Total
3399 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-88817 | 2026-09-16 | N/A | N/A | ||
| An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group without an invitation or approval. It did not grant application-wide administrator privileges, and the vulnerability could not be used to obtain root access to the application or its underlying host. | |||||
| CVE-2026-55225 | 2026-09-16 | N/A | 8.0 HIGH | ||
| Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster Operator to create a Role with full Secret CRUD permissions there and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can mint a token for that ServiceAccount and read or write Secrets in any target namespace where the Cluster Operator has been granted permissions, regardless of STRIMZI_NAMESPACE. This issue is fixed in versions 1.0.1 and 1.1.0. | |||||
| CVE-2026-66818 | 1 Microsoft | 4 Sql Server 2017, Sql Server 2019, Sql Server 2022 and 1 more | 2026-09-16 | N/A | 8.8 HIGH |
| Improper privilege management in SQL Server allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-85979 | 2026-09-16 | N/A | N/A | ||
| Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system. It affects Puppet Enterprise 2023.8.0 through 2023.8.10 and Puppet Enterprise 2025.0.0 through 2025.11.2. This has been resolved in Puppet Enterprise 2023.8.11 and Puppet Enterprise 2025.11.3. | |||||
| CVE-2026-92073 | 2026-09-16 | N/A | 8.8 HIGH | ||
| Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||||
| CVE-2026-92062 | 2026-09-16 | N/A | 8.8 HIGH | ||
| Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||||
| CVE-2026-92055 | 2026-09-16 | N/A | 8.8 HIGH | ||
| Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||||
| CVE-2026-92053 | 2026-09-16 | N/A | 8.8 HIGH | ||
| Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||||
| CVE-2026-92047 | 2026-09-16 | N/A | 8.8 HIGH | ||
| Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, and Thunderbird 156. | |||||
| CVE-2026-92033 | 2026-09-16 | N/A | 8.8 HIGH | ||
| Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156. | |||||
| CVE-2026-92017 | 2026-09-16 | N/A | 8.8 HIGH | ||
| Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16. | |||||
| CVE-2026-92015 | 2026-09-16 | N/A | 8.8 HIGH | ||
| Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 140.16. | |||||
| CVE-2026-61549 | 2026-09-16 | N/A | N/A | ||
| Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, and the Kubernetes backend in pipeline/backend/kubernetes/pod.go copies that pipeline-step value directly into the pod specification without administrator authorization. Any user with Push permission on a connected repository can therefore run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace and inherit that account's RBAC permissions. When a privileged ServiceAccount is reachable, the attacker can exfiltrate secrets such as database credentials, API keys, and TLS certificates and may take over the cluster. This issue is fixed in version 3.16.0. | |||||
| CVE-2026-12793 | 2026-09-16 | N/A | 9.8 CRITICAL | ||
| The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account. | |||||
| CVE-2026-80166 | 1 Dell | 1 Secure Connect Gateway | 2026-09-16 | N/A | 7.8 HIGH |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges. | |||||
| CVE-2026-76694 | 2026-09-15 | N/A | 6.6 MEDIUM | ||
| A privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to escalate privileges beyond their authorized level, and execute arbitrary code on a vulnerable system. | |||||
| CVE-2026-64753 | 1 Apple | 7 Ipados, Iphone Os, Macos and 4 more | 2026-09-15 | N/A | 6.5 MEDIUM |
| A permissions issue was addressed by removing the vulnerable code. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may disclose sensitive user information. | |||||
| CVE-2026-55226 | 2026-09-15 | N/A | 5.4 MEDIUM | ||
| Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In Strimzi 1.0.0 and earlier, deploying only the Topic Operator or only the User Operator through the Kafka custom resource leaves the Entity Operator ServiceAccount with RBAC permissions for both components. The excess permissions can allow access to KafkaUser custom resources and Secrets when the User Operator is absent, or access to KafkaTopic custom resources when the Topic Operator is absent. This issue is fixed in versions 1.0.1 and 1.1.0. | |||||
| CVE-2026-84042 | 2026-09-15 | N/A | 7.8 HIGH | ||
| A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29 | |||||
| CVE-2026-9327 | 1 Ibm | 1 Websphere Application Server | 2026-09-15 | N/A | 6.3 MEDIUM |
| IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security configuration. This could result in information disclosure or denial of service. | |||||