Total
413924 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-87999 | 1 Openwebui | 1 Open Webui | 2026-09-16 | N/A | 7.1 HIGH |
| Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.1, POST /api/v1/retrieval/process/web and POST /api/v1/retrieval/process/web/search in backend/open_webui/retrieval/web/utils.py treated Python's globally routable address classification as proof that a destination was external. An authenticated user could make an Azure-hosted instance fetch and return content from 168.63.129.16, the Azure platform channel, as well as other reserved ranges that the standard classification did not reject. This issue is fixed in version 0.11.1. | |||||
| CVE-2026-73022 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-16 | N/A | 7.0 HIGH |
| Use after free in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-87818 | 1 Gitpython Project | 1 Gitpython | 2026-09-16 | N/A | 6.5 MEDIUM |
| GitPython 3.1.59 fails to restrict the --no-index option in the high-level diff API, allowing attackers to read arbitrary filesystem paths as repository operands. Attackers can combine --no-index with -I/--ignore-matching-lines to create a content-dependent Boolean oracle, repeatedly querying local files to recover single-line secrets through distinguishable success or error responses. | |||||
| CVE-2026-72928 | 1 Microsoft | 1 Windows Server 2025 | 2026-09-16 | N/A | 7.5 HIGH |
| Use after free in Windows DNS allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-77500 | 1 Microsoft | 10 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 7 more | 2026-09-16 | N/A | 7.8 HIGH |
| Release of invalid pointer or reference in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-77899 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-09-16 | N/A | 7.0 HIGH |
| Use after free in Windows Security Center allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-71332 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-16 | N/A | 7.0 HIGH |
| Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-68842 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 | 2026-09-16 | N/A | 5.5 MEDIUM |
| Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-65407 | 1 Apple | 6 Ipados, Iphone Os, Macos and 3 more | 2026-09-16 | N/A | 5.5 MEDIUM |
| A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7, tvOS 26.6, tvOS 27, visionOS 26.6, visionOS 27, watchOS 26.6, watchOS 27. An app may be able to cause unexpected system termination. | |||||
| CVE-2026-65412 | 1 Apple | 5 Ipados, Iphone Os, Macos and 2 more | 2026-09-16 | N/A | 6.5 MEDIUM |
| A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. Processing web content may lead to a denial-of-service. | |||||
| CVE-2026-65413 | 1 Apple | 1 Macos | 2026-09-16 | N/A | 5.5 MEDIUM |
| An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause a denial of service. | |||||
| CVE-2026-84543 | 1 Apple | 1 Macos | 2026-09-16 | N/A | 7.5 HIGH |
| An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory. | |||||
| CVE-2026-86894 | 1 Apple | 1 Macos | 2026-09-16 | N/A | 7.5 HIGH |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to break out of its sandbox. | |||||
| CVE-2026-84541 | 1 Apple | 1 Macos | 2026-09-16 | N/A | 5.5 MEDIUM |
| An input validation issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An application may be able to access restricted files. | |||||
| CVE-2026-90511 | 2026-09-16 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea. This vulnerability affects unknown code of the file src/cn/ylcto/book/servlet/BooksServlet.java of the component listSplit Interface. The manipulation of the argument column results in sql injection. The attack may be performed from remote. The exploit is now public and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. | |||||
| CVE-2026-90506 | 2026-09-16 | 4.6 MEDIUM | 5.0 MEDIUM | ||
| A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This impacts an unknown function of the component Save Account Job. This manipulation causes race condition. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | |||||
| CVE-2026-90501 | 2026-09-16 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT. This issue affects the function HrInfoController.updateHr of the file HrMapper.xml. Such manipulation of the argument Password leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-90496 | 2026-09-16 | 5.8 MEDIUM | 4.7 MEDIUM | ||
| A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11. Affected is the function update_system_module_order/update_dimension_order of the file application/controllers/MoreController.class.php of the component Reorder Handlers. Performing a manipulation of the argument modules/dims results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-84534 | 1 Apple | 4 Ipados, Iphone Os, Macos and 1 more | 2026-09-16 | N/A | 5.5 MEDIUM |
| A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files. | |||||
| CVE-2026-65390 | 1 Apple | 7 Ipados, Iphone Os, Macos and 4 more | 2026-09-16 | N/A | 8.8 HIGH |
| An integer overflow was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption. | |||||