Total
415469 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-102830 | 2026-09-29 | N/A | 6.8 MEDIUM | ||
| JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 3.0.0 until 4.5.11 and 4.6.4, and in JupyterLite Core 0.8.3 and earlier, the Plural-Forms header in a selected third-party language pack can append JavaScript after a valid plural rule because prefix-only regular-expression validation accepts a matching prefix without requiring the entire header to match. JupyterLab passes the accepted expression to new Function, so loading the catalogue and translating a plural string executes the appended code in the authenticated JupyterLab origin. Where Jupyter Server kernels, terminals, and APIs are exposed, the code can use authenticated server APIs to read or modify files and run code. Impact is much more limited in JupyterLite because it typically lacks most exposed Jupyter Server surfaces. The default English locale is unaffected because it does not load a translation catalogue. This issue is fixed in JupyterLab 4.5.11 and 4.6.4 and JupyterLite Core 0.8.4. | |||||
| CVE-2026-11796 | 2026-09-29 | N/A | N/A | ||
| Asset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet, MetadataCacheFlushServlet and ResourceBundleReloadServlet, which could result in denial-of-service conditions affecting application availability. These servlets are designed to perform specific functions within production environment depending on how the Asset Suite application is configured. | |||||
| CVE-2026-75553 | 2026-09-29 | N/A | 2.4 LOW | ||
| Smartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key, which may allow an attacker to retrieve a hard-coded cryptographic key from the affected product. | |||||
| CVE-2026-7395 | 2026-09-29 | N/A | N/A | ||
| Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production environment. | |||||
| CVE-2026-76720 | 2026-09-29 | N/A | 4.3 MEDIUM | ||
| A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. | |||||
| CVE-2026-12268 | 2026-09-29 | N/A | 8.8 HIGH | ||
| ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution. | |||||
| CVE-2026-8066 | 2026-09-29 | N/A | 9.1 CRITICAL | ||
| A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in unauthorized modification of device data or disruption of the device’s intended operation. | |||||
| CVE-2026-8065 | 2026-09-29 | N/A | 9.1 CRITICAL | ||
| An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Successful exploitation could allow the attacker to modify device functionality or compromise the integrity or availability of the device. | |||||
| CVE-2026-19444 | 2026-09-29 | N/A | 6.5 MEDIUM | ||
| A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on the local machine. If the tar binary in the container is malicious, it can execute arbitrary code and emit unexpected output, allowing an attacker who controls container contents to write files to arbitrary paths on the user's local machine when kubectl cp is invoked, limited only by the system permissions of the local user. This issue only affects kubectl clients running on Windows. | |||||
| CVE-2026-76718 | 2026-09-29 | N/A | 8.2 HIGH | ||
| A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions. | |||||
| CVE-2026-12267 | 2026-09-29 | N/A | 7.2 HIGH | ||
| ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution. | |||||
| CVE-2026-12264 | 2026-09-29 | N/A | 8.8 HIGH | ||
| Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution. | |||||
| CVE-2026-12265 | 2026-09-29 | N/A | 8.8 HIGH | ||
| Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations. | |||||
| CVE-2026-76719 | 2026-09-29 | N/A | 8.2 HIGH | ||
| A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions. | |||||
| CVE-2026-8067 | 2026-09-29 | N/A | 6.5 MEDIUM | ||
| An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the RTU500 to reboot through the reset endpoint. Successful exploitation could cause temporary device unavailability and disruption of its intended operation. | |||||
| CVE-2026-12269 | 2026-09-29 | N/A | 8.8 HIGH | ||
| Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host. | |||||
| CVE-2026-97399 | 2026-09-29 | N/A | 3.7 LOW | ||
| The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable. This condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable. | |||||
| CVE-2026-19759 | 2026-09-29 | N/A | N/A | ||
| An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type. This vulnerability was patched on 17 June 2026, and no customer action is needed. | |||||
| CVE-2026-87723 | 2026-09-29 | N/A | N/A | ||
| In Google fuse-archive versions prior to 1.24, an attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway. This allows the attacker to execute arbitrary local code under the security context of the user running the fuse-archive process. The issue was partially mitigated in version 1.22 and fully resolved in 1.24 via refined selective PATH filtering. | |||||
| CVE-2026-102437 | 2026-09-29 | N/A | 7.8 HIGH | ||
| OS Command Injection in internal/gitcmd (git diff filter.clean/smudge invocation) in esengine DeepSeek-Reasonix (Reasonix Studio) allows a local attacker who controls repository content (.gitattributes + .git/config) to execute arbitrary commands via the desktop app's workspace-changes diff viewer. | |||||