Total
396665 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-86504 | 2026-09-09 | N/A | 7.8 HIGH | ||
| In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution | |||||
| CVE-2026-86502 | 2026-09-09 | N/A | 8.4 HIGH | ||
| In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts | |||||
| CVE-2026-86480 | 2026-09-09 | N/A | 9.8 CRITICAL | ||
| In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges | |||||
| CVE-2026-86479 | 2026-09-09 | N/A | 8.1 HIGH | ||
| In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR | |||||
| CVE-2026-86478 | 2026-09-09 | N/A | 9.8 CRITICAL | ||
| In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address | |||||
| CVE-2026-86218 | 1 N-able | 1 N-central | 2026-09-09 | N/A | 9.8 CRITICAL |
| N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. | |||||
| CVE-2026-85880 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 5 more | 2026-09-09 | N/A | 7.8 HIGH |
| Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-83534 | 2026-09-09 | N/A | 6.4 MEDIUM | ||
| PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions | |||||
| CVE-2026-83527 | 2026-09-09 | N/A | 8.1 HIGH | ||
| An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain administrative level access. | |||||
| CVE-2026-81963 | 1 Microsoft | 5 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 2 more | 2026-09-09 | N/A | 7.8 HIGH |
| Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-76967 | 2026-09-09 | N/A | 7.8 HIGH | ||
| SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the crafted content is processed and could lead to arbitrary code execution in the context of the user. This results in a high impact on confidentiality, integrity and availability of the application. | |||||
| CVE-2026-75650 | 1 Adobe | 3 Commerce, Commerce B2b, Magento | 2026-09-09 | N/A | 10.0 CRITICAL |
| Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | |||||
| CVE-2026-69338 | 2026-09-09 | N/A | 7.1 HIGH | ||
| Use after free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-69292 | 2026-09-09 | N/A | 7.0 HIGH | ||
| Double free in Remote Desktop Gateway Service allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-67276 | 2026-09-09 | N/A | N/A | ||
| RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker knowing an authorized RSA modulus can supply a key with exponent one, forge a valid signature, and open an SSH command channel as the target user without the private key.This issue affects only 7.x branch was fixed in versions: 7.23.4 (Long-term) and 7.24.2 (Stable) | |||||
| CVE-2026-66768 | 2026-09-09 | N/A | 9.0 CRITICAL | ||
| SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality. This could allow arbitrary command execution on the victim's machine, leading to a high impact on the confidentiality, integrity, and availability of the affected system. | |||||
| CVE-2026-66767 | 2026-09-09 | N/A | 7.7 HIGH | ||
| SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation could result in high impact on confidentiality and integrity, with low impact on availability of the application. | |||||
| CVE-2026-58240 | 2026-09-09 | N/A | 9.8 CRITICAL | ||
| SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system. | |||||
| CVE-2026-45200 | 2026-09-09 | N/A | 7.8 HIGH | ||
| Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when freed would cause double free and kernel heap corruption. Scenario caused by fabricating a specific combination of flags on the allocation interface that would cause an incorrect double free event when freed. | |||||
| CVE-2026-21042 | 2026-09-09 | N/A | N/A | ||
| Out-of-bounds write in libsavsac.so prior to SMR Jul-2026 Release 1 allows remote attackers to execute arbitrary code. | |||||