Total
413884 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-87735 | 2026-09-09 | N/A | 4.3 MEDIUM | ||
| An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption. | |||||
| CVE-2026-87724 | 2026-09-09 | N/A | 6.5 MEDIUM | ||
| Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash) because of corrupted congestion-control state. This is TROVE-2026-032. | |||||
| CVE-2026-83986 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-09 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-83975 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-09 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-79588 | 2026-09-09 | N/A | 4.3 MEDIUM | ||
| U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration credentials over HTTP. | |||||
| CVE-2026-79574 | 2026-09-09 | N/A | 9.8 CRITICAL | ||
| An issue in the gateway server of mpush v0.8.1 allows attackers to execute arbitrary code via sending a crafted broadcast message. | |||||
| CVE-2026-79571 | 2026-09-09 | N/A | 9.1 CRITICAL | ||
| Incorrect access control in the SellerAuthorizeAspect component of springboot-project v1.0.0 allows unauthenticated attackers to access all seller management interfaces and list all products/orders, put products on/off sale, finish/cancel orders, and modify categories without authentication. | |||||
| CVE-2026-79390 | 2026-09-09 | N/A | 7.5 HIGH | ||
| Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational data, including device identifiers, message metadata, and control-related information. | |||||
| CVE-2026-78997 | 2026-09-09 | N/A | 9.3 CRITICAL | ||
| UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) contains a Universal Cross-Site Scripting vulnerability that allows an attacker to execute arbitrary JavaScript in the context of any origin. An attacker hosts a specially crafted URL on a UC-owned domain (via a reflected XSS) that leverages the browser's internal JavaScript bridge to register a deferred callback, navigate the tab to a victim site, and then execute attacker-controlled code on that site when a login dialog is dismissed. | |||||
| CVE-2026-78837 | 2026-09-09 | N/A | 7.5 HIGH | ||
| A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement. | |||||
| CVE-2026-69690 | 1 Microsoft | 1 Sharepoint Server | 2026-09-09 | N/A | 4.6 MEDIUM |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | |||||
| CVE-2026-52486 | 2026-09-09 | N/A | 6.6 MEDIUM | ||
| An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module | |||||
| CVE-2022-26961 | 2026-09-09 | N/A | 5.4 MEDIUM | ||
| Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then be triggered every time an authenticated user browses the page containing it. | |||||
| CVE-2026-87485 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 3.1 LOW |
| Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87495 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 4.3 MEDIUM |
| Information leak in Scroll in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87498 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 3.1 LOW |
| Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-87508 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 4.3 MEDIUM |
| Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87516 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 4.3 MEDIUM |
| Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-87517 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-09-09 | N/A | 3.1 LOW |
| Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-87531 | 1 Google | 1 Chrome | 2026-09-09 | N/A | 3.1 LOW |
| Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | |||||