Total
419035 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-63349 | 2026-09-25 | N/A | N/A | ||
| AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group argument to the backend instead of extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2. | |||||
| CVE-2026-53718 | 2026-09-25 | N/A | 6.4 MEDIUM | ||
| Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRoute can use an extension-managed custom backendRef to reference a backend resource in another namespace without a matching Gateway API ReferenceGrant in the target namespace. The custom-backend branch in internal/gatewayapi/route.go omits validateBackendNamespace, allowing the route-owning namespace to bind to and use the resource without the backend namespace owner's consent and violating the Gateway API cross-namespace authorization model. This issue is fixed in versions 1.7.4 and 1.8.1. | |||||
| CVE-2026-69441 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-25 | N/A | 7.0 HIGH |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69444 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-25 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69445 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-25 | N/A | 7.8 HIGH |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Compressed Folder allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69447 | 1 Microsoft | 5 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 2 more | 2026-09-25 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Audio Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69448 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-25 | N/A | 7.0 HIGH |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69449 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-25 | N/A | 6.7 MEDIUM |
| Heap-based buffer overflow in Windows BitLocker allows an authorized attacker to execute code locally. | |||||
| CVE-2026-25264 | 2 Microsoft, Qualcomm | 2 Windows, Software Center | 2026-09-25 | N/A | 8.8 HIGH |
| Privilege escalation due to weak configuration during package extraction process. | |||||
| CVE-2026-25254 | 1 Qualcomm | 1 Software Center | 2026-09-25 | N/A | 9.8 CRITICAL |
| Improper authorization leads to Remote Code Execution via SocketIO interface. | |||||
| CVE-2026-25265 | 2 Microsoft, Qualcomm | 2 Windows, Software Center | 2026-09-25 | N/A | 8.8 HIGH |
| Privilege escalation due to weak configuration while temporary file handling. | |||||
| CVE-2026-61413 | 1 Dell | 1 Policy Manager For Secure Connect Gateway | 2026-09-25 | N/A | 6.8 MEDIUM |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Privilege Management vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. | |||||
| CVE-2026-71177 | 1 Dell | 1 Policy Manager For Secure Connect Gateway | 2026-09-25 | N/A | 5.4 MEDIUM |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Frames vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges and Session theft. | |||||
| CVE-2026-73586 | 1 Dell | 1 Policy Manager For Secure Connect Gateway | 2026-09-25 | N/A | 6.4 MEDIUM |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism bypass, and Unauthorized access. | |||||
| CVE-2026-73587 | 1 Dell | 1 Policy Manager For Secure Connect Gateway | 2026-09-25 | N/A | 6.8 MEDIUM |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Protection mechanism bypass. | |||||
| CVE-2026-73588 | 1 Dell | 1 Policy Manager For Secure Connect Gateway | 2026-09-25 | N/A | 7.4 HIGH |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. | |||||
| CVE-2026-73589 | 1 Dell | 1 Policy Manager For Secure Connect Gateway | 2026-09-25 | N/A | 6.3 MEDIUM |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access. | |||||
| CVE-2026-73591 | 1 Dell | 1 Policy Manager For Secure Connect Gateway | 2026-09-25 | N/A | 7.5 HIGH |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. | |||||
| CVE-2026-85724 | 1 Moquette | 1 Moquette | 2026-09-25 | N/A | 9.6 CRITICAL |
| Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses + or # in either identity can broaden the substituted filter and gain cross-tenant read and write access. A # identity can also produce an invalid filter that triggers a NullPointerException in Topic.match and disrupts session processing. This issue is fixed in version 0.18.1. | |||||
| CVE-2026-95842 | 1 Moquette | 1 Moquette | 2026-09-25 | N/A | 7.5 HIGH |
| Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions, preventing every co-located client from processing PUBLISH, SUBSCRIBE, PUBACK, and other commands. An attacker can select client IDs that map across the available loops to disrupt session processing for the entire broker. This issue is fixed in version 0.18.1. | |||||