviewer: Log Access Controls not Enforced by Logviewer4.3CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-82435Apache Storm Worker: Unauthenticated remote memory exhaustion in the Worker Messaging Decoder9.8CISA ADP v3.10.7%2026-09-14Fix
CVE-2026-82434Apache Storm Nimbus topology configuration information disclosure10.0CNA v4.00.5%2026-09-14Fix
CVE-2026-82433Apache Storm Nimbus configuration API vulnerability6.5CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-82432Apache Storm Nimbus: Blobstore authorization bypass via Rebalance Configuration Overrides8.1CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-82431Apache Storm Client: Authorization bypass when nimbus.groups is Configured without nimbus.users9.8CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-82430Apache Storm Worker Launcher: Local privilege escalation to Root7.8CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-82429Apache Storm Worker Launcher: Local privilege escalation to Root7.8CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-82428Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys8.8CISA ADP v3.10.7%2026-09-14Fix
CVE-2026-82427Apache Storm Nimbus: Path traversal as the Supervisor User via Unsanitised Blobstore Map Local Name7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-82426Apache Storm Nimbus: Arbitrary file read on Nimbus via Unvalidated Uploaded Jar Location6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-82232Apache Syncope: SQL injection via sort parameter in Task search9.8CISA ADP v3.10.6%2026-09-14Fix
CVE-2026-82049Python CPython tarfile extraction filters link following8.4CNA v4.00.2%2026-09-14Fix
CVE-2026-82035PyMuPDF path traversal via extract_objects Font Branch7.1CNA v4.00.3%2026-09-14Fix
CVE-2026-82028Magistrala SQL injection via format parameter in Reader API8.7CNA v4.00.6%2026-09-14Fix
CVE-2026-82019TripleLift video-bundle.js DOM-based XSS via postMessage2.3CNA v4.00.3%2026-09-14Fix
CVE-2026-81903Concrete CMS to is vulnerable to stored XSS via Page Container icon7.0CNA v4.00.3%2026-09-14
CVE-2026-81902Concrete CMS to is vulnerable to CSRF on Orphan Block Cleanup7.1CNA v4.00.2%2026-09-14
CVE-2026-81901Concrete CMS page update API endpoint missing authorization7.2CNA v4.00.4%2026-09-14
CVE-2026-81900Concrete CMS is vulnerable to stored XSS in the YouTube block (vWidth/vHeight)7.3CNA v4.00.3%2026-09-14
CVE-2026-81566Joomla extension joomshaper.com missing access control in Menu Item Creation in SP Page Builder5.1CNA v4.00.4%2026-09-14
CVE-2026-81565Joomla extension joomshaper.com Missing Directory Confinement in Media upload in SP Page Builder6.9CNA v4.00.5%2026-09-14
CVE-2026-81564JoomShaper SP Page Builder media rename path traversal7.0CNA v4.00.5%2026-09-14
CVE-2026-81301Ekia File Manager Exported ContentProvider allows unauthorized file access8.5CNA v4.00.2%2026-09-14
CVE-2026-79701joomshaper.com SP Page Builder Pro Contact, Opt-in and Form Builder addons vulnerability6.9CNA v4.00.5%2026-09-14
CVE-2026-79700JoomShaper SP Page Builder Pro opt-in form addon vulnerability6.9CNA v4.00.5%2026-09-14
CVE-2026-78415IBM Sterling Secure Proxy cross-site scripting5.4CNA v3.10.3%2026-09-14Fix
CVE-2026-78375joomshaper.com SP Page Builder content plugin SQL injection8.6CNA v4.00.4%2026-09-14
CVE-2026-78336Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user7.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-78330Apache Syncope: Privilege escalation for admin user via JWT authentication9.8CISA ADP v3.10.6%2026-09-14Fix
CVE-2026-78318Apache Syncope: Unauthenticated reflected XSS in console and Enduser6.1CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-78299Eclipse Embedded CDT (C/C++ Development Tools) path traversal9.1CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-77884Gallery Private Photo Vault Unauthenticated local-network HTTP file exposure7.1CNA v4.00.3%2026-09-14
CVE-2026-77883Apache Syncope: Information disclosure4.9CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-77191Arista EOS 802.1X ACL enforcement vulnerability2.1CNA v4.00.2%2026-09-14
