Total
419416 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-96456 | 2026-09-23 | N/A | 6.3 MEDIUM | ||
| The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not the caller, so an attacker in Bluetooth range can ride along on someone else's successful authentication. The authenticated state is kept in a single shared flag on the service instance rather than per device. BlueZ passes the calling device's identity to the characteristic write handler in the options argument, but WriteValue(self, value, options) in src/reachy_mini/daemon/app/services/bluetooth/bluetooth_service.py ignores options entirely. The handler therefore has no idea which device sent a given write, and it cannot tell the authenticated one from any other. Once any device completes the PIN exchange, the flag is set and every nearby device can send CMD_ commands until it resets. An attacker simply waits within radio range for a legitimate user to authenticate, then writes commands into the same window. No PIN is ever guessed or brute-forced. This is the second step of a three-step chain that JFrog documented against the robot. The first is the unrestricted file upload in the media sounds API, tracked as CVE-2026-55419, which places an attacker-controlled script on the filesystem. This issue then provides command access over Bluetooth. The third is the Bluetooth command handler path traversal, tracked as CVE-2026-62661, which runs that script as root. | |||||
| CVE-2026-28664 | 1 Google | 1 Android | 2026-09-23 | N/A | 7.8 HIGH |
| In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-6669 | 2026-09-23 | N/A | 5.9 MEDIUM | ||
| Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupted in frontend builds such as PgBouncer. Because PgBouncer serves all clients from a single process, one backend can in this way stop it from serving traffic for every other database and client it is pooling, so the failure of a single backend is not contained. | |||||
| CVE-2026-6668 | 2026-09-23 | N/A | 7.5 HIGH | ||
| Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all clients from a single process, this saturates a CPU core and stalls every pooled connection until the process is killed. Both unauthenticated and authenticated code paths can reach the overflow. | |||||
| CVE-2026-19888 | 2026-09-23 | N/A | 7.5 HIGH | ||
| Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced as a NULL pointer. The crash occurs before any credential is verified, so no valid account is required. Because PgBouncer serves all clients from a single process, this terminates every pooled connection. | |||||
| CVE-2026-94080 | 2026-09-23 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions. | |||||
| CVE-2026-95601 | 2026-09-23 | N/A | 9.3 CRITICAL | ||
| Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions. | |||||
| CVE-2026-95586 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions. | |||||
| CVE-2026-95515 | 2026-09-23 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. | |||||
| CVE-2026-94487 | 2026-09-23 | N/A | 8.1 HIGH | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions. | |||||
| CVE-2026-93623 | 2026-09-23 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions. | |||||
| CVE-2026-94500 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. | |||||
| CVE-2026-94174 | 2026-09-23 | N/A | 7.6 HIGH | ||
| Administrator SQL Injection in Email Log <= 2.63 versions. | |||||
| CVE-2026-94391 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. | |||||
| CVE-2026-94176 | 2026-09-23 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions. | |||||
| CVE-2026-94124 | 2026-09-23 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in WP EasyCart <= 5.9.4 versions. | |||||
| CVE-2026-95525 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions. | |||||
| CVE-2026-95529 | 2026-09-23 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions. | |||||
| CVE-2026-95593 | 2026-09-23 | N/A | 7.6 HIGH | ||
| Editor SQL Injection in Ultimeter <= 3.0.8 versions. | |||||
| CVE-2026-94680 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | |||||