Total
413884 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-78481 | 1 Dell | 1 Secure Connect Gateway | 2026-09-09 | N/A | 6.5 MEDIUM |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass. | |||||
| CVE-2026-80239 | 1 Dell | 1 Secure Connect Gateway | 2026-09-09 | N/A | 2.4 LOW |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to information exposure. | |||||
| CVE-2026-79727 | 1 Dell | 1 Secure Connect Gateway | 2026-09-09 | N/A | 3.3 LOW |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. | |||||
| CVE-2026-80122 | 1 Dell | 1 Secure Connect Gateway | 2026-09-09 | N/A | 7.3 HIGH |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. | |||||
| CVE-2026-9854 | 1 Hitachienergy | 1 Microscada X Sys600 | 2026-09-09 | N/A | 7.8 HIGH |
| A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine. | |||||
| CVE-2026-79973 | 1 Dell | 1 Secure Connect Gateway | 2026-09-09 | N/A | 6.3 MEDIUM |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Unsynchronized Access to Shared Data in a Multithreaded Context vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service. | |||||
| CVE-2026-79967 | 1 Dell | 1 Secure Connect Gateway | 2026-09-09 | N/A | 5.6 MEDIUM |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass. | |||||
| CVE-2026-79640 | 1 Dell | 1 Secure Connect Gateway | 2026-09-09 | N/A | 5.4 MEDIUM |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. | |||||
| CVE-2026-9853 | 1 Hitachienergy | 1 Microscada X Sys600 | 2026-09-09 | N/A | 7.8 HIGH |
| A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify application objects. | |||||
| CVE-2026-9852 | 1 Hitachienergy | 1 Microscada X Sys600 | 2026-09-09 | N/A | 7.8 HIGH |
| A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log. | |||||
| CVE-2026-81385 | 1 Microsoft | 5 365 Apps, Office 2019, Office 2021 and 2 more | 2026-09-09 | N/A | 8.8 HIGH |
| Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69742 | 1 Microsoft | 5 365 Apps, Office 2019, Office 2021 and 2 more | 2026-09-09 | N/A | 8.8 HIGH |
| Integer overflow or wraparound in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69285 | 1 Microsoft | 5 365 Apps, Office 2016, Office 2019 and 2 more | 2026-09-09 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69442 | 1 Microsoft | 5 365 Apps, Office 2016, Office 2019 and 2 more | 2026-09-09 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-85124 | 1 Fastify | 1 Fastify\/http-proxy | 2026-09-09 | N/A | 7.5 HIGH |
| @fastify/http-proxy versions before 11.6.2 do not validate proxied HTTP request paths for backslash based dot-segments before forwarding them to the configured upstream. The plain HTTP request handler skips the destination validation that the WebSocket path performs, and the underlying reply-from library only rejects forward-slash traversal, so a request containing backslash dot-segments can escape the boundary set by the prefix and rewritePrefix options. An unauthenticated network attacker can use this to reach upstream paths that were meant to stay hidden behind the proxy, resulting in disclosure of internal endpoints. This is a path traversal issue (CWE-22). Users should upgrade to @fastify/http-proxy 11.6.2 or later. | |||||
| CVE-2026-69629 | 1 Microsoft | 5 365 Apps, Office 2019, Office 2021 and 2 more | 2026-09-09 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-85090 | 1 Freerdp | 1 Freerdp | 2026-09-09 | N/A | 5.4 MEDIUM |
| FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an out-of-bounds memory read past the allocated luma plane. | |||||
| CVE-2026-87563 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 4.3 MEDIUM |
| Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87565 | 1 Google | 2 Android, Chrome | 2026-09-09 | N/A | 6.5 MEDIUM |
| Information leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-87566 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 5.3 MEDIUM |
| Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | |||||