Total
415351 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-103041 | 2026-09-30 | N/A | 9.8 CRITICAL | ||
| LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges. | |||||
| CVE-2026-102912 | 2026-09-30 | 5.8 MEDIUM | 4.7 MEDIUM | ||
| A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument date_start/date_end leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. | |||||
| CVE-2026-102909 | 2026-09-30 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/examproper/btn_functions.php. The manipulation of the argument access_code leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-102874 | 2026-09-30 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-102845 | 2026-09-30 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function error_reporting of the file index.php of the component HTTP Response. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-102842 | 2026-09-30 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_user_login_model.php::cekUserLogin of the file application/models/app_user_login_model.php of the component KCFinder File Manager. Such manipulation of the argument ADMIN_RS_KCFINDER leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-102794 | 2026-09-30 | 8.3 HIGH | 9.1 CRITICAL | ||
| A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-102399 | 2026-09-30 | N/A | 5.4 MEDIUM | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions. | |||||
| CVE-2026-102398 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions. | |||||
| CVE-2026-102396 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions. | |||||
| CVE-2026-102395 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions. | |||||
| CVE-2026-102386 | 2026-09-30 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions. | |||||
| CVE-2026-102385 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. | |||||
| CVE-2026-102384 | 2026-09-30 | N/A | 5.9 MEDIUM | ||
| Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions. | |||||
| CVE-2026-102006 | 2026-09-30 | N/A | 5.5 MEDIUM | ||
| In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09 | |||||
| CVE-2026-100513 | 2026-09-30 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions. | |||||
| CVE-2026-100508 | 2026-09-30 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. | |||||
| CVE-2024-42002 | 2026-09-30 | N/A | 8.4 HIGH | ||
| A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code. | |||||
| CVE-2026-95350 | 1 Google | 2 Android, Chrome | 2026-09-30 | N/A | 9.6 CRITICAL |
| Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-95359 | 1 Google | 2 Android, Chrome | 2026-09-30 | N/A | 3.4 LOW |
| Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |||||