Total
396138 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-89246 | 2026-09-11 | N/A | 5.4 MEDIUM | ||
| WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @ characters that execute when administrators or video owners open the exported CSV file in spreadsheet applications. | |||||
| CVE-2026-89146 | 2026-09-11 | N/A | 7.5 HIGH | ||
| libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arithmetic overflow. A malicious rendezvous server can send a discovery response with an unbounded TTL value that causes the client node process to panic when computing the expiry timer. | |||||
| CVE-2026-79393 | 2026-09-11 | N/A | 7.5 HIGH | ||
| A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes. | |||||
| CVE-2026-73694 | 2026-09-11 | N/A | 7.2 HIGH | ||
| FileRun before 2026.3.0 contains an OS command injection vulnerability caused by a no-op redefinition of escapeshellcmd() in CLI.php that strips shell-metacharacter escaping, allowing attacker-controlled input to reach an exec() sink unsanitized. Attackers can exploit this through an interactive path via image_preview.php with a crafted args parameter requiring superuser authentication, or through a persistent path by storing malicious payloads in thumbnails_ffmpeg_args or thumbnails_ffmpeg_ss that execute when any user triggers video thumbnail generation. | |||||
| CVE-2026-15630 | 2026-09-11 | N/A | 9.9 CRITICAL | ||
| A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body). | |||||
| CVE-2026-68846 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-11 | N/A | 7.1 HIGH |
| Use after free in Windows Kernel allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-77904 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-11 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-77905 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-11 | N/A | 7.0 HIGH |
| Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-78445 | 1 Microsoft | 5 Windows Server 2012, Windows Server 2016, Windows Server 2019 and 2 more | 2026-09-11 | N/A | 9.8 CRITICAL |
| Use after free in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-78446 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-11 | N/A | 5.3 MEDIUM |
| Use after free in Windows Distributed File System (DFS) allows an authorized attacker to deny service over a network. | |||||
| CVE-2026-19004 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-09-11 | N/A | 8.1 HIGH |
| An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution. | |||||
| CVE-2026-78451 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-11 | N/A | 6.8 MEDIUM |
| Untrusted pointer dereference in Microsoft Windows SCSI Class System File allows an unauthorized attacker to elevate privileges with a physical attack. | |||||
| CVE-2026-78452 | 1 Microsoft | 10 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-11 | N/A | 4.6 MEDIUM |
| Out-of-bounds read in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information with a physical attack. | |||||
| CVE-2026-78453 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-09-11 | N/A | 6.5 MEDIUM |
| Integer underflow (wrap or wraparound) in Microsoft Windows SCSI Class System File allows an unauthorized attacker to disclose information over a network. | |||||
| CVE-2026-78454 | 1 Microsoft | 10 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 7 more | 2026-09-11 | N/A | 5.5 MEDIUM |
| Out-of-bounds read in Windows CD-ROM Driver allows an authorized attacker to disclose information locally. | |||||
| CVE-2026-81532 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-09-11 | N/A | 8.8 HIGH |
| A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting application process and may allow unintended code to run within it. | |||||
| CVE-2026-19003 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-09-11 | N/A | 7.8 HIGH |
| A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog. | |||||
| CVE-2026-78457 | 1 Microsoft | 5 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 2 more | 2026-09-11 | N/A | 7.0 HIGH |
| Use after free in Windows Security Health Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-19001 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-09-11 | N/A | 9.8 CRITICAL |
| The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution. | |||||
| CVE-2026-81533 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-09-11 | N/A | 7.1 HIGH |
| An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process. | |||||