Total
414858 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-102842 | 2026-09-30 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_user_login_model.php::cekUserLogin of the file application/models/app_user_login_model.php of the component KCFinder File Manager. Such manipulation of the argument ADMIN_RS_KCFINDER leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-102794 | 2026-09-30 | 8.3 HIGH | 9.1 CRITICAL | ||
| A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-102399 | 2026-09-30 | N/A | 5.4 MEDIUM | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions. | |||||
| CVE-2026-102398 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions. | |||||
| CVE-2026-102396 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions. | |||||
| CVE-2026-102395 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions. | |||||
| CVE-2026-102386 | 2026-09-30 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions. | |||||
| CVE-2026-102385 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. | |||||
| CVE-2026-102384 | 2026-09-30 | N/A | 5.9 MEDIUM | ||
| Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions. | |||||
| CVE-2026-102006 | 2026-09-30 | N/A | 5.5 MEDIUM | ||
| In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09 | |||||
| CVE-2026-101109 | 2026-09-30 | N/A | N/A | ||
| Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a double-quoted HTML attribute with no output encoding of any kind. A double-quote character in the parameter closes the attribute, allowing arbitrary markup, including a <script> tag, to be injected into the page. | |||||
| CVE-2026-101108 | 2026-09-30 | N/A | N/A | ||
| Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing, search, and the all-vehicles listing) through a sanitizing function that applies real escaping, but the value is then placed into an unquoted ORDER BY clause, where escaping has no protective effect. | |||||
| CVE-2026-100753 | 2026-09-30 | N/A | N/A | ||
| Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from the request with no escaping and no filtering function of any kind, unlike the adjacent comment field on the same form, which at least receives partial tag-stripping. A " character in the title query parameter breaks out of the HTML attribute the value is placed in, allowing a following <script> element to execute in the browser of anyone who loads the crafted link. | |||||
| CVE-2026-100752 | 2026-09-30 | N/A | N/A | ||
| Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled order_field parameter, concatenated directly into an unquoted SQL clause with no allow-list of real column names and no cast. | |||||
| CVE-2026-100513 | 2026-09-30 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions. | |||||
| CVE-2026-100508 | 2026-09-30 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. | |||||
| CVE-2024-42002 | 2026-09-30 | N/A | 8.4 HIGH | ||
| A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code. | |||||
| CVE-2026-95350 | 1 Google | 2 Android, Chrome | 2026-09-30 | N/A | 9.6 CRITICAL |
| Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-95359 | 1 Google | 2 Android, Chrome | 2026-09-30 | N/A | 3.4 LOW |
| Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-102616 | 2026-09-30 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The sink is injectable on two independent positions, not just one. The vendor was contacted early about this disclosure but did not respond in any way. | |||||