Total
413905 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-88272 | 2026-09-10 | N/A | 7.2 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted. | |||||
| CVE-2026-88271 | 2026-09-10 | N/A | 8.8 HIGH | ||
| GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR. | |||||
| CVE-2026-88270 | 2026-09-10 | N/A | 6.5 MEDIUM | ||
| GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated. | |||||
| CVE-2026-87925 | 2026-09-10 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affects the function storeCustomerOrderInvoice of the file includes/manage.php. Performing a manipulation of the argument pro_name[] results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-87924 | 2026-09-10 | 6.4 MEDIUM | 6.5 MEDIUM | ||
| A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affects an unknown part of the file includes/invoice_bill.php of the component Invoice Generation. Such manipulation of the argument order_date/invoice_no leads to missing authentication. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-86810 | 2026-09-10 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely. Upgrading to version 1.10.0 is sufficient to resolve this issue. The patch is named 6fc91c49eebdb8bfdfeed71cb50a5d97eac70f24. It is advisable to upgrade the affected component. | |||||
| CVE-2026-86675 | 2026-09-10 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/us_edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-86213 | 2026-09-10 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/university.php of the component Search Handler. The manipulation of the argument book_name/book_author results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-86208 | 2026-09-10 | 7.5 HIGH | 7.3 HIGH | ||
| A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /delete_teacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. | |||||
| CVE-2026-85630 | 2026-09-10 | N/A | 6.1 MEDIUM | ||
| HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method. Any application with fields or field labels where some attributes are built from data rather than literals allows attacker-influenced text in an attribute value that can override the field attributes or embed JavaScript in rendered pages. For example, the RadioGroup widget uses the process_attrs method via the render_option and wrap_radio methods. | |||||
| CVE-2026-85485 | 2026-09-10 | N/A | 6.1 MEDIUM | ||
| HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bootstrap 2 and 3 wrappers splice each error string straight into the surrounding markup. Version 0.410000, the fix for CVE-2026-19872, escaped the equivalent values in the other layouts and wrappers, and 0.410002 extended that to these three. Error messages that contain attacker-influenced content such as rejected field values could embed JavaScript in rendered pages. | |||||
| CVE-2026-85484 | 2026-09-10 | N/A | 6.1 MEDIUM | ||
| HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, Select into a label attribute and the other three into element content. RadioGroup also renders each radio button's own label unescaped. Any application whose option list is built from data rather than literals, using options_from, an options_fieldname method, or the DBIC model, allows attacker-influenced text in a label that can override the options or embed JavaScript in rendered pages. | |||||
| CVE-2026-84819 | 2026-09-10 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions. | |||||
| CVE-2026-84282 | 2026-09-10 | N/A | 6.5 MEDIUM | ||
| A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses. | |||||
| CVE-2026-81801 | 2026-09-10 | N/A | 8.1 HIGH | ||
| Subscriber Settings Change in WP-Stateless <= 4.4.1 versions. | |||||
| CVE-2026-81794 | 2026-09-10 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions. | |||||
| CVE-2026-81787 | 2026-09-10 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. | |||||
| CVE-2026-81782 | 2026-09-10 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions. | |||||
| CVE-2026-50165 | 2026-09-10 | N/A | N/A | ||
| alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner to read system-level configuration secrets through organization/event scoped "single configuration" endpoints. The affected endpoints require organization or event ownership, but they accept an arbitrary configuration key and then return the first matching value from a lookup that includes system-level configuration. As a result, an organization owner can retrieve secrets intended to be administrator-only, including the system API key when it is configured. Version 2.0-M5-2605 fixes the issue. | |||||
| CVE-2026-4897 | 2 Freedesktop, Redhat | 3 Polkit, Enterprise Linux, Openshift Container Platform | 2026-09-10 | N/A | 5.5 MEDIUM |
| A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system. | |||||