Total
413143 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-85222 | 2026-09-04 | 8.3 HIGH | 9.1 CRITICAL | ||
| A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/addon_center.cgi of the component Add-On Center. Such manipulation of the argument f_name/f_url/f_flag/f_login_user leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2026-85186 | 2026-09-04 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdateimage of the file /customer/controller.php?action=photos of the component Customer Controller. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-84848 | 2026-09-04 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions. | |||||
| CVE-2026-84813 | 2026-09-04 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. | |||||
| CVE-2026-84776 | 2026-09-04 | N/A | 7.5 HIGH | ||
| Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. | |||||
| CVE-2026-84767 | 2026-09-04 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. | |||||
| CVE-2026-84761 | 2026-09-04 | N/A | 7.2 HIGH | ||
| Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions. | |||||
| CVE-2026-84754 | 2026-09-04 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. | |||||
| CVE-2026-81776 | 2026-09-04 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. | |||||
| CVE-2026-81282 | 2026-09-04 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions. | |||||
| CVE-2026-39956 | 1 Jqlang | 1 Jq | 2026-09-04 | N/A | 6.1 MEDIUM |
| jq is a command-line JSON processor. Prior to version 1.8.2, the _strindices builtin in jq's src/builtin.c passes its arguments directly to jv_string_indexes() without verifying they are strings, and jv_string_indexes() in src/jv.c relies solely on assert() checks that are stripped in release builds compiled with -DNDEBUG. This allows an attacker to crash jq trivially with input like _strindices(0), and by crafting a numeric value whose IEEE-754 bit pattern maps to a chosen pointer, achieve a controlled pointer dereference and limited memory read/probe primitive. Any deployment that evaluates untrusted jq filters against a release build is vulnerable. This issue has been patched in commit fdf8ef0f0810e3d365cdd5160de43db46f57ed03, which is part of version 1.8.2. | |||||
| CVE-2024-28056 | 1 Amazon | 1 Aws Amplify Cli | 2026-09-04 | N/A | 9.8 CRITICAL |
| Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects. When the Authentication component is removed from an Amplify project, a Condition property is removed but "Effect":"Allow" remains present, and consequently sts:AssumeRoleWithWebIdentity would be available to threat actors with no conditions. Thus, if Amplify CLI had been used to remove the Authentication component from a project built between August 2019 and January 2024, an "assume role" may have occurred, and may have been leveraged to obtain unauthorized access to an organization's AWS resources. NOTE: the problem could only occur if an authorized AWS user removed an Authentication component. (The vulnerability did not give a threat actor the ability to remove an Authentication component.) However, in realistic situations, an authorized AWS user may have removed an Authentication component, e.g., if the objective were to stop using built-in Cognito resources, or move to a completely different identity provider. | |||||
| CVE-2026-67620 | 1 Flowiseai | 1 Flowise | 2026-09-04 | N/A | 7.7 HIGH |
| Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services. Attackers can send requests to the fetch-links API endpoint with a crafted URL parameter, bypassing deny-list validation including redirect-based bypasses, to reach instance metadata services and expose instance identity data and role credentials on Oracle Cloud Infrastructure or Alibaba Cloud deployments, with unauthenticated access possible when URL-fetching nodes exist in public chatflows. | |||||
| CVE-2026-12372 | 1 Nltk | 1 Nltk | 2026-09-04 | N/A | 3.7 LOW |
| A Server-Side Request Forgery (SSRF) vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The `nltk.pathsec.validate_network_url()` function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space (`100.64.0.0/10`). This occurs because Python's `ipaddress` module does not classify such addresses as `is_private` or `is_global`, and the current guard only checks `is_private` and a few explicit categories. An attacker who can influence a URL passed to NLTK's network-loading helpers can exploit this vulnerability to make a strict-mode application send requests to shared-address-space hosts, potentially exposing non-public infrastructure reachable from the application host. The impact is limited to SSRF-style confidentiality exposure, with no code execution claimed. | |||||
| CVE-2026-71962 | 1 Flowiseai | 1 Flowise | 2026-09-04 | N/A | 7.5 HIGH |
| Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypasses all session and API key verification. Attackers can supply valid chatflowId, chatId, and fileName identifiers to retrieve files from any chatflow on the instance, including private chatflows belonging to other workspaces or organizations. | |||||
| CVE-2026-81838 | 1 Amazon | 1 Diagram-as-code | 2026-09-04 | N/A | 7.1 HIGH |
| A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal sequences. This could allow the third party to perform inappropriate actions in the diagram bundle. To remediate this issue, users should upgrade to the version 0.24 or later. | |||||
| CVE-2026-6694 | 1 Redhat | 1 Enterprise Linux | 2026-09-04 | N/A | 5.5 MEDIUM |
| A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user. | |||||
| CVE-2019-3773 | 2 Broadcom, Oracle | 3 Spring Web Services, Financial Services Analytical Applications Infrastructure, Flexcube Private Banking | 2026-09-04 | 7.5 HIGH | 9.8 CRITICAL |
| Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources. | |||||
| CVE-2026-18248 | 1 Fastify | 1 Fastify\/aws-lambda | 2026-09-04 | N/A | 9.1 CRITICAL |
| @fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.context, values that applications are documented to use for authorization decisions such as reading API Gateway authorizer claims. In the default configuration, the getter that populates this decoration reads the client-controlled x-apigateway-event and x-apigateway-context HTTP headers before falling back to the trusted internal request token, and those reserved headers are not stripped from the incoming event. An unauthenticated attacker who can set a single HTTP header can therefore forge the entire Lambda proxy event, including the authorizer context, and override the genuine one. This results in a full authentication and authorization bypass and privilege escalation for any application that trusts request.awsLambda.event for identity or access control. Only version 6.4.0 is affected. Patches: upgrade to @fastify/aws-lambda 6.4.1, which resolves the decoration only through the internal per-invocation token and strips the reserved headers before the request is processed. | |||||
| CVE-2026-10709 | 1 Autodesk | 1 Fbx Software Development Kit | 2026-09-04 | N/A | 7.8 HIGH |
| A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, can trigger a stack-based buffer overflow vulnerability in fbxsdk::FbxIO::BinaryReadSectionHeader. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | |||||