Total
419416 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-21112 | 1 Samsung | 1 Android | 2026-09-23 | N/A | 5.5 MEDIUM |
| Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability. | |||||
| CVE-2026-77860 | 1 Nlnetlabs | 1 Unbound | 2026-09-23 | N/A | 3.7 LOW |
| In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path. | |||||
| CVE-2026-21107 | 1 Samsung | 1 Notes | 2026-09-23 | N/A | 5.5 MEDIUM |
| Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory. | |||||
| CVE-2026-77955 | 1 Nlnetlabs | 1 Unbound | 2026-09-23 | N/A | 4.4 MEDIUM |
| In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located below (but not at) a trust anchor allow for an attack window where (tampered with) zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution that needs to happen before the ZONEMD check completes. If a zonefile is written to disk (zonefile: option) while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again. If verification fails, the data is not served any more but still persists on disk for future reloads. | |||||
| CVE-2026-21105 | 1 Samsung | 2 Android, Collection | 2026-09-23 | N/A | 5.5 MEDIUM |
| Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information. | |||||
| CVE-2026-96756 | 2026-09-23 | N/A | 8.1 HIGH | ||
| orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled. | |||||
| CVE-2026-96549 | 2026-09-23 | 1.7 LOW | 3.3 LOW | ||
| A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssm_pro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java. Such manipulation leads to cleartext storage of sensitive information. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-96514 | 2026-09-23 | 7.5 HIGH | 7.3 HIGH | ||
| A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. This manipulation of the argument uname causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-95603 | 2026-09-23 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions. | |||||
| CVE-2026-95600 | 2026-09-23 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions. | |||||
| CVE-2026-95592 | 2026-09-23 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions. | |||||
| CVE-2026-95530 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions. | |||||
| CVE-2026-95528 | 2026-09-23 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions. | |||||
| CVE-2026-95524 | 2026-09-23 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. | |||||
| CVE-2026-95522 | 2026-09-23 | N/A | 7.6 HIGH | ||
| Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. | |||||
| CVE-2026-95513 | 2026-09-23 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions. | |||||
| CVE-2026-94682 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions. | |||||
| CVE-2026-94671 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | |||||
| CVE-2026-94498 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions. | |||||
| CVE-2026-94457 | 2026-09-23 | N/A | 4.8 MEDIUM | ||
| Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. | |||||