Total
416251 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-102399 | 2026-09-30 | N/A | 5.4 MEDIUM | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions. | |||||
| CVE-2026-102398 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions. | |||||
| CVE-2026-102396 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions. | |||||
| CVE-2026-102395 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions. | |||||
| CVE-2026-102386 | 2026-09-30 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions. | |||||
| CVE-2026-102385 | 2026-09-30 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. | |||||
| CVE-2026-102384 | 2026-09-30 | N/A | 5.9 MEDIUM | ||
| Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions. | |||||
| CVE-2026-102006 | 2026-09-30 | N/A | 5.5 MEDIUM | ||
| In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application. Fixed in Version 26.09 | |||||
| CVE-2026-100513 | 2026-09-30 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions. | |||||
| CVE-2026-100508 | 2026-09-30 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. | |||||
| CVE-2024-42002 | 2026-09-30 | N/A | 8.4 HIGH | ||
| A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS 2 distributions from Crystal Clemmys up to and including Lyrical Luth and Rolling Ridley. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code. | |||||
| CVE-2026-95350 | 1 Google | 2 Android, Chrome | 2026-09-30 | N/A | 9.6 CRITICAL |
| Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-95359 | 1 Google | 2 Android, Chrome | 2026-09-30 | N/A | 3.4 LOW |
| Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-102616 | 2026-09-30 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/processInstanceId results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The sink is injectable on two independent positions, not just one. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-95357 | 1 Google | 2 Android, Chrome | 2026-09-30 | N/A | 9.6 CRITICAL |
| Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-102303 | 1 Google | 2 Android, Chrome | 2026-09-30 | N/A | 4.3 MEDIUM |
| Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-102307 | 1 Google | 2 Android, Chrome | 2026-09-30 | N/A | 4.7 MEDIUM |
| Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-95349 | 1 Google | 2 Android, Chrome | 2026-09-30 | N/A | 9.6 CRITICAL |
| Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-94286 | 2026-09-30 | N/A | 7.1 HIGH | ||
| An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients. | |||||
| CVE-2026-94285 | 2026-09-30 | N/A | 5.1 MEDIUM | ||
| An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients. | |||||