Total
417620 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-49470 | 2026-09-28 | N/A | N/A | ||
| GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. This issue is fixed in version 11.0.8. | |||||
| CVE-2026-101068 | 2026-09-28 | 6.4 MEDIUM | 6.5 MEDIUM | ||
| A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/zipJsonLinesData.js of the component Create Connection Endpoint. Performing a manipulation of the argument filePath results in path traversal. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. PR #1530 / commit 5f99b4d82 (7.2.5) hardened other export endpoints with checkSecureExportFilePath but omitted this endpoint. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-100722 | 2026-09-28 | N/A | 6.8 MEDIUM | ||
| vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process. | |||||
| CVE-2026-100419 | 2026-09-28 | N/A | 7.0 HIGH | ||
| gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwrite_existing enabled, attackers can craft malicious repository trees where symlink entries replace validated directories, causing subsequent files to be written outside the worktree through the symlink for code execution or file manipulation. | |||||
| CVE-2024-58385 | 2026-09-28 | N/A | 9.8 CRITICAL | ||
| Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands and, on Microsoft SQL Server deployments with xp_cmdshell enabled, write backdoor files and execute arbitrary operating system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2025-02-13. | |||||
| CVE-2024-38639 | 2026-09-28 | N/A | 4.8 MEDIUM | ||
| An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to compromise the security of the system. QTS is not affected. We have already fixed the vulnerability in the following version: | |||||
| CVE-2024-58384 | 2026-09-28 | N/A | 5.4 MEDIUM | ||
| Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests. | |||||
| CVE-2024-53922 | 2026-09-28 | N/A | 5.7 MEDIUM | ||
| An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length check leads to a Denial of Service in the kernel. | |||||
| CVE-2024-56344 | 2026-09-28 | N/A | 5.9 MEDIUM | ||
| IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. | |||||
| CVE-2024-27123 | 2026-09-28 | N/A | N/A | ||
| A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later | |||||
| CVE-2024-23176 | 2026-09-28 | N/A | 5.4 MEDIUM | ||
| An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS. | |||||
| CVE-2024-14029 | 2026-09-28 | N/A | 7.5 HIGH | ||
| Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling, enabling access control bypass, cache poisoning, or connection desynchronization. | |||||
| CVE-2024-44659 | 1 Phpgurukul | 1 Online Shopping Portal | 2026-09-28 | N/A | 9.8 CRITICAL |
| PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the email parameter in forgot-password.php. | |||||
| CVE-2026-76717 | 1 Arubanetworks | 1 Analytics And Location Engine | 2026-09-28 | N/A | 5.3 MEDIUM |
| A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result in the disclosure of sensitive user information, including password hashes, which could be used to facilitate further attacks. | |||||
| CVE-2026-76716 | 1 Arubanetworks | 1 Analytics And Location Engine | 2026-09-28 | N/A | 5.3 MEDIUM |
| Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted input or leveraging improper security configurations. Successful exploitation could result in a denial of service condition or unauthorized access to sensitive information. | |||||
| CVE-2026-76715 | 1 Arubanetworks | 1 Analytics And Location Engine | 2026-09-28 | N/A | 7.1 HIGH |
| A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the affected appliance. | |||||
| CVE-2026-76714 | 1 Arubanetworks | 1 Analytics And Location Engine | 2026-09-28 | N/A | 7.2 HIGH |
| Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise. | |||||
| CVE-2026-69472 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-28 | N/A | 7.0 HIGH |
| Use after free in Windows Devices Human Interface allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-76713 | 1 Arubanetworks | 1 Analytics And Location Engine | 2026-09-28 | N/A | 7.2 HIGH |
| A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full system compromise. | |||||
| CVE-2026-76712 | 1 Arubanetworks | 1 Analytics And Location Engine | 2026-09-28 | N/A | 7.3 HIGH |
| A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications. Successful exploitation could result in the disclosure of sensitive information, bypass of security controls, or a denial of service condition on the affected system. | |||||