Total
410572 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-66382 | 1 Jfrog | 1 Artifactory | 2026-09-02 | N/A | 4.3 MEDIUM |
| An authenticated user may write files outside the intended Artifactory work directory under specific conditions. | |||||
| CVE-2026-68752 | 1 Jfrog | 1 Artifactory | 2026-09-02 | N/A | 7.2 HIGH |
| A Project Resource Manager may gain broader administrative privileges under specific conditions. | |||||
| CVE-2026-68753 | 1 Jfrog | 1 Artifactory | 2026-09-02 | N/A | 5.3 MEDIUM |
| An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way. | |||||
| CVE-2026-68754 | 1 Jfrog | 1 Artifactory | 2026-09-02 | N/A | 6.5 MEDIUM |
| A repository publisher without delete permission may modify protected package content under specific conditions. | |||||
| CVE-2026-68755 | 1 Jfrog | 1 Artifactory | 2026-09-02 | N/A | 4.3 MEDIUM |
| A bundle writer may create misleading release promotion information under specific conditions. | |||||
| CVE-2026-68756 | 1 Jfrog | 1 Artifactory | 2026-09-02 | N/A | 6.6 MEDIUM |
| A party with write access to stored session data may affect JFrog Artifactory under specific conditions. | |||||
| CVE-2026-68757 | 1 Jfrog | 1 Artifactory | 2026-09-02 | N/A | 7.5 HIGH |
| A user with access to a valid SAML response may impersonate another user under specific conditions. | |||||
| CVE-2026-68760 | 1 Jfrog | 1 Artifactory | 2026-09-02 | N/A | 5.3 MEDIUM |
| An unauthenticated user may bypass authentication under specific cache conditions. | |||||
| CVE-2026-68758 | 1 Jfrog | 1 Artifactory | 2026-09-02 | N/A | 6.5 MEDIUM |
| A low-privileged authenticated user may access restricted support information under specific conditions. | |||||
| CVE-2026-68759 | 1 Jfrog | 1 Artifactory | 2026-09-02 | N/A | 7.2 HIGH |
| A holder of a valid integration credential may impersonate other users under specific conditions. | |||||
| CVE-2026-76221 | 1 Gitpython Project | 1 Gitpython | 2026-09-02 | N/A | 8.8 HIGH |
| GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshCommand = touch /tmp/RCE #' to execute arbitrary commands via core.sshCommand or core.hooksPath on the next git operation. | |||||
| CVE-2026-76222 | 1 Gitpython Project | 1 Gitpython | 2026-09-02 | N/A | 8.2 HIGH |
| GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython processes during submodule initialization, creating attacker-controlled Git repositories at escaped filesystem locations. | |||||
| CVE-2026-20355 | 2026-09-02 | N/A | 5.9 MEDIUM | ||
| Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication. | |||||
| CVE-2026-20281 | 2026-09-02 | N/A | 7.5 HIGH | ||
| A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition. A manual reboot of the device is required to recover from this condition. Note: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default. | |||||
| CVE-2026-78222 | 2026-09-02 | N/A | 7.5 HIGH | ||
| A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2026-20354 | 2026-09-02 | N/A | 5.9 MEDIUM | ||
| Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication. | |||||
| CVE-2026-82463 | 2026-09-02 | N/A | 8.1 HIGH | ||
| pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks. | |||||
| CVE-2026-76759 | 2026-09-02 | N/A | 7.3 HIGH | ||
| Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. | |||||
| CVE-2026-76758 | 2026-09-02 | N/A | 5.9 MEDIUM | ||
| Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*. | |||||
| CVE-2026-73717 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 7.5 HIGH |
| A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. | |||||