Total
414999 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-32424 | 2026-09-29 | N/A | N/A | ||
| AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, ScreenshotWebPageBlock will store the captured screenshots in a temporary directory. `StepThroughItemsBlock` can be used to iterate `ScreenshotWebPageBlock` multiple times. `StepThroughItemsBlock` does not limit the number of loops. In addition, `ScreenshotWebPageBlock` does not limit the amount of disk space consumed in the current working directory. When a malicious user chooses to screen shot many web pages, the disk space will eventually run out, causing a DoS. Version 0.6.63 patches the issue. | |||||
| CVE-2025-32437 | 2026-09-29 | N/A | N/A | ||
| AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `MediaDurationBlock` will download and store the video in a temporary directory without deleting before all noded are done. `StepThroughItemsBlock` can be used to iterate `MediaDurationBlock` multiple times. `StepThroughItemsBlock` does not limit the number of loops. In addition, `MediaDurationBlock ` does not limit the amount of disk space consumed in the current working directory and does not delete the video after outputing the result. When a malicious user chooses to screen shot many web pages, the disk space will eventually run out, causing a DoS. Version 0.6.63 patches the issue. | |||||
| CVE-2025-55017 | 2026-09-29 | N/A | 9.1 CRITICAL | ||
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.6, from 1.0.0 before 1.3.6. Users are recommended to upgrade to version 1.3.6 and 2.0.6, which fixes the issue. | |||||
| CVE-2026-94400 | 1 Elastic | 1 Kibana | 2026-09-29 | N/A | 6.5 MEDIUM |
| Uncontrolled Resource Consumption (CWE-400) in Kibana can lead denial of service via Excessive Allocation (CAPEC-130) | |||||
| CVE-2026-69359 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-29 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69805 | 1 Microsoft | 3 Microsoft.diagnostics.runtime, Visual Studio 2022, Visual Studio 2026 | 2026-09-29 | N/A | 7.5 HIGH |
| External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-69854 | 1 Microsoft | 1 Spring Cloud | 2026-09-29 | N/A | 9.0 CRITICAL |
| Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-70351 | 1 Microsoft | 1 Webp Image Extension | 2026-09-29 | N/A | 8.8 HIGH |
| Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-77504 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-29 | N/A | 8.8 HIGH |
| Double free in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-77897 | 1 Microsoft | 1 Power Automate For Desktop | 2026-09-29 | N/A | 7.0 HIGH |
| Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-77908 | 1 Microsoft | 1 Dynamics 365 | 2026-09-29 | N/A | 8.8 HIGH |
| Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-77909 | 1 Microsoft | 1 Azure Cyclecloud | 2026-09-29 | N/A | 7.7 HIGH |
| Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network. | |||||
| CVE-2026-69367 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-29 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-69376 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-29 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-69605 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-29 | N/A | 7.0 HIGH |
| Use after free in Microsoft Install Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-89099 | 1 Mongodb | 1 Mongodb | 2026-09-29 | N/A | 7.5 HIGH |
| A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user holding ordinary read-write privileges on a database may be able to trigger this condition over the normal client protocol, resulting in server termination and potential corruption of process memory with user-influenced content. Successful use of this issue may impact the confidentiality, integrity, and availability of the affected server process. | |||||
| CVE-2026-85921 | 1 Microsoft | 1 Windows 11 26h1 | 2026-09-29 | N/A | 8.2 HIGH |
| Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-93393 | 1 Mongodb | 1 C Driver | 2026-09-29 | N/A | 8.1 HIGH |
| A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming encrypted traffic after the TLS handshake completes. No authentication or user interaction is required, because the affected processing occurs before any application-level authentication completes. Triggering this issue may lead to memory corruption in the client process, disclosure of adjacent heap memory, or termination of the process. | |||||
| CVE-2026-97886 | 2026-09-29 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-97060 | 2026-09-29 | N/A | 7.2 HIGH | ||
| X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind roles, or delete users via POST /sys/user/update and POST /sys/user/delete endpoints. | |||||