Total
395696 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-25550 | 2026-09-16 | N/A | 9.8 CRITICAL | ||
| Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .NET Remoting service exposed on TCP port 7375 via BtSystem.Service.exe. The service registers an unauthenticated singleton endpoint — BarTenderSystem for BarTender 2016 <= R9, and DataServiceSingleton for BarTender 2019 <= R10 — configured with BinaryServerFormatterSinkProvider and TypeFilterLevel set to Full. An unauthenticated remote attacker can exploit .NET Remoting object unmarshalling to read or write arbitrary files on the server using the .NET WebClient class, or coerce NTLMv2 authentication by supplying a UNC path to an attacker-controlled server, enabling sensitive credential disclosure, remote code execution, or lateral movement depending on service account privileges and network environment. The service runs in the context of NT AUTHORITY\\SYSTEM. This vulnerability is corrected in BarTender 12.0.1. Users of affected releases should upgrade to BarTender 12.0.1 or later. | |||||
| CVE-2026-88053 | 1 Tesseract-ocr | 1 Tesseract Ocr | 2026-09-16 | N/A | 7.8 HIGH |
| Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Classify::ReadIntTemplates in src/classify/intproto.cpp reads NumClassPruners, NumClasses, and NumProtoSets from the TESSDATA_INTTEMP component of a crafted .traineddata file and uses those values as loop bounds without validating them against MAX_NUM_CLASS_PRUNERS, MAX_NUM_CLASSES, and MAX_NUM_PROTO_SETS. The loops store heap pointers into fixed-capacity ClassPruners and ProtoSets arrays in INT_TEMPLATES_STRUCT and INT_CLASS_STRUCT, so an oversized count causes heap out-of-bounds pointer writes during legacy-classifier initialization before OCR begins, resulting in heap corruption, a crash, or potentially controlled corruption. No fixed release is available as of this review. | |||||
| CVE-2026-88054 | 1 Tesseract-ocr | 1 Tesseract Ocr | 2026-09-16 | N/A | 5.5 MEDIUM |
| Tesseract is an open source OCR engine. In version 5.5.3 and earlier, Plumbing::DeSerialize in src/lstm/plumbing.cpp rejects excessively large network stacks but accepts a zero-length stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layers in a crafted .traineddata model. During LSTMRecognizer initialization in src/lstm/lstmrecognizer.cpp, CacheXScaleFactor(XScaleFactor()) reaches Series::CacheXScaleFactor in src/lstm/series.cpp, which dereferences stack_[0] on the empty vector and invokes a virtual method through an invalid Network pointer. This causes a deterministic crash and denial of service at model load. No fixed release is available as of this review. | |||||
| CVE-2026-88032 | 1 Mongodb | 1 Java Driver | 2026-09-16 | N/A | 5.9 MEDIUM |
| A use-after-free in the reactive client-side encryption component of the MongoDB Java Driver can cause native resources to be freed while an affected encrypted operation is still using them when the operation is cancelled. A party able to cause such an operation to be cancelled may cause the hosting application process to terminate. Reaching the issue requires an affected reactive encryption configuration that retrieves KMS credentials on demand. | |||||
| CVE-2026-69527 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-16 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Windows USB Mass Storage Class Driver allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-81205 | 1 Miniorange | 1 Ldap \/ Active Directory Integration | 2026-09-16 | N/A | 5.3 MEDIUM |
| Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1. | |||||
| CVE-2026-69503 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-16 | N/A | 8.0 HIGH |
| Stack-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-69490 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-16 | N/A | 6.8 MEDIUM |
| Out-of-bounds read in Windows USB Mass Storage Class Driver allows an unauthorized attacker to elevate privileges with a physical attack. | |||||
| CVE-2026-69469 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-16 | N/A | 6.6 MEDIUM |
| Integer overflow or wraparound in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to elevate privileges with a physical attack. | |||||
| CVE-2026-69457 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-16 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Windows USB Driver allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-73477 | 1 Quick Tabs Project | 1 Quick Tabs | 2026-09-16 | N/A | 5.3 MEDIUM |
| Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1. | |||||
| CVE-2026-81201 | 1 Monster Menus Project | 1 Monster Menus | 2026-09-16 | N/A | 6.1 MEDIUM |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3. | |||||
| CVE-2026-69423 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-16 | N/A | 8.0 HIGH |
| Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-40635 | 1 Dell | 1 Powerscale Onefs | 2026-09-16 | N/A | 5.4 MEDIUM |
| Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering. | |||||
| CVE-2026-46460 | 1 Dell | 1 Powerscale Onefs | 2026-09-16 | N/A | 3.5 LOW |
| Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized modification of system logs. | |||||
| CVE-2026-70425 | 1 Dell | 1 Powerscale Onefs | 2026-09-16 | N/A | 6.7 MEDIUM |
| Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain a command injection vulnerability. An admin privileged local attacker could potentially exploit this vulnerability, leading to elevation of privileges to root, impacting confidentiality, integrity, and availability. | |||||
| CVE-2026-86878 | 1 Apple | 2 Ipados, Iphone Os | 2026-09-16 | N/A | 5.5 MEDIUM |
| A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data. | |||||
| CVE-2026-65404 | 1 Apple | 3 Ipados, Iphone Os, Macos | 2026-09-16 | N/A | 5.5 MEDIUM |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A malicious application may be able to bypass Privacy preferences. | |||||
| CVE-2026-91781 | 1 Gnu | 1 Binutils | 2026-09-16 | 1.7 LOW | 3.3 LOW |
| A security vulnerability has been detected in GNU Binutils 2.47. Affected is the function elf_x86_64_common_section_index of the file bfd/elf64-x86-64.c of the component ELF Section Handler. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. Upgrading to version 2.48 is able to address this issue. The identifier of the patch is 7322e9bc30cb282575a701c307851fd3d66fee68. It is suggested to upgrade the affected component. | |||||
| CVE-2026-91780 | 1 Gnu | 1 Binutils | 2026-09-16 | 1.7 LOW | 3.3 LOW |
| A weakness has been identified in GNU Binutils 2.47. This impacts the function elf_link_add_object_symbols of the file bfd/elflink.c. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet. | |||||