Total
418208 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-77886 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-09-24 | N/A | 7.5 HIGH |
| Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-77561 | 2026-09-24 | N/A | 5.3 MEDIUM | ||
| Tinyauth is an authentication and authorization server. Prior to 5.1.0, an unauthenticated remote attacker can send POST /api/user/login requests with 257 distinct nonexistent usernames to fill MaxLoginAttemptRecords and activate a global login lockdown. internal/controller/user_controller.go loginHandler passes each attacker-controlled identifier to internal/service/auth_service.go RecordLoginAttempt, which invokes lockdownMode after the map reaches its cap. IsAccountLocked checks that global state before validating unrelated accounts, causing valid users to receive HTTP 429 until auth.loginTimeout expires, approximately 300 seconds by default. The attack can be repeated, but existing authenticated sessions are not invalidated. This issue is fixed in version 5.1.0. | |||||
| CVE-2026-77525 | 2026-09-24 | N/A | 4.2 MEDIUM | ||
| MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load records using global chat_id and chat_record_id values without confirming that the chat belongs to the authorized application. A normal user in the same workspace who knows the chat_id of a persisted non-debug record for a victim's published application can place it under a separate attacker-owned application path to read victim chat records. An attacker with an owned knowledge base and document can also use add_knowledge to copy victim answers while updating the victim record's improve_paragraph_id_list. No fixed version is available as of this review. | |||||
| CVE-2026-77522 | 2026-09-24 | N/A | 4.3 MEDIUM | ||
| MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback, link-local, private, or reserved addresses. The response body is converted into imported document content, allowing a low-privileged user to read cloud metadata or internal HTTP services through the MaxKB server. No fixed version is available as of this review. | |||||
| CVE-2026-77519 | 2026-09-24 | N/A | 5.4 MEDIUM | ||
| MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the is_permanent and expire_time checks used by the standard chat API. A previously valid, non-permanent application key that remains active after expiration can initialize the MCP endpoint, list the published application's tool metadata, invoke tools/call, and create durable application_chat and application_chat_record state even though /chat/api/open rejects the same key. No fixed version is available as of this review. | |||||
| CVE-2026-77503 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 8.4 HIGH |
| Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally. | |||||
| CVE-2026-77502 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-09-24 | N/A | 7.5 HIGH |
| Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-77501 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-09-24 | N/A | 7.5 HIGH |
| Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-77499 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-09-24 | N/A | 7.5 HIGH |
| Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-77498 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-09-24 | N/A | 7.5 HIGH |
| Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-77495 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-77494 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-09-24 | N/A | 7.5 HIGH |
| Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-77493 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 9.8 CRITICAL |
| Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-76898 | 2026-09-24 | N/A | N/A | ||
| draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.3.8, src/main/java/com/mxgraph/online/Utils.java checks IPv6 Unique Local Addresses in Utils.sanitizeUrl() by comparing the text prefixes fc00:: and fd00::, but the JDK returns the expanded address form, so the fc00::/7 range, including the AWS metadata range fd00:ec2::/32, is not blocked. An unauthenticated request to /embed2.js?fetch= can therefore make src/main/java/com/mxgraph/online/EmbedServlet2.java fetch an IPv6 ULA internal resource and reflect the response to the requester. Utils.validatedAddress() uses the same private-address check for the separate ProxyServlet path, which requires ENABLE_DRAWIO_PROXY=1. The primary /embed2.js path requires no proxy feature flag or DNS rebinding, and it can disclose cloud metadata credentials or data from other IPv6-reachable internal services. This issue is fixed in version 30.3.8. | |||||
| CVE-2026-73025 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-09-24 | N/A | 9.8 CRITICAL |
| Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network. | |||||
| CVE-2026-73024 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Services for NFS ONCRPC XDR Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-73023 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-73019 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 4.3 MEDIUM |
| Improper resolution of path equivalence in Windows URL Moniker allows an unauthorized attacker to bypass a security feature over a network. | |||||
| CVE-2026-73018 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-73016 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-24 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | |||||