Total
420933 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-46035 | 2026-09-22 | N/A | 5.9 MEDIUM | ||
| The svg_optimizer gem before 0.3.0 for Ruby performs entity expansion on untrusted documents. | |||||
| CVE-2026-36470 | 2026-09-22 | N/A | 5.8 MEDIUM | ||
| CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php. | |||||
| CVE-2026-79592 | 2026-09-22 | N/A | 7.5 HIGH | ||
| An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controlled OLE summary offsets. | |||||
| CVE-2026-89086 | 2026-09-22 | N/A | 9.1 CRITICAL | ||
| In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and proceed to declare the signature valid without the required steps that involve the public key. | |||||
| CVE-2026-88622 | 2026-09-22 | N/A | 8.8 HIGH | ||
| NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php. | |||||
| CVE-2026-38999 | 2026-09-22 | N/A | 7.5 HIGH | ||
| A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the server. | |||||
| CVE-2026-79590 | 2026-09-22 | N/A | 6.5 MEDIUM | ||
| A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash. | |||||
| CVE-2026-79396 | 2026-09-22 | N/A | 9.8 CRITICAL | ||
| Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over the camera. | |||||
| CVE-2023-34854 | 2026-09-22 | N/A | 6.6 MEDIUM | ||
| HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function. | |||||
| CVE-2026-36453 | 2026-09-22 | N/A | 7.4 HIGH | ||
| Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables. | |||||
| CVE-2026-79551 | 2026-09-22 | N/A | 7.5 HIGH | ||
| Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key. | |||||
| CVE-2021-3030 | 2026-09-22 | N/A | 6.1 MEDIUM | ||
| Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpicker_more.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the vulnerable component, executes arbitrary JavaScript in the security context of that site. | |||||
| CVE-2026-36472 | 2026-09-22 | N/A | 5.2 MEDIUM | ||
| CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msg_info page. | |||||
| CVE-2026-88406 | 2026-09-22 | N/A | 7.5 HIGH | ||
| FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. | |||||
| CVE-2023-24286 | 2026-09-22 | N/A | 2.9 LOW | ||
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter. | |||||
| CVE-2026-79395 | 2026-09-22 | N/A | 9.8 CRITICAL | ||
| An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote attackers to bypass authentication and execute privileged ONVIF actions (including PTZ control, stream URL retrieval, and system reboot) via a crafted SOAP request supplying the admin username with any arbitrary password when the account's stored password is empty. | |||||
| CVE-2026-88404 | 2026-09-22 | N/A | 9.8 CRITICAL | ||
| A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload. | |||||
| CVE-2026-89094 | 2026-09-22 | N/A | 9.9 CRITICAL | ||
| Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled. | |||||
| CVE-2023-24291 | 2026-09-22 | N/A | 2.9 LOW | ||
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the record length parameter. | |||||
| CVE-2026-88411 | 2026-09-22 | N/A | 7.5 HIGH | ||
| Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application. | |||||