Total
416408 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-96651 | 1 Plex | 1 Media Server | 2026-09-29 | N/A | 6.5 MEDIUM |
| Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the PlexOnlineToken, which grants control of the Plex account and server. A LAN-adjacent attacker with a client-supplied X-Forwarded-For header could exploit the same issue. | |||||
| CVE-2026-65113 | 2 Linux, Nvidia | 2 Linux Kernel, Infra Controller | 2026-09-29 | N/A | 9.8 CRITICAL |
| NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure. | |||||
| CVE-2026-65115 | 2 Linux, Nvidia | 2 Linux Kernel, Infra Controller | 2026-09-29 | N/A | 6.5 MEDIUM |
| NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. A successful exploit of this vulnerability may lead to denial of service. | |||||
| CVE-2026-65117 | 2 Linux, Nvidia | 2 Linux Kernel, Infra Controller | 2026-09-29 | N/A | 5.0 MEDIUM |
| NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure. | |||||
| CVE-2026-69365 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-29 | N/A | 8.0 HIGH |
| Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-65124 | 2 Linux, Nvidia | 2 Linux Kernel, Infra Controller | 2026-09-29 | N/A | 5.9 MEDIUM |
| NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of this vulnerability might lead to data tampering and denial of service. | |||||
| CVE-2026-65125 | 2 Linux, Nvidia | 2 Linux Kernel, Infra Controller | 2026-09-29 | N/A | 6.6 MEDIUM |
| NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and denial of service. | |||||
| CVE-2026-65126 | 2 Linux, Nvidia | 2 Linux Kernel, Infra Controller | 2026-09-29 | N/A | 5.0 MEDIUM |
| NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workflow. A successful exploit of this vulnerability might lead to data tampering, denial of service, and information disclosure. | |||||
| CVE-2026-97897 | 2026-09-29 | 4.0 MEDIUM | 3.5 LOW | ||
| A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php of the component TinyMCE Media Upload. The manipulation results in cross site scripting. The attack may be performed from remote. Upgrading to version 2.2.6 is capable of addressing this issue. The patch is identified as 734aa10ae6c2ffa4c96c8869a89aa66940e4d345. You should upgrade the affected component. | |||||
| CVE-2026-71483 | 2026-09-29 | N/A | N/A | ||
| Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in employee/templates/employee_nav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an authenticated employee or administrator reaches the employee filter, allowing access to browser-visible session data and actions with the victim's application privileges. This issue is fixed in version 1.6.0. | |||||
| CVE-2026-55214 | 2026-09-29 | N/A | N/A | ||
| GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8. | |||||
| CVE-2026-53610 | 2026-09-29 | N/A | N/A | ||
| GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. This issue is fixed in version 11.0.8. | |||||
| CVE-2026-49469 | 2026-09-29 | N/A | N/A | ||
| GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can submit crafted criteria through the user import feature to bypass the configured default LDAP filter. This allows access to LDAP objects that the default filter was intended to exclude. This issue is fixed in versions 11.0.8 and 10.0.26. | |||||
| CVE-2026-102634 | 2026-09-29 | N/A | 7.5 HIGH | ||
| SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout. | |||||
| CVE-2026-100537 | 2026-09-29 | N/A | 3.1 LOW | ||
| OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory automatic recall. In deployments that use Active Memory together with requester-specific tool rules, deterministic and hidden recall paths can retrieve durable memory and inject it into the agent's context even when toolsBySender explicitly denies that requester access to the memory tools (memory_search, memory_get). As a result, an admitted but denied sender can receive information derived from durable memory in the agent's response without directly invoking any memory tool. The issue is fixed in 2026.8.1. | |||||
| CVE-2026-100533 | 2026-09-29 | N/A | 5.3 MEDIUM | ||
| OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the configured workspace boundary. | |||||
| CVE-2026-100529 | 2026-09-29 | N/A | 6.4 MEDIUM | ||
| OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows attackers to reuse standing grants for unreviewed paths. Attackers can exploit glob metacharacter interpretation and node display name reuse to access sibling paths or different nodes beyond the operator's original approval scope. | |||||
| CVE-2026-100521 | 2026-09-29 | N/A | 6.1 MEDIUM | ||
| Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, including administrators. | |||||
| CVE-2026-100304 | 2026-09-29 | N/A | 5.3 MEDIUM | ||
| TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providing a known dataId to the GET /user/form/data/details endpoint after the form has been permanently deleted. | |||||
| CVE-2026-65128 | 2 Linux, Nvidia | 2 Linux Kernel, Infra Controller | 2026-09-29 | N/A | 8.8 HIGH |
| NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure. | |||||