CVE-2026-77181Apache Syncope: ClientApp update entitlement not effective9.8CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-77147Apache Syncope: Groovy sandbox escape for empty CommandArgs6.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-77051Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search9.8CISA ADP v3.10.6%2026-09-14Fix
CVE-2026-76461Cisco Secure Email Gateway SQL injection9.8CNA v3.129.5%2026-09-14KEVExploit codeFix
CVE-2026-76443Cisco Secure Email Gateway Security Hardening Release9.8CNA v3.10.5%2026-09-14Fix
CVE-2026-76442Cisco Secure Email Gateway Security Hardening Release7.5CNA v3.10.5%2026-09-14Fix
CVE-2026-76441Cisco Secure Email Gateway Security Hardening Release9.8CNA v3.10.5%2026-09-14Fix
CVE-2026-76440Cisco Secure Email Gateway Security Hardening Release9.8CNA v3.10.6%2026-09-14Fix
CVE-2026-76081ZITADEL: Improper Role Revocation on Granted Projects during multiple Role Deletions5.5CNA v3.10.4%2026-09-14Fix
CVE-2026-75945Arista Networks EOS dot1x race condition2.1CNA v4.00.2%2026-09-14
CVE-2026-75944Arista Networks EOS AclAgent race condition5.6CNA v4.00.2%2026-09-14
CVE-2026-75943Arista Networks EOS dot1x vulnerability2.1CNA v4.00.2%2026-09-14
CVE-2026-75792IBM Sterling Secure Proxy administrative interface improper authorization4.3CNA v3.10.4%2026-09-14Fix
CVE-2026-75030Apache Syncope: Incomplete authorization checks for Group members deprovisioning9.8CISA ADP v3.10.6%2026-09-14Fix
CVE-2026-75015Apache Syncope: Nested secrets leak cleartext into audit records readable4.9CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-73668Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values9.8CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-73579Apache Syncope: Non-recursive Any search could skip Realms restrictions9.8CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-73497sooperset mcp-atlassian MCP Atlassian: DNS-rebinding TOCTOU bypass of the SSRF fix6.5CNA v3.10.4%2026-09-14Fix
CVE-2026-73496sooperset mcp-atlassian MCP Atlassian: Arbitrary server-side file read via attachment upload7.7CNA v3.10.5%2026-09-14Fix
CVE-2026-73494http4s blaze HTTP/1.1 wire parser HTTP request smuggling7.4CNA v3.10.6%2026-09-14Fix
CVE-2026-73470Apache Syncope: Delegating users can grant unowned Roles9.8CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-73449Arista EOS RADIUS proxy dynamic authorization vulnerability5.9CNA v4.00.2%2026-09-14
CVE-2026-73370Apache Syncope: Cross-Realm boundaries reconciliation bypass9.8CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-73236Apache Syncope: Cross-Realm authorization bypass in delegated administration7.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-73195Apache Syncope: CSV export spreadsheet formula injection7.3CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-73191Apache Syncope: CAS service URL injection via Forwarded HTTP headers6.1CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-73178Apache Syncope: JWT Access Token takeover7.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-72524Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables8.8CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-71198OpenStack Glance server-side request forgery7.0CNA v4.00.5%2026-09-14Fix
CVE-2026-70658Pay-rails/pay: Non-constant-time HMAC comparison in Paddle Billing webhook signature verifier7.4CNA v3.10.6%2026-09-14Fix
CVE-2026-68955Rakuten Kobo The installer for Rakuten Kobo Desktop Application uncontrolled search path8.4CNA v4.00.2%2026-09-14
CVE-2026-68570Apache Doris: Authorization bypass leading to unauthorized data access6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-68489WebPros Plesk extension "Ruby" Plesk extensions "Ruby" static code injection8.7CNA v4.00.7%2026-09-14Fix
CVE-2026-67399WebPros WHMCS deserialization of untrusted data9.3CNA v4.00.8%2026-09-14Fix
CVE-2026-65838Skipper: Incomplete fix for an oversized body can bypass OPA deny-on-presence Rego policies8.2CNA v3.10.5%2026-09-14Fix
