Total
419404 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-93541 | 2026-09-24 | N/A | 6.5 MEDIUM | ||
| An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a | |||||
| CVE-2026-86858 | 2026-09-24 | N/A | N/A | ||
| ServiceNow has remediated an improper access control security issue that was identified in the ServiceNow AI Platform. This security issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so. | |||||
| CVE-2026-96748 | 2026-09-24 | N/A | 6.5 MEDIUM | ||
| PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results. | |||||
| CVE-2026-96269 | 2026-09-24 | N/A | N/A | ||
| GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affects the intern and unintern functions. This affects the default configuration; no particular user settings are required to trigger it. | |||||
| CVE-2026-93542 | 2026-09-24 | N/A | 6.5 MEDIUM | ||
| An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous servers to crash the X client. | |||||
| CVE-2026-94281 | 2026-09-24 | N/A | 6.5 MEDIUM | ||
| An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. | |||||
| CVE-2026-75649 | 3 Adobe, Apple, Microsoft | 3 Bridge, Macos, Windows | 2026-09-24 | N/A | 7.8 HIGH |
| Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2026-92469 | 2026-09-24 | N/A | 8.1 HIGH | ||
| zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and delete arbitrary users' files and metadata by supplying their identifiers to the delete endpoint. | |||||
| CVE-2026-92780 | 2026-09-24 | N/A | 8.8 HIGH | ||
| KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without proper authorization. | |||||
| CVE-2026-92459 | 2026-09-24 | N/A | 6.5 MEDIUM | ||
| yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office users to claim sales leads without proper permission checks. Attackers can invoke the lead-claim endpoint to reassign leads from other employees to themselves by overwriting the ownerUserId field, with no access logging or quota validation to prevent bulk lead theft. | |||||
| CVE-2026-92795 | 2026-09-24 | N/A | 6.5 MEDIUM | ||
| Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticated users to make the backend fetch internal services. Attackers can construct plugin requests to access cloud metadata endpoints and internal services reachable only from the backend network, reading responses containing sensitive information. | |||||
| CVE-2026-92790 | 2026-09-24 | N/A | 6.5 MEDIUM | ||
| Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls. | |||||
| CVE-2026-92788 | 2026-09-24 | N/A | 8.8 HIGH | ||
| Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's workspace. Authenticated attackers can enumerate predictable table identifiers and execute SQL statements against other workspaces' memory databases to read, insert, or delete data. | |||||
| CVE-2026-92765 | 2026-09-24 | N/A | 6.5 MEDIUM | ||
| ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings from other organizations. Attackers can supply arbitrary scan identifiers to retrieve complete web vulnerability data including titles, severities, statuses, and analyst notes from other tenants. | |||||
| CVE-2026-92785 | 2026-09-24 | N/A | 8.1 HIGH | ||
| Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint. | |||||
| CVE-2026-91987 | 2026-09-24 | N/A | 6.5 MEDIUM | ||
| atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pricing table. Attackers can configure deployments with unknown model identifiers to bypass daily cost caps and exceed budget limits in parallel batch operations. | |||||
| CVE-2026-88097 | 1 Microsoft | 1 Edge Chromium | 2026-09-24 | N/A | 8.1 HIGH |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally. | |||||
| CVE-2026-94054 | 1 Exim | 1 Exim | 2026-09-24 | N/A | 7.0 HIGH |
| Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. | |||||
| CVE-2026-90776 | 2026-09-24 | N/A | 7.5 HIGH | ||
| Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js event loop for several seconds, causing denial of service. | |||||
| CVE-2026-90781 | 2026-09-24 | N/A | 4.4 MEDIUM | ||
| alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters. Attackers can supply a long control-element identifier string through saved state files or command-line arguments to overwrite adjacent stack memory and crash the calling process. | |||||