Total
420933 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-51990 | 2026-09-22 | N/A | 9.8 CRITICAL | ||
| An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component | |||||
| CVE-2026-88403 | 2026-09-22 | N/A | 6.5 MEDIUM | ||
| A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request. | |||||
| CVE-2026-88408 | 2026-09-22 | N/A | 6.5 MEDIUM | ||
| FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. | |||||
| CVE-2026-71645 | 2026-09-22 | N/A | 7.5 HIGH | ||
| An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the exploration state machine | |||||
| CVE-2023-46273 | 2026-09-22 | N/A | 8.8 HIGH | ||
| Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_send. | |||||
| CVE-2026-71642 | 2026-09-22 | N/A | 4.0 MEDIUM | ||
| An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the EGOReplanFSM::checkCollisionCallback() | |||||
| CVE-2026-79393 | 2026-09-22 | N/A | 7.5 HIGH | ||
| A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes. | |||||
| CVE-2026-79312 | 2026-09-22 | N/A | 6.8 MEDIUM | ||
| webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loads that session from the store, and _save() writes back under the same session_id; no rotation after authentication, so a fixed session_id keeps the authenticated state. | |||||
| CVE-2026-88618 | 2026-09-22 | N/A | 6.5 MEDIUM | ||
| 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code. | |||||
| CVE-2023-50459 | 2026-09-22 | N/A | 5.4 MEDIUM | ||
| An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts. | |||||
| CVE-2023-40772 | 2026-09-22 | N/A | 4.3 MEDIUM | ||
| A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component. | |||||
| CVE-2026-79316 | 2026-09-22 | N/A | 7.6 HIGH | ||
| An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary. | |||||
| CVE-2026-79298 | 2026-09-22 | N/A | 8.4 HIGH | ||
| An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrary code via the BOOTia32.efi and a crafted cloak32.dat file on the ESP. | |||||
| CVE-2026-90647 | 2026-09-22 | N/A | 7.4 HIGH | ||
| ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications. | |||||
| CVE-2026-38924 | 2026-09-22 | N/A | 2.9 LOW | ||
| In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena." | |||||
| CVE-2023-24283 | 2026-09-22 | N/A | 2.9 LOW | ||
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of Service (DoS) via a crafted save file. | |||||
| CVE-2023-24285 | 2026-09-22 | N/A | 2.9 LOW | ||
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed. | |||||
| CVE-2023-50460 | 2026-09-22 | N/A | 5.4 MEDIUM | ||
| An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser, and resendUserConfirmation) for any frontend user in the system. | |||||
| CVE-2026-79317 | 2026-09-22 | N/A | 4.8 MEDIUM | ||
| A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the username or password, previously issued session cookies are not revoked, so an attacker who holds a pre-change admin cookie can continue accessing and operating the management interface after the credentials have been rotated. | |||||
| CVE-2026-77166 | 2026-09-22 | N/A | 2.4 LOW | ||
| The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items. | |||||