Total
413092 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-40014 | 2026-09-03 | N/A | 6.5 MEDIUM | ||
| An attacker that can send mail to a user can craft a message header that makes the IMAP THREAD command consume CPU disproportionate to the size of the message. When a mail client issues a THREAD command on the affected mailbox, this can cause degradation or denial of service for IMAP. Monitor system for abnormal CPU usage, kill the offending process and remove the offending message from the affected mailbox. Update to non-vulnerable version. No publicly available exploits are known. | |||||
| CVE-2026-6071 | 2026-09-03 | N/A | N/A | ||
| A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a malicious page or open a malicious file. | |||||
| CVE-2026-82968 | 2026-09-03 | N/A | 6.4 MEDIUM | ||
| A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access. | |||||
| CVE-2026-82838 | 2026-09-03 | N/A | N/A | ||
| The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set. | |||||
| CVE-2024-7956 | 2026-09-03 | N/A | N/A | ||
| A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project. | |||||
| CVE-2026-40464 | 2026-09-03 | N/A | 5.4 MEDIUM | ||
| NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content. | |||||
| CVE-2026-16316 | 2026-09-03 | N/A | 4.3 MEDIUM | ||
| OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traffic. The vulnerability does not affect overall system availability or the processing of other traffic types, and the process is automatically restarted, and the failure is immediately reported to the user. | |||||
| CVE-2026-75414 | 2026-09-03 | N/A | 9.8 CRITICAL | ||
| In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability. | |||||
| CVE-2026-75415 | 2026-09-03 | N/A | 7.5 HIGH | ||
| AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive information leakage. | |||||
| CVE-2026-40465 | 2026-09-03 | N/A | 5.3 MEDIUM | ||
| NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter. | |||||
| CVE-2026-40463 | 2026-09-03 | N/A | 7.6 HIGH | ||
| WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser. | |||||
| CVE-2026-16315 | 2026-09-03 | N/A | 8.7 HIGH | ||
| OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate clients. An attacker can gain full access to the system configuration, allowing modification, reset, or unauthorized alteration of system parameters. | |||||
| CVE-2026-16731 | 2026-09-03 | N/A | N/A | ||
| OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate clients. An attacker can gain full access to the system configuration, allowing modification, reset, or unauthorized alteration of system parameters or injecting network traffic into the connected network. | |||||
| CVE-2026-80184 | 2026-09-03 | N/A | N/A | ||
| In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected. | |||||
| CVE-2021-38489 | 2026-09-03 | N/A | 8.2 HIGH | ||
| HDD password plaintext is stored in a UEFI variable. | |||||
| CVE-2026-67560 | 2026-09-03 | N/A | 7.5 HIGH | ||
| Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS function, steering assist, speedometer, and shifting. | |||||
| CVE-2026-68967 | 2026-09-03 | N/A | 6.5 MEDIUM | ||
| Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker to deliver a payload that could establish an arbitrary write primitive, which could crash the ECU. | |||||
| CVE-2021-43613 | 2026-09-03 | N/A | 6.5 MEDIUM | ||
| An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege | |||||
| CVE-2021-43614 | 2026-09-03 | N/A | 6.7 MEDIUM | ||
| Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure. | |||||
| CVE-2026-65421 | 2026-09-03 | N/A | 6.5 MEDIUM | ||
| The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition. | |||||