Total
413957 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-75047 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 6.5 MEDIUM |
| In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint | |||||
| CVE-2026-75046 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 4.3 MEDIUM |
| In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint | |||||
| CVE-2026-75044 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 8.1 HIGH |
| In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint | |||||
| CVE-2026-75045 | 1 Jetbrains | 1 Youtrack | 2026-09-15 | N/A | 9.1 CRITICAL |
| In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature | |||||
| CVE-2026-84538 | 1 Apple | 1 Macos | 2026-09-15 | N/A | 6.5 MEDIUM |
| A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause a denial-of-service. | |||||
| CVE-2026-84553 | 1 Apple | 1 Macos | 2026-09-15 | N/A | 7.5 HIGH |
| A resource exhaustion issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause a denial-of-service. | |||||
| CVE-2026-84568 | 1 Apple | 1 Macos | 2026-09-15 | N/A | 7.8 HIGH |
| A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network directory server may be able to execute arbitrary code with root privileges. | |||||
| CVE-2026-84631 | 1 Apple | 1 Macos | 2026-09-15 | N/A | 7.8 HIGH |
| This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges. | |||||
| CVE-2026-86876 | 1 Apple | 5 Ipados, Iphone Os, Macos and 2 more | 2026-09-15 | N/A | 5.2 MEDIUM |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27, watchOS 27. A sandboxed process may be able to circumvent sandbox restrictions. | |||||
| CVE-2026-86879 | 1 Apple | 2 Ipados, Iphone Os | 2026-09-15 | N/A | 6.5 MEDIUM |
| A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A remote attacker may be able to cause a denial-of-service. | |||||
| CVE-2026-86917 | 1 Apple | 1 Macos | 2026-09-15 | N/A | 7.8 HIGH |
| A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges. | |||||
| CVE-2026-87511 | 1 Google | 1 Chrome | 2026-09-15 | N/A | 4.3 MEDIUM |
| Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Low) | |||||
| CVE-2026-87473 | 1 Google | 1 Chrome | 2026-09-15 | N/A | 6.5 MEDIUM |
| Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-87469 | 1 Google | 1 Chrome | 2026-09-15 | N/A | 4.3 MEDIUM |
| Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via crafted network traffic. (Chromium security severity: Low) | |||||
| CVE-2026-85025 | 1 Langflow | 1 Langflow | 2026-09-15 | N/A | 9.8 CRITICAL |
| IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls. | |||||
| CVE-2026-90708 | 2026-09-15 | 7.5 HIGH | 7.3 HIGH | ||
| A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3_user/yot3_pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-90693 | 2026-09-15 | 9.0 HIGH | 9.9 CRITICAL | ||
| A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible. | |||||
| CVE-2026-90537 | 2026-09-15 | N/A | 8.2 HIGH | ||
| WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages. | |||||
| CVE-2026-89263 | 2026-09-15 | N/A | 5.3 MEDIUM | ||
| MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization. | |||||
| CVE-2026-89257 | 2026-09-15 | N/A | 5.4 MEDIUM | ||
| AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory() capability and a CSRF nonce before passing the attacker-supplied $_REQUEST['id'] to Category::deleteAssets(), which recursively removes {systemRootPath}videos/categories/assets/{id}/. It omits the Category::userCanEditCategory() ownership check enforced by the sibling Category::delete(). On installations where the non-default usersCanCreateNewCategories setting is enabled, an authenticated non-admin user with the canUpload capability can send a POST request with an arbitrary category ID and recursively delete any category's on-disk asset directory (icons/images). Category records and videos are not deleted. As of the advisory publication no patched version was available. | |||||