Total
414888 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-69376 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-29 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-69605 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-29 | N/A | 7.0 HIGH |
| Use after free in Microsoft Install Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-89099 | 1 Mongodb | 1 Mongodb | 2026-09-29 | N/A | 7.5 HIGH |
| A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of process memory with user-influenced content. Successful use of this issue may impact the confidentiality, integrity, and availability of the affected server process. | |||||
| CVE-2026-85921 | 1 Microsoft | 1 Windows 11 26h1 | 2026-09-29 | N/A | 8.2 HIGH |
| Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-93393 | 1 Mongodb | 1 C Driver | 2026-09-29 | N/A | 8.1 HIGH |
| A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process. | |||||
| CVE-2026-97886 | 2026-09-29 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-97060 | 2026-09-29 | N/A | 7.2 HIGH | ||
| X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints. | |||||
| CVE-2026-18117 | 1 Concretecms | 1 Concrete Cms | 2026-09-29 | N/A | 5.4 MEDIUM |
| Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name (customAliasName) because the Edit Alias dialog applied only trim() to the submitted value and performed no input neutralization. An authenticated user holding canWrite (editor) permission on a page could store a malicious alias name that was later rendered unescaped in the administrative Sitemap panel, where it executed automatically in any administrator or editor session that opened the panel, allowing an editor to escalate to administrator through the victim's active session. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. Thanks Nguyen Manh Thuan for reporting. | |||||
| CVE-2026-85417 | 2026-09-29 | N/A | N/A | ||
| Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be recorded in application logs under specific configuration conditions. Individuals with read access to system logs or support bundles can retrieve these credentials, leading to unauthorized read or management access to monitored switch environments | |||||
| CVE-2026-84465 | 2026-09-29 | N/A | N/A | ||
| Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a certificate with a matching name is already stored in the system. An attacker can create their own certificate using the name of a real, previously trusted sender and use it to send a forged email. Zammad will display that email with the same "validly signed" indicator as a genuine message from the real sender, even though the attacker never had access to that sender's actual certificate or private key. This issue is fixed in version 7.1.2. | |||||
| CVE-2026-84460 | 2026-09-29 | N/A | N/A | ||
| Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. Tags are an internal categorization feature and may contain sensitive labels. Ticket IDs are sequential integers, making bulk enumeration straightforward. This issue is fixed in version 7.1.2. | |||||
| CVE-2026-63207 | 2026-09-29 | N/A | N/A | ||
| Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, an authenticated administrator can obtain stored integration credentials in cleartext through the integration administration API. Certain responses do not consistently mask sensitive fields, so configured secrets can be returned in plain text instead of the expected masked placeholder. Both the LDAP and Exchange integrations are affected. This issue is fixed in version 7.1.2. | |||||
| CVE-2026-63006 | 2026-09-29 | N/A | N/A | ||
| Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, attacker-controlled HTML in inbound emails or tickets could bypass the image URL sanitizer using path traversal sequences. When an authenticated agent views the content, the browser resolves the URL to a protected API endpoint and sends the request with the agent's session cookie, enabling side effects such as forced logout without any user interaction. This issue is fixed in version 7.1.2. | |||||
| CVE-2026-17107 | 2026-09-29 | N/A | 8.5 HIGH | ||
| A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster. | |||||
| CVE-2026-102730 | 2026-09-29 | N/A | N/A | ||
| Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demonstrated control-flow hijack — RIP set to a full 8-byte attacker-chosen value (register-verified). Two accompanying OOB reads. All reproduced verbatim under ASan at HEAD `9f1cfdc`. (The affected metadata-parser header states "Some portions generated by Copilot (Sonnet 4.6)" — an AI-generated parser with an unchecked on-flash count.) | |||||
| CVE-2026-102729 | 2026-09-29 | N/A | N/A | ||
| `gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer. | |||||
| CVE-2026-102727 | 2026-09-29 | N/A | N/A | ||
| FTP Passive Data Connection Not Bound to the Authenticated Control Peer | |||||
| CVE-2026-102726 | 2026-09-29 | N/A | N/A | ||
| Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read | |||||
| CVE-2026-102725 | 2026-09-29 | N/A | N/A | ||
| Out-of-bounds Read from Unvalidated MSRP Attribute List Length | |||||
| CVE-2026-102724 | 2026-09-29 | N/A | N/A | ||
| NULL Pointer Dereference When Evicting the Sole MSRP Attribute | |||||