Total
420500 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-94680 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | |||||
| CVE-2026-95604 | 2026-09-23 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions. | |||||
| CVE-2026-93618 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 2.0.1. | |||||
| CVE-2026-94679 | 2026-09-23 | N/A | 5.4 MEDIUM | ||
| Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions. | |||||
| CVE-2026-93527 | 2026-09-23 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions. | |||||
| CVE-2026-93773 | 2026-09-23 | N/A | 8.5 HIGH | ||
| Contributor SQL Injection in Mollie Forms <= 2.11.0 versions. | |||||
| CVE-2026-95514 | 2026-09-23 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions. | |||||
| CVE-2026-94079 | 2026-09-23 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. | |||||
| CVE-2026-95590 | 2026-09-23 | N/A | 7.1 HIGH | ||
| Subscriber SQL Injection in Tainacan <= 1.2.0 versions. | |||||
| CVE-2026-94461 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. | |||||
| CVE-2026-96548 | 2026-09-23 | 5.1 MEDIUM | 5.6 MEDIUM | ||
| A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity is rated as high. It is indicated that the exploitability is difficult. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-95527 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions. | |||||
| CVE-2026-95602 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1. | |||||
| CVE-2026-93622 | 2026-09-23 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions. | |||||
| CVE-2026-95523 | 2026-09-23 | N/A | 6.5 MEDIUM | ||
| Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. | |||||
| CVE-2026-28666 | 1 Google | 1 Android | 2026-09-23 | N/A | 8.8 HIGH |
| In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check bypass. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-28668 | 1 Google | 1 Android | 2026-09-23 | N/A | 7.8 HIGH |
| In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-28671 | 1 Google | 1 Android | 2026-09-23 | N/A | 3.3 LOW |
| In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-45531 | 1 Google | 1 Android | 2026-09-23 | N/A | 7.8 HIGH |
| In read_boot_region of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-49879 | 1 Google | 1 Android | 2026-09-23 | N/A | 8.8 HIGH |
| In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||