Total
395446 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-56563 | 2026-09-17 | N/A | 9.8 CRITICAL | ||
| A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validation. An unauthenticated remote attacker can leverage this to make arbitrary HTTP and HTTPS requests from the server to internal networks or cloud metadata services, potentially obtaining sensitive information or pivoting to further attacks. | |||||
| CVE-2026-69316 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-17 | N/A | 4.7 MEDIUM |
| Buffer over-read in Windows Overlay Filter allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-69333 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 | 2026-09-17 | N/A | 7.0 HIGH |
| Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69344 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-17 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Windows Print Spooler Components allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-20301 | 1 Cisco | 2 Ios, Ios Xe | 2026-09-17 | N/A | 8.6 HIGH |
| A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of malformed XMCP packets. An attacker could exploit this vulnerability by sending a malformed XMCP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. The attacker does not need the XMCP client username to exploit this vulnerability. | |||||
| CVE-2026-69348 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-09-17 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-20274 | 1 Cisco | 1 Ios Xr | 2026-09-17 | N/A | 9.8 CRITICAL |
| As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20274 are related to improper resource control issues that are grouped under the Common Weakness Enumeration (CWE) CWE-664. | |||||
| CVE-2026-69351 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-17 | N/A | 5.5 MEDIUM |
| Exposure of private personal information to an unauthorized actor in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally. | |||||
| CVE-2024-41965 | 3 Neovim, Netapp, Vim | 3 Neovim, Hci Compute Node, Vim | 2026-09-17 | N/A | 4.2 MEDIUM |
| Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask the user what to do with the modified buffer. If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet. However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash. The issue has been fixed as of Vim patch v9.1.0648. | |||||
| CVE-2023-48706 | 4 Fedoraproject, Neovim, Netapp and 1 more | 4 Fedora, Neovim, Hci Compute Node and 1 more | 2026-09-17 | N/A | 3.6 LOW |
| Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue. | |||||
| CVE-2023-5535 | 3 Fedoraproject, Neovim, Vim | 3 Fedora, Neovim, Vim | 2026-09-17 | N/A | 7.8 HIGH |
| Use After Free in GitHub repository vim/vim prior to v9.0.2010. | |||||
| CVE-2023-4781 | 4 Apple, Debian, Neovim and 1 more | 4 Macos, Debian Linux, Neovim and 1 more | 2026-09-17 | N/A | 7.8 HIGH |
| Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1873. | |||||
| CVE-2023-4752 | 5 Apple, Debian, Fedoraproject and 2 more | 5 Macos, Debian Linux, Fedora and 2 more | 2026-09-17 | N/A | 7.8 HIGH |
| Use After Free in GitHub repository vim/vim prior to 9.0.1858. | |||||
| CVE-2023-4751 | 3 Apple, Neovim, Vim | 3 Macos, Neovim, Vim | 2026-09-17 | N/A | 7.8 HIGH |
| Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331. | |||||
| CVE-2023-4750 | 4 Apple, Fedoraproject, Neovim and 1 more | 4 Macos, Fedora, Neovim and 1 more | 2026-09-17 | N/A | 7.8 HIGH |
| Use After Free in GitHub repository vim/vim prior to 9.0.1857. | |||||
| CVE-2026-91731 | 1 Google | 1 Chrome | 2026-09-17 | N/A | 8.8 HIGH |
| Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-91730 | 1 Google | 1 Chrome | 2026-09-17 | N/A | 3.1 LOW |
| Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-91729 | 1 Google | 1 Chrome | 2026-09-17 | N/A | 9.6 CRITICAL |
| Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-91728 | 1 Google | 1 Chrome | 2026-09-17 | N/A | 9.6 CRITICAL |
| Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-91727 | 2 Apple, Google | 2 Macos, Chrome | 2026-09-17 | N/A | 8.1 HIGH |
| Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) | |||||