Total
420948 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-26731 | 1 Totolink | 2 A3002ru-v2, A3002ru Firmware | 2026-09-21 | N/A | 8.8 HIGH |
| TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv6 function. | |||||
| CVE-2026-69648 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-21 | N/A | 7.0 HIGH |
| Use after free in Windows Notification allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-72964 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-21 | N/A | 5.5 MEDIUM |
| Missing authentication for critical function in Windows Internet Connection Sharing (ICS) allows an authorized attacker to perform tampering locally. | |||||
| CVE-2026-72962 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-21 | N/A | 8.2 HIGH |
| Heap-based buffer overflow in Windows USB Video Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-72953 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-21 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-72947 | 1 Microsoft | 10 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 7 more | 2026-09-21 | N/A | 6.4 MEDIUM |
| Integer underflow (wrap or wraparound) in Windows File History Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-72945 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 5 more | 2026-09-21 | N/A | 5.5 MEDIUM |
| Use of uninitialized resource in Windows Task Scheduler allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-72952 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-21 | N/A | 7.0 HIGH |
| Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally. | |||||
| CVE-2026-72949 | 1 Microsoft | 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-09-21 | N/A | 7.5 HIGH |
| Null pointer dereference in Windows SMB Server Network Transport Driver (srvnet.sys) allows an unauthorized attacker to deny service over a network. | |||||
| CVE-2026-72960 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-21 | N/A | 8.8 HIGH |
| Heap-based buffer overflow in Windows Media Player allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-69575 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-21 | N/A | 7.0 HIGH |
| Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-93978 | 2026-09-21 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was identified in code-projects Internship Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Such manipulation of the argument Password leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. | |||||
| CVE-2026-93973 | 2026-09-21 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used. | |||||
| CVE-2026-93968 | 2026-09-21 | 4.7 MEDIUM | 3.8 LOW | ||
| A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing a manipulation can lead to improper privilege management. The attack can be executed remotely. This patch is called 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is best practice to apply a patch to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. | |||||
| CVE-2026-93963 | 2026-09-21 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/controller.php. The manipulation of the argument DEPTID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. | |||||
| CVE-2026-93958 | 2026-09-21 | 8.3 HIGH | 9.1 CRITICAL | ||
| A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. | |||||
| CVE-2026-93742 | 2026-09-21 | 9.0 HIGH | 9.9 CRITICAL | ||
| A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-92729 | 2026-09-21 | N/A | 8.2 HIGH | ||
| SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers can submit arbitrary funnel definitions to retrieve trace analytics including identifiers, durations, span counts, service topology, and error activity without credentials. | |||||
| CVE-2026-91981 | 2026-09-21 | N/A | 4.3 MEDIUM | ||
| Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint. | |||||
| CVE-2026-91971 | 2026-09-21 | N/A | 6.5 MEDIUM | ||
| Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted images that decode to excessive pixel counts. Attackers can upload small images with extreme aspect ratios that consume significant CPU and memory during processing, causing denial of service through repeated or concurrent uploads. | |||||