Total
414043 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-84562 | 1 Apple | 1 Macos | 2026-09-17 | N/A | 4.7 MEDIUM |
| A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.6. An app may be able to access protected user data. | |||||
| CVE-2026-84586 | 1 Apple | 2 Macos, Watchos | 2026-09-17 | N/A | 5.5 MEDIUM |
| An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, watchOS 27. A malicious application may be able to leak sensitive user information. | |||||
| CVE-2026-84593 | 1 Apple | 2 Ipados, Iphone Os | 2026-09-17 | N/A | 5.5 MEDIUM |
| A use after free issue was addressed with improved memory management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to cause unexpected system termination. | |||||
| CVE-2026-84603 | 1 Apple | 4 Ipados, Iphone Os, Visionos and 1 more | 2026-09-17 | N/A | 5.5 MEDIUM |
| A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data. | |||||
| CVE-2026-84606 | 1 Apple | 4 Ipados, Iphone Os, Macos and 1 more | 2026-09-17 | N/A | 7.5 HIGH |
| A privacy issue was addressed with improved handling of identifiers. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to identify a user across reinstalls. | |||||
| CVE-2026-69294 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-17 | N/A | 5.5 MEDIUM |
| Generation of error message containing sensitive information in Microsoft COM for Windows allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-69315 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-17 | N/A | 5.5 MEDIUM |
| Exposure of sensitive system information to an unauthorized control sphere in Windows License Manager allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-69339 | 1 Microsoft | 3 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 | 2026-09-17 | N/A | 5.5 MEDIUM |
| Exposure of sensitive system information to an unauthorized control sphere in Windows MIDI Service Module allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-69374 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-17 | N/A | 6.5 MEDIUM |
| Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network. | |||||
| CVE-2026-69390 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-17 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-92960 | 2026-09-17 | N/A | 10.0 CRITICAL | ||
| vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver. | |||||
| CVE-2026-92955 | 2026-09-17 | N/A | 10.0 CRITICAL | ||
| vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions. | |||||
| CVE-2026-92950 | 2026-09-17 | N/A | 8.6 HIGH | ||
| vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process. | |||||
| CVE-2026-92945 | 2026-09-17 | N/A | 4.2 MEDIUM | ||
| vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled. | |||||
| CVE-2026-92939 | 2026-09-17 | N/A | 9.9 CRITICAL | ||
| vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call crypto.setEngine() with a filesystem path to an attacker-supplied native library (for example, one bundled in an untrusted plugin package already written to disk); OpenSSL asks the operating-system dynamic loader to load the file, and the library's constructor executes native code in the host process before engine-symbol validation rejects it. Exploitation requires only the crypto builtin and does not require fs, process, module, child_process, worker_threads, vm, or inspector access, resulting in a sandbox escape and arbitrary native code execution. Fixed in 3.11.7. | |||||
| CVE-2026-92934 | 2026-09-17 | N/A | 9.0 CRITICAL | ||
| vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox. | |||||
| CVE-2026-92772 | 2026-09-17 | N/A | 7.1 HIGH | ||
| Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users with limited roles can install marketplace plugins and control arbitrary properties including identifier, version, and license key to deploy malicious plugins. | |||||
| CVE-2026-91942 | 2026-09-17 | N/A | 5.4 MEDIUM | ||
| crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin and steal API tokens from sessionStorage for authenticated API abuse. | |||||
| CVE-2026-91936 | 2026-09-17 | N/A | 6.8 MEDIUM | ||
| Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag_version and node_version to execute arbitrary commands and steal AWS credentials and Docker Hub tokens. | |||||
| CVE-2026-91926 | 2026-09-17 | N/A | 3.7 LOW | ||
| A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service. | |||||