CVE-2026-65415Apple macOS race condition8.1CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-65414Apple macOS out-of-bounds write9.8CISA ADP v3.11.1%2026-09-14Fix
CVE-2026-65413Apple macOS integer overflow5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65412Apple macOS null pointer dereference6.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-65411Apple visionOS path traversal5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65410Apple macOS uncaught exception7.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-65409Apple macOS type confusion5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65408Apple macOS integer overflow5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65407Apple macOS use-after-free5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65406Apple macOS logic flaw5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65405Apple macOS uninitialized variable use5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65404Apple macOS incorrect authorization5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-65403Apple macOS information disclosure5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-65402Apple macOS use-after-free5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65401Apple macOS race condition5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-65399Apple macOS authentication bypass by spoofing4.4CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-65398Apple macOS buffer overflow7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65395Apple macOS out-of-bounds write6.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-65393Apple Xcode incorrect authorization5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65391Apple Safari integer overflow8.8CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-65390Apple Safari integer overflow8.8CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-65383Apple macOS Gatekeeper vulnerability4.4v3.10.1%2026-09-14Fix
CVE-2026-65382Apple macOS path traversal5.5v3.10.2%2026-09-14Fix
CVE-2026-65381Apple macOS missing authorization10.0v3.10.3%2026-09-14Fix
CVE-2026-65380Apple macOS incorrect authorization5.5v3.10.2%2026-09-14Fix
CVE-2026-65378Apple macOS incorrect authorization7.5v3.10.3%2026-09-14Fix
CVE-2026-65377Apple macOS out-of-bounds read5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65376Apple macOS out-of-bounds read5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65375Apple macOS improper authentication7.5CISA ADP v3.10.7%2026-09-14Fix
CVE-2026-65374Apple macOS out-of-bounds write8.8CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-65371Apple macOS information disclosure3.3CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65369Apple macOS logic flaw5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65365Apple macOS out-of-bounds read6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-65364Apple macOS out-of-bounds read7.5CISA ADP v3.10.7%2026-09-14Fix
CVE-2026-65362Apple macOS privilege escalation7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65361Apple macOS information disclosure5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-65360Apple macOS race condition4.7CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-65359Apple macOS out-of-bounds read7.1CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65358Apple macOS race condition4.7CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-65357Apple macOS buffer overflow7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65355Apple macOS external control of critical state data4.3CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-65354Apple macOS improper privilege management8.2CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-65353Apple macOS improper authorization5.5CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-65352Apple macOS external control of critical state data4.3CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-65348Apple macOS incorrect permission assignment5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65345Apple macOS insecure permissions5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65344Apple macOS out-of-bounds write7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-65342Apple macOS missing authorization7.5v3.10.3%2026-09-14Fix
