Total
420920 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-78631 | 1 Okta | 1 Hyperdrive | 2026-09-22 | N/A | 5.3 MEDIUM |
| The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every successful MFA completion. This insertion of sensitive information into the log file makes a live authentication credential readable by any local user with access to the log file. | |||||
| CVE-2026-69762 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-22 | N/A | 8.0 HIGH |
| Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-23814 | 1 Hpe | 156 Aruba Cx 10000-48y6c \(r8p13a\), Aruba Cx 10000-48y6c \(r8p14a\), Aruba Cx 10000-48y6c \(s0f98a\) and 153 more | 2026-09-22 | N/A | 8.8 HIGH |
| A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior. | |||||
| CVE-2026-23813 | 1 Hpe | 156 Aruba Cx 10000-48y6c \(r8p13a\), Aruba Cx 10000-48y6c \(r8p14a\), Aruba Cx 10000-48y6c \(s0f98a\) and 153 more | 2026-09-22 | N/A | 9.8 CRITICAL |
| A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password. | |||||
| CVE-2026-36467 | 2026-09-22 | N/A | 7.2 HIGH | ||
| Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell. | |||||
| CVE-2023-24287 | 2026-09-22 | N/A | 2.9 LOW | ||
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the "M" command. | |||||
| CVE-2026-88409 | 2026-09-22 | N/A | 8.8 HIGH | ||
| FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. | |||||
| CVE-2026-51990 | 2026-09-22 | N/A | 9.8 CRITICAL | ||
| An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component | |||||
| CVE-2026-88403 | 2026-09-22 | N/A | 6.5 MEDIUM | ||
| A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request. | |||||
| CVE-2026-88408 | 2026-09-22 | N/A | 6.5 MEDIUM | ||
| FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. | |||||
| CVE-2026-71645 | 2026-09-22 | N/A | 7.5 HIGH | ||
| An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the exploration state machine | |||||
| CVE-2023-46273 | 2026-09-22 | N/A | 8.8 HIGH | ||
| Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_send. | |||||
| CVE-2026-71642 | 2026-09-22 | N/A | 4.0 MEDIUM | ||
| An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the EGOReplanFSM::checkCollisionCallback() | |||||
| CVE-2026-79393 | 2026-09-22 | N/A | 7.5 HIGH | ||
| A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes. | |||||
| CVE-2026-79312 | 2026-09-22 | N/A | 6.8 MEDIUM | ||
| webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after authentication, so a fixed session_id keeps the authenticated state. | |||||
| CVE-2026-88618 | 2026-09-22 | N/A | 6.5 MEDIUM | ||
| 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code. | |||||
| CVE-2023-50459 | 2026-09-22 | N/A | 5.4 MEDIUM | ||
| An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts. | |||||
| CVE-2023-40772 | 2026-09-22 | N/A | 4.3 MEDIUM | ||
| A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component. | |||||
| CVE-2026-79316 | 2026-09-22 | N/A | 7.6 HIGH | ||
| An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary. | |||||
| CVE-2026-79298 | 2026-09-22 | N/A | 8.4 HIGH | ||
| An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrary code via the BOOTia32.efi and a crafted cloak32.dat file on the ESP. | |||||