Total
395945 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-25832 | 2026-09-14 | N/A | 3.7 LOW | ||
| In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group. | |||||
| CVE-2026-23792 | 2026-09-14 | N/A | 4.0 MEDIUM | ||
| An issue was discovered in NR RRC in Samsung Mobile Processor and Modem Exynos 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, W1000, Modem 5300, Modem 5400, and Modem 5410. Incorrect handling of unauthenticated downlink RRC Setup messages can cause the baseband to crash. | |||||
| CVE-2026-23790 | 2026-09-14 | N/A | 4.2 MEDIUM | ||
| An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A double-free vulnerability in the Samsung Exynos DPU driver (due to improper pointer management during DMA buffer reallocation) leads to kernel memory corruption and a potential use-after-free. | |||||
| CVE-2026-23787 | 2026-09-14 | N/A | 4.2 MEDIUM | ||
| An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600. A Use-After-Free in the Exynos DRM HDR driver (due to improper cleanup upon vmap failure) leads to a kernel crash. | |||||
| CVE-2026-15451 | 2026-09-14 | N/A | 8.8 HIGH | ||
| The MemberPress Corporate Accounts plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 1.5.39. This is due to a mass assignment vulnerability in the 'add_sub_account_user' function that passes the raw 'userdata' array to 'wp_insert_user' without filtering dangerous keys like role or ID. This makes it possible for authenticated attackers, with subscriber-level access and above who hold a corporate account, to create new administrator accounts or hijack existing administrator accounts by overwriting their email addresses. The vulnerability was partially patched in version 1.5.39. | |||||
| CVE-2026-11355 | 2026-09-14 | N/A | 5.3 MEDIUM | ||
| The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up to, and including, 1.1. These handlers are registered on the wp_ajax_nopriv_* hook and contain no capability check, no nonce verification, and pass user-supplied data directly to update_option(). This makes it possible for unauthenticated attackers to overwrite arbitrary plugin option values stored in the wp_options table, including Point-of-Contact email configuration and skin/branding settings, which can be used to alter the appearance and behavior of the LMS for all site visitors. | |||||
| CVE-2023-50461 | 2026-09-14 | N/A | 8.8 HIGH | ||
| An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration Injection (TYPO3 10.4 and above) and to Arbitrary Code Execution (TYPO3 9.5 and below). A valid backend user account, with access to the Direct Mail Configuration backend module, is needed to exploit this. | |||||
| CVE-2023-46035 | 2026-09-14 | N/A | 5.9 MEDIUM | ||
| The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents. | |||||
| CVE-2023-45858 | 2026-09-14 | N/A | 8.6 HIGH | ||
| A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files. | |||||
| CVE-2023-28148 | 2026-09-14 | N/A | 7.2 HIGH | ||
| A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520. | |||||
| CVE-2023-25500 | 1 Vaadin | 1 Vaadin | 2026-09-14 | N/A | 3.5 LOW |
| Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests. | |||||
| CVE-2023-24285 | 2026-09-14 | N/A | 2.9 LOW | ||
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed. | |||||
| CVE-2023-22632 | 2026-09-14 | N/A | 2.7 LOW | ||
| PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor. | |||||
| CVE-2022-29567 | 1 Vaadin | 1 Vaadin | 2026-09-14 | 5.0 MEDIUM | 5.7 MEDIUM |
| The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side. | |||||
| CVE-2026-90779 | 2026-09-14 | N/A | 7.5 HIGH | ||
| SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process. | |||||
| CVE-2026-90774 | 2026-09-14 | N/A | 7.5 HIGH | ||
| rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations. | |||||
| CVE-2026-90769 | 2026-09-14 | N/A | 7.7 HIGH | ||
| Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests. | |||||
| CVE-2026-90678 | 2026-09-14 | N/A | 7.5 HIGH | ||
| An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer coding on a reused connection. Under those conditions, when an HTTP/3 request carries no Content-Length header, the HTTP/3 multiplexer credits the length declared in a DATA frame header to the stream endpoint's known-input-payload estimate at the moment the frame header is decoded, before the payload has been received, and that declared length is emitted verbatim as the HTTP/1.1 chunk size. A remote unauthenticated client that declares more payload than it delivers and then ends the stream causes HAProxy to announce a chunk larger than the bytes it writes and to return the connection to the idle pool in a desynchronized state. The result is potential HTTP request smuggling on reused backend connections: an attacker can place a request past a frontend rule such as a path-based http-request deny, so that the smuggled request is never seen by HAProxy's HTTP analysis, and can cause concurrent clients' requests, including their request lines and Authorization headers, to be consumed as the attacker's request body and lost. Exploitation is not deterministic; it depends on a race with backend connection pooling, succeeding in a majority of but not all trials during testing, and can be retried freely. The mechanism was introduced in 3.3-dev10; releases 3.2.x and earlier are unaffected. | |||||
| CVE-2026-90560 | 2026-09-14 | N/A | 8.2 HIGH | ||
| zstd-jni versions 1.2.0 through 1.5.7-13 contain an out-of-bounds read vulnerability in the ZstdDictDecompress constructor because offset and length arguments are never validated against the dictionary array bounds. Attackers can supply arbitrary offset or length values to read memory past the end of the supplied array, potentially causing JVM termination. | |||||
| CVE-2026-89094 | 2026-09-14 | N/A | 9.9 CRITICAL | ||
| Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled. | |||||