Total
420475 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-21105 | 1 Samsung | 2 Android, Collection | 2026-09-23 | N/A | 5.5 MEDIUM |
| Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information. | |||||
| CVE-2026-96756 | 2026-09-23 | N/A | 8.1 HIGH | ||
| orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled. | |||||
| CVE-2026-96549 | 2026-09-23 | 1.7 LOW | 3.3 LOW | ||
| A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssm_pro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java. Such manipulation leads to cleartext storage of sensitive information. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-96514 | 2026-09-23 | 7.5 HIGH | 7.3 HIGH | ||
| A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the component Login Handler. This manipulation of the argument uname causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-95603 | 2026-09-23 | N/A | 7.2 HIGH | ||
| Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions. | |||||
| CVE-2026-95600 | 2026-09-23 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions. | |||||
| CVE-2026-95592 | 2026-09-23 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions. | |||||
| CVE-2026-95530 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions. | |||||
| CVE-2026-95528 | 2026-09-23 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions. | |||||
| CVE-2026-95524 | 2026-09-23 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. | |||||
| CVE-2026-95522 | 2026-09-23 | N/A | 7.6 HIGH | ||
| Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. | |||||
| CVE-2026-95513 | 2026-09-23 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions. | |||||
| CVE-2026-94682 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions. | |||||
| CVE-2026-94671 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | |||||
| CVE-2026-94498 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions. | |||||
| CVE-2026-94457 | 2026-09-23 | N/A | 4.8 MEDIUM | ||
| Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. | |||||
| CVE-2026-94179 | 2026-09-23 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions. | |||||
| CVE-2026-94168 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. | |||||
| CVE-2026-94118 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions. | |||||
| CVE-2026-93774 | 2026-09-23 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions. | |||||