Total
420933 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-24284 | 2026-09-22 | N/A | 2.9 LOW | ||
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the is_markable() function. | |||||
| CVE-2026-79318 | 2026-09-22 | N/A | 6.5 MEDIUM | ||
| web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py). | |||||
| CVE-2026-88745 | 2026-09-22 | N/A | 6.1 MEDIUM | ||
| EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell. | |||||
| CVE-2026-88619 | 2026-09-22 | N/A | 8.1 HIGH | ||
| 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality intended for authorized administrators. | |||||
| CVE-2026-39040 | 2026-09-22 | N/A | 5.4 MEDIUM | ||
| BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx. | |||||
| CVE-2026-79394 | 2026-09-22 | N/A | 7.5 HIGH | ||
| An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP. | |||||
| CVE-2026-71641 | 2026-09-22 | N/A | 7.5 HIGH | ||
| An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via thenteraction between traj_server, poscmd_2_odom, and the EGOReplanFSM emergency recovery logic | |||||
| CVE-2026-39038 | 2026-09-22 | N/A | 6.1 MEDIUM | ||
| BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx. | |||||
| CVE-2026-88402 | 2026-09-22 | N/A | 9.8 CRITICAL | ||
| A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements. | |||||
| CVE-2026-93894 | 2026-09-22 | N/A | N/A | ||
| In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.). | |||||
| CVE-2026-35867 | 2026-09-22 | N/A | 3.1 LOW | ||
| A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a scenario where an actor is able to make a "POST /goform/set_LimitClient_cfg" call but does not already have administrative access to the device. | |||||
| CVE-2026-79294 | 2026-09-22 | N/A | 6.1 MEDIUM | ||
| Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component | |||||
| CVE-2026-90668 | 2026-09-22 | N/A | 7.5 HIGH | ||
| The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and unresponsive server) via an HTTP request with an unlimited number of headers, if a websocket or JSON-RPC listener is enabled (disabled by default). | |||||
| CVE-2026-88592 | 2026-09-22 | N/A | 9.1 CRITICAL | ||
| kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter validated by the filter is not the same parameter the controller actually fetches: the filter validates the first non-empty parameter in a fixed priority order, while the controller only reads and fetches urlPath. By supplying both urlPath=<real target> and url=<whitelisted decoy address> in the same request, the decoy passes validation while the unvalidated real target is fetched server-side — and the response body is echoed back to the attacker. | |||||
| CVE-2026-52484 | 2026-09-22 | N/A | 8.8 HIGH | ||
| An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component | |||||
| CVE-2026-88616 | 2026-09-22 | N/A | 8.8 HIGH | ||
| An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components | |||||
| CVE-2026-88743 | 2026-09-22 | N/A | 6.1 MEDIUM | ||
| Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags. | |||||
| CVE-2026-36468 | 2026-09-22 | N/A | 6.1 MEDIUM | ||
| Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload (such as "><script>alert(1)</script>). | |||||
| CVE-2026-88746 | 2026-09-22 | N/A | 7.1 HIGH | ||
| idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php. | |||||
| CVE-2023-50462 | 2026-09-22 | N/A | 5.3 MEDIUM | ||
| An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direct object reference (IDOR) issue with the potential to expose internal content elements. | |||||