Total
420935 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-75791 | 2026-09-22 | N/A | 8.6 HIGH | ||
| Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API. | |||||
| CVE-2026-11716 | 2026-09-22 | N/A | 7.5 HIGH | ||
| IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code during queue manager startup due to improper validation of cluster migration data. | |||||
| CVE-2026-18869 | 2026-09-22 | N/A | 6.4 MEDIUM | ||
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access internal network services due to improper validation of FTP PORT and EPRT commands. | |||||
| CVE-2026-11727 | 2026-09-22 | N/A | 8.1 HIGH | ||
| IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 IBM MQ C client could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to improper validation of queue manager responses when requesting AMS policy data. | |||||
| CVE-2026-11710 | 2026-09-22 | N/A | 6.5 MEDIUM | ||
| IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of Content-Length headers. | |||||
| CVE-2026-17619 | 2026-09-22 | N/A | 8.6 HIGH | ||
| IBM Platform RTM is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. | |||||
| CVE-2026-11539 | 2026-09-22 | N/A | 5.3 MEDIUM | ||
| IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector. | |||||
| CVE-2026-11726 | 2026-09-22 | N/A | 8.1 HIGH | ||
| IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message header offset values. | |||||
| CVE-2026-11725 | 2026-09-22 | N/A | 8.8 HIGH | ||
| IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to an integer overflow in MQINQ request processing. | |||||
| CVE-2026-24081 | 1 Qualcomm | 304 Ar8035, Ar8035 Firmware, C110100 and 301 more | 2026-09-22 | N/A | 7.4 HIGH |
| Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled. | |||||
| CVE-2026-25261 | 1 Qualcomm | 48 Cologne, Cologne Firmware, Fastconnect 6700 and 45 more | 2026-09-22 | N/A | 6.7 MEDIUM |
| Memory corruption while processing rear sensor IOCTL calls. | |||||
| CVE-2026-25278 | 1 Qualcomm | 58 Lemans Au Lgit, Lemans Au Lgit Firmware, Lemansau and 55 more | 2026-09-22 | N/A | 7.8 HIGH |
| Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying. | |||||
| CVE-2026-87148 | 1 Oracle | 1 Hyperion Data Relationship Management | 2026-09-22 | N/A | 7.5 HIGH |
| Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Data Relationship Management. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Hyperion Data Relationship Management. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). | |||||
| CVE-2026-69649 | 1 Microsoft | 6 Raw Image Extension, Windows 10 21h2, Windows 10 22h2 and 3 more | 2026-09-22 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-95660 | 2026-09-22 | 7.5 HIGH | 6.3 MEDIUM | ||
| A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-core-v2/src/agent/mcp/config-loader.ts of the component MCP Configuration Loader. The manipulation results in os command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.31.1 is sufficient to fix this issue. It is recommended to upgrade the affected component. Beyond the trust prompt, the fix resolves fd/stty binaries to absolute paths specifically "so untrusted workspaces cannot plant bare-name executables before confirmation," fixing a secondary $PATH path-planting vector alongside the primary untrusted-.mcp.json auto-spawn. | |||||
| CVE-2026-95501 | 2026-09-22 | 5.8 MEDIUM | 4.3 MEDIUM | ||
| A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $_CMS['site'] results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-94491 | 2026-09-22 | 7.5 HIGH | 7.3 HIGH | ||
| A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-94384 | 2026-09-22 | N/A | 8.1 HIGH | ||
| Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected function to escalate privileges and perform AWS API operations that their own IAM identity is explicitly denied, via invocation of a Lambda function that dispatches caller-supplied parameters to privileged service APIs without authorization validation. To remediate this issue, we recommend upgrading to version 5.26 or later. After setup is complete, either delete or disable the sfExecuteAWSService function. If you retain the function, restrict invocation to the intended IAM user only. | |||||
| CVE-2026-94016 | 2026-09-22 | 3.3 LOW | 2.4 LOW | ||
| A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_symptom. Performing a manipulation of the argument txtname results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. | |||||
| CVE-2026-93960 | 2026-09-22 | 4.0 MEDIUM | 4.3 MEDIUM | ||
| A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and might be used. Upgrading to version 0.12.10 is recommended to address this issue. The name of the patch is 68dca5097305fa0065d029587b2233524636025a. Upgrading the affected component is advised. | |||||