CVE-2026-64790Apple macOS path traversal7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-64761Apple iOS and iPadOS information disclosure7.5CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-64756Apple macOS path traversal5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-64753Apple Safari improper privilege management6.5CISA ADP v3.10.3%2026-09-14Fix
CVE-2026-64752Apple macOS out-of-bounds write7.3CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-64736Apple macOS out-of-bounds read7.1CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-64717Apple macOS race condition6.3CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-64714Apple macOS memory corruption5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-64712Apple macOS privilege escalation7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-64701Apple macOS improper handling of insufficient permissions7.8CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-61701Laravel MagicLink action insecure deserialization8.8CNA v3.10.8%2026-09-14Fix
CVE-2026-61534Yayson: Prototype pollution in the Store/LegacyStore deserialization9.1CNA v3.10.8%2026-09-14Fix
CVE-2026-59960Argos JavaScript: CI Branch Name OS command injection in @argos-ci/core7.5CNA v3.10.6%2026-09-14Fix
CVE-2026-59570Zscaler Client Connector android ZCC denial of service7.5CNA v3.10.1%2026-09-14Fix
CVE-2026-59569Zscaler Client Connector android ZCC VPN API method privilege escalation8.1CNA v3.10.2%2026-09-14Fix
CVE-2026-59178ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade9.8CNA v3.10.8%2026-09-14Fix
CVE-2026-57583OpenZeppelin Contracts Wizard generated source comments code injection3.3CNA v3.10.2%2026-09-14Fix
CVE-2026-57581DotVVM: Unrestricted file upload5.3CNA v3.10.6%2026-09-14Fix
CVE-2026-57579alchemy_cms alchemy: Unauthenticated nested page API leaks restricted and unpublished content7.5CNA v3.10.6%2026-09-14Fix
CVE-2026-57578DotVVM: Missing authorization in AuthorizeActionFilter9.2CNA v4.00.6%2026-09-14Fix
CVE-2026-57577DotVVM: ReDOS in routing8.2CNA v4.00.6%2026-09-14Fix
CVE-2026-57570Backpack CRUD HasMany and MorphMany relation fields missing authorization6.5CNA v3.10.4%2026-09-14Fix
CVE-2026-57497quic-go webtransport-go capsule parsing resource exhaustion5.3CNA v3.10.5%2026-09-14Fix
CVE-2026-57145PraisonAI: Arbitrary file read/Write via `multiedit` tool without Path Validation9.1CNA v3.10.5%2026-09-14Fix
CVE-2026-57132PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication8.2CNA v3.10.5%2026-09-14Fix
CVE-2026-57131PraisonAI: Jobs API exposes agent-execution endpoints with no authentication9.8CNA v3.11.0%2026-09-14Fix
CVE-2026-57130MervinPraison praisonaiagents PraisonAI: IMAP command injection8.1CNA v3.10.5%2026-09-14Fix
CVE-2026-57129MervinPraison praisonaiagents PraisonAI: Arbitrary file read via `@file:` Mention path traversal7.5CNA v3.10.5%2026-09-14Fix
CVE-2026-57128PraisonAI: Unauthenticated Event injection via SSE `/publish` endpoint4.3CNA v3.10.3%2026-09-14Fix
CVE-2026-57127PraisonAI: Recipe serve auth middleware silently disables itself when no secret is set9.8CNA v3.10.9%2026-09-14Fix
CVE-2026-57126MervinPraison PraisonAI SpiderTools SSRF guard server-side request forgery8.5CNA v3.10.4%2026-09-14Fix
CVE-2026-57125PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass9.8CNA v3.10.6%2026-09-14Fix
CVE-2026-57124PraisonAI UI MCP connect endpoint allows unauthenticated local command execution9.8CNA v3.11.0%2026-09-14Fix
CVE-2026-57123MervinPraison praisonaiagents MCP SSE transport missing authentication9.8CNA v3.10.9%2026-09-14Fix
CVE-2026-57122MervinPraison PraisonAI webhook improper signature verification8.6CNA v3.10.2%2026-09-14Fix
