Total
412639 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-71468 | 2026-09-05 | N/A | 5.3 MEDIUM | ||
| A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the cache expires. This allows other authenticated users to gain unauthorized access to remote managed hub search results, leading to information disclosure. | |||||
| CVE-2026-64927 | 2026-09-05 | N/A | 6.4 MEDIUM | ||
| A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system. | |||||
| CVE-2026-78408 | 2026-09-05 | N/A | 7.9 HIGH | ||
| The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes. | |||||
| CVE-2026-62196 | 1 Openclaw | 1 Openclaw | 2026-09-05 | N/A | 8.3 HIGH |
| OpenClaw versions 2026.3.22 before 2026.6.6 contain an authorization bypass vulnerability where WhatsApp group IDs can satisfy elevated sender allowlists. Attackers with lower-trust access can perform actions requiring stronger authorization by leveraging group ID validation in the affected feature. | |||||
| CVE-2026-85225 | 2026-09-05 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-85207 | 2026-09-05 | 4.0 MEDIUM | 3.5 LOW | ||
| A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-85309 | 2026-09-05 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3. | |||||
| CVE-2026-85305 | 2026-09-05 | N/A | 5.4 MEDIUM | ||
| Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1. | |||||
| CVE-2026-85137 | 2026-09-05 | 7.5 HIGH | 7.3 HIGH | ||
| A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. | |||||
| CVE-2026-85106 | 2026-09-05 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-84847 | 2026-09-05 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. | |||||
| CVE-2026-84812 | 2026-09-05 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. | |||||
| CVE-2026-84774 | 2026-09-05 | N/A | 6.1 MEDIUM | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions. | |||||
| CVE-2026-84766 | 2026-09-05 | N/A | 5.9 MEDIUM | ||
| Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. | |||||
| CVE-2026-84758 | 2026-09-05 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. | |||||
| CVE-2026-84753 | 2026-09-05 | N/A | 9.8 CRITICAL | ||
| Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. | |||||
| CVE-2026-81773 | 2026-09-05 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. | |||||
| CVE-2026-81281 | 2026-09-05 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. | |||||
| CVE-2026-85030 | 2026-09-05 | 2.6 LOW | 3.7 LOW | ||
| A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Such manipulation of the argument initial_balance leads to business logic errors. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring's return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game. | |||||
| CVE-2026-84886 | 2026-09-05 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executing a manipulation of the argument img_bytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | |||||