CVE-2026-57120MervinPraison praisonaiagents execute_code sandbox sandbox bypass6.5CNA v3.10.6%2026-09-14Fix
CVE-2026-57119PraisonAI: Unauthenticated local file inclusion via agent_file path in the Jobs API7.5CNA v3.10.5%2026-09-14Fix
CVE-2026-57115PraisonAI: SpiderTools redirect-target SSRF protection bypass6.5CNA v3.10.4%2026-09-14Fix
CVE-2026-56839PraisonAI Code agent tools fail open without a workspace boundary7.3CNA v3.10.4%2026-09-14Fix
CVE-2026-55866AuthZed SpiceDB dispatch check cache incorrect authorization3.7CNA v3.10.3%2026-09-14Fix
CVE-2026-55847allure-framework allure2 allure: Stored XSS6.1CNA v3.10.3%2026-09-14Fix
CVE-2026-55846allure-framework allure2 allure Report: Path traversal in HTTP Server allows arbitrary file read6.2CNA v3.10.2%2026-09-14Fix
CVE-2026-55837dbt-labs dbt-mcp dbt MCP Server: Unauthenticated OAuth Context endpoint leaks dbt platform tokens6.8CNA v3.10.3%2026-09-14Fix
CVE-2026-55832Tract: Arbitrary file read6.1CNA v3.10.2%2026-09-14Fix
CVE-2026-55795Craft Commerce: Coupon Code brute-force via Rate Limit Bypass6.9CNA v4.00.5%2026-09-14Fix
CVE-2026-55451locize gettext-converter translation key parser prototype pollution8.3CNA v4.00.6%2026-09-14Fix
CVE-2026-55416Pimcore: SQL injection in Custom Reports via Malicious Report Configuration8.8CNA v3.10.7%2026-09-14Fix
CVE-2026-55253langchain-mongodb MongoDBSaver NoSQL injection7.7CNA v3.10.5%2026-09-14Fix
CVE-2026-55244ASTEVAL: Sandbox escape via BaseException Subclasses5.0CNA v3.10.2%2026-09-14Fix
CVE-2026-55236LangGraph API run creation improper authorization5.9CNA v3.10.3%2026-09-14Fix
CVE-2026-55235LangGraph API webhook delivery improper authentication5.9CNA v3.10.4%2026-09-14Fix
CVE-2026-55209resdata insufficiently validates untrusted GRDECL files9.8CNA v3.10.8%2026-09-14Fix
CVE-2026-55102hashi-vault-js error handling information disclosure5.8CNA v4.00.2%2026-09-14Fix
CVE-2026-55093Sonos Tract NNEF tensor parser integer overflow6.1CNA v3.10.2%2026-09-14Fix
CVE-2026-55091joaonuno flat-to-nested-js flat-to-nested: Prototype pollution in flat-to-nested convert7.5CNA v3.10.5%2026-09-14Fix
CVE-2026-55073WeasyPrint restrictive URL fetcher bypass allows local file read and SSRF6.2CNA v3.10.2%2026-09-14Fix
CVE-2026-55072Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection8.5CNA v3.10.4%2026-09-14Fix
CVE-2026-54723devpi devpi-server may leak database contents6.5CNA v3.10.4%2026-09-14Fix
CVE-2026-54632SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)7.5CNA v3.10.7%2026-09-14Fix
CVE-2026-54629Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table modules in Server Mode7.5CNA v3.11.0%2026-09-14Fix
CVE-2026-54628Anyquery: Server-side request forgery8.6CNA v3.10.6%2026-09-14Fix
CVE-2026-54567Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path7.5CNA v3.10.6%2026-09-14Fix
CVE-2026-54559PocketSphinx: Buffer overflows in language and acoustic model loading code6.9CNA v4.00.5%2026-09-14Fix
CVE-2026-54542Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof3.7CNA v3.10.4%2026-09-14Fix
CVE-2026-54541Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys3.7CNA v3.10.4%2026-09-14Fix
CVE-2026-54529SQLAdmin: Unvalidated sortBy parameter in `ModelView` bypasses `column_sortable_list`5.3CNA v3.10.4%2026-09-14Fix
CVE-2026-54452safeurl is Missing IPv6 CIDR Ranges in Blocklist6.3CNA v4.00.5%2026-09-14Fix
CVE-2026-54447garminconnect OAuth token store incorrect permission assignment8.4CNA v3.10.2%2026-09-14Fix
CVE-2026-54334UEFI Firmware Parser Tiano decompressor out-of-bounds write9.8CNA v3.10.8%2026-09-14Fix
CVE-2026-54333UEFI Firmware Parser Tiano decompressor out-of-bounds write9.8CNA v3.10.8%2026-09-14Fix
CVE-2026-54247Skipper: Unbounded Request Body Read in Admission Webhook causes memory exhaustion DoS4.3CNA v3.10.3%2026-09-14Fix
CVE-2026-54246Skipper routesrv-no-auth: All routesrv API endpoints lack Authentication5.7CNA v3.10.3%2026-09-14Fix
CVE-2026-54182Backpack/crud: OS command injection in Stats::makeCurlRequest8.1CNA v3.10.8%2026-09-14Fix
CVE-2026-54181Backpack/crud: Stored XSS in the color column the `@if($column['escaped'])` branches are inverted5.4CNA v3.10.3%2026-09-14Fix
CVE-2026-54180Laravel-Backpack CRUD CRUD panel query scopes incorrect authorization7.6CNA v3.10.5%2026-09-14Fix
CVE-2026-54178Backpack/crud: Arbitrary file deletion8.1CNA v3.10.6%2026-09-14Fix
CVE-2026-54177Laravel-Backpack CRUD HasUploadFields file uploads vulnerability6.6CNA v3.10.9%2026-09-14Fix
CVE-2026-54176Backpack/crud: MyAccountController allows changing the login email without a current-password check6.5CNA v3.10.7%2026-09-14Fix
CVE-2026-54175Backpack/crud: Unverified password change in MyAccountController via mass assignment7.6CNA v3.10.6%2026-09-14Fix
CVE-2026-54156node-opcua nonce cache denial of service7.5CNA v3.10.8%2026-09-14Fix
CVE-2026-54155node-opcua missing nonce verification in UserNameIdentityToken authentication7.7CNA v3.10.4%2026-09-14Fix
CVE-2026-54150next-video /api/video request handler path traversal6.9CNA v4.00.4%2026-09-14Fix
CVE-2026-54087EasyCorp EasyAdminBundle EasyAdmin: Stored cross-site scripting7.6CNA v3.10.4%2026-09-14Fix
CVE-2026-53752Plutext docx4j style inheritance resolver uncontrolled recursion7.5CNA v3.10.6%2026-09-14Fix
CVE-2026-53719Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization6.5CNA v3.10.7%2026-09-14Fix
CVE-2026-53718Envoy Gateway custom backendRef cross-namespace ReferenceGrant bypass6.4CNA v3.10.4%2026-09-14Fix
CVE-2026-53717Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header6.5CNA v3.10.7%2026-09-14Fix
CVE-2026-53716Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit6.5CNA v3.10.7%2026-09-14Fix
CVE-2026-53715Envoy Gateway: Wasm cache ServeHTTP reads mappingPath2Cache without lock5.3CNA v3.10.5%2026-09-14Fix
CVE-2026-53714Envoy Gateway: XDS Control Plane information disclosure when operating in GatewayNamespaceMode7.4CNA v3.10.3%2026-09-14Fix
CVE-2026-53713Envoy Gateway: Authentication bypass9.1CNA v3.10.4%2026-09-14Fix
CVE-2026-53708IBM mcp-context-forge ContextForge: DNS TOCTOU race condition causes SSRF protection bypass6.6CNA v3.10.4%2026-09-14Fix
CVE-2026-53659http4k gzip decompression denial of service7.5CNA v3.10.6%2026-09-14Fix
CVE-2026-53496ExifReader HEIC/AVIF ISO-BMFF parser throws uncaught RangeError on truncated boxes5.3CNA v3.10.5%2026-09-14Fix
CVE-2026-53495containerd CRI ExecSync Goroutine leak leading to Node-Level denial of service6.8CNA v4.00.2%2026-09-14Fix
CVE-2026-50276Datadog dd-trace-rb W3C baggage header parser denial of service7.5CNA v3.10.8%2026-09-14Fix
CVE-2026-50270Datadog dd-trace-java W3C baggage header parser denial of service7.5CNA v3.10.8%2026-09-14Fix
CVE-2026-50157Auth0 Symfony: Bearer Token Accepted via URL Query parameter in Auth0 Symfony SDK6.5CNA v3.10.5%2026-09-14Fix
CVE-2026-50006Anyquery: Arbitrary file write which could lead to remote code execution9.1CNA v3.11.0%2026-09-14Fix
CVE-2026-49400October CMS: PHP object injection via Backend Widget Session Storage3.3CNA v3.10.2%2026-09-14Fix
CVE-2026-49250Conform: ParseSubmission vulnerable to CPU exhaustion when parsing many unique form fields8.7CNA v4.00.5%2026-09-14Fix
CVE-2026-47701OpenTelemetry Operator ServiceMonitor bearerTokenFile information disclosure7.7CNA v3.10.5%2026-09-14Fix
CVE-2026-47256OpenTelemetry: Path traversal in Sentry exporter5.3CNA v3.10.4%2026-09-14Fix
CVE-2026-47253Anyquery: Path traversal in `clear_plugin_cache` allows arbitrary Directory Deletion7.3CNA v3.10.4%2026-09-14Fix
CVE-2026-46696octobercms system October CMS: Safe Mode sandbox bypass3.3CNA v3.10.3%2026-09-14Fix
CVE-2026-44162fluent-plugin-s3 vulnerable to denial of service (DoS) via decompression bomb in `in_s3`2.7CNA v3.10.5%2026-09-14Fix
CVE-2026-43815Apple macOS out-of-bounds write8.8v3.10.5%2026-09-14Fix
CVE-2026-43808Apple macOS use-after-free5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-43791Apple macOS path traversal6.5v3.10.5%2026-09-14Fix
CVE-2026-43790Apple macOS out-of-bounds write9.1v3.10.7%2026-09-14Fix
CVE-2026-43789Apple macOS missing authorization7.5v3.10.3%2026-09-14Fix
CVE-2026-43788Apple macOS integer overflow6.6CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-43787Apple macOS logic flaw5.9CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-43786Apple macOS improper handling of insufficient permissions7.8CISA ADP v3.10.2%2026-09-14Exploit codeFix
CVE-2026-43785Apple macOS incorrect authorization5.5v3.10.1%2026-09-14Fix
CVE-2026-43783Apple macOS race condition7.8CISA ADP v3.10.1%2026-09-14Exploit codeFix
CVE-2026-43762Apple macOS improper access control5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-43761Apple macOS out-of-bounds write6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-43741Apple macOS logic flaw5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-43737Apple macOS incorrect authorization5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-43719Apple macOS use-after-free6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-43702Apple macOS memory corruption7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-43697Apple macOS out-of-bounds read7.1v3.10.3%2026-09-14Fix
CVE-2026-43696Apple macOS missing authorization5.3v3.10.2%2026-09-14Fix
CVE-2026-43695Apple macOS improper authorization5.5v3.10.1%2026-09-14Fix
CVE-2026-43692Apple macOS arbitrary code execution8.8CISA ADP v3.10.7%2026-09-14Fix
CVE-2026-43691Apple macOS path traversal7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-43690Apple macOS race condition4.7CISA ADP v3.10.1%2026-09-14Fix
CVE-2026-43689Apple macOS missing authorization7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-43688Apple macOS clickjacking7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-43687Apple macOS information disclosure6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-43686Apple macOS use-after-free8.8CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-43684Apple macOS use-after-free7.8CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-43683Apple macOS out-of-bounds read7.1CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-43677Apple macOS out-of-bounds write6.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-43674Apple iOS and iPadOS improper authentication4.6CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-43664Apple macOS information disclosure5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-38924Oraios AI Serena incorrect resource transfer2.9CNA v3.10.2%2026-09-14Fix
CVE-2026-34151XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+8.2CNA v4.01.1%2026-09-14Fix
CVE-2026-33970Samsung Exynos 850 firmware null pointer dereference3.5CNA v3.10.3%2026-09-14
CVE-2026-33968Samsung Exynos 1330 firmware out-of-bounds read2.8CNA v3.10.1%2026-09-14
CVE-2026-33967Samsung Exynos 1330 firmware out-of-bounds write2.8CNA v3.10.1%2026-09-14
CVE-2026-33966Samsung Exynos 1330 firmware debug information exposure2.8CNA v3.10.1%2026-09-14
CVE-2026-33964Samsung Exynos 1580 firmware untrusted pointer dereference6.4CNA v3.10.1%2026-09-14
CVE-2026-33963Samsung Exynos 1330 firmware stack-based buffer overflow7.5CNA v3.10.1%2026-09-14
CVE-2026-33962Samsung Exynos 850 firmware out-of-bounds read2.8CNA v3.10.1%2026-09-14
CVE-2026-33960Samsung Exynos 1330 firmware out-of-bounds write2.8CNA v3.10.1%2026-09-14
CVE-2026-33957Samsung Exynos 1580 firmware out-of-bounds write4.2CNA v3.10.1%2026-09-14
CVE-2026-33956Samsung Exynos 1330 firmware out-of-bounds write2.8CNA v3.10.1%2026-09-14
CVE-2026-31278supremainc BioStar 2 cleartext transmission of sensitive information7.7CNA v3.10.3%2026-09-14Fix
CVE-2026-28968Apple macOS out-of-bounds read5.5CISA ADP v3.10.2%2026-09-14Fix
CVE-2026-28966Apple macOS out-of-bounds write4.3CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-28960Apple iOS and iPadOS denial of service7.5CISA ADP v3.10.5%2026-09-14Fix
CVE-2026-28938Apple iOS and iPadOS personal information exposure7.5CISA ADP v3.10.4%2026-09-14Fix
CVE-2026-28937Apple macOS information disclosure5.5CISA ADP v3.10.2%2026-09-14Fix