Total
396899 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-78043 | 2026-09-08 | N/A | N/A | ||
| The Windows Interactive Service in OpenVPN 2.7_alpha1 through 2.7.6 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via specially crafted paths | |||||
| CVE-2026-81830 | 2026-09-08 | N/A | N/A | ||
| The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation | |||||
| CVE-2026-84732 | 2026-09-08 | N/A | N/A | ||
| Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via crafted inputs that trigger a timeout integer overflow | |||||
| CVE-2026-75021 | 2026-09-08 | N/A | 8.1 HIGH | ||
| fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the Inspector to a broadly reachable address instead of the intended loopback. As a result the debugging interface can be exposed beyond the local machine, and because the Inspector protocol allows arbitrary code evaluation, a remote party that reaches it can achieve remote code execution on the developer's machine. This affects fastify-cli from 1.5.0 up to 8.0.1. Users should upgrade to fastify-cli 8.0.1, which honors the configured Inspector bind address. | |||||
| CVE-2026-81738 | 2026-09-08 | N/A | N/A | ||
| OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries | |||||
| CVE-2026-86853 | 2026-09-08 | N/A | 4.3 MEDIUM | ||
| A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launches. This could make Firefox for iOS temporarily unusable until the page is closed. This vulnerability was fixed in Firefox for iOS 155.1. | |||||
| CVE-2025-67038 | 1 Lantronix | 66 E213f102s, E213f102s Firmware, E214f002s and 63 more | 2026-09-08 | N/A | 9.8 CRITICAL |
| An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges. | |||||
| CVE-2026-75002 | 1 Roundcube | 1 Webmail | 2026-09-08 | N/A | 7.1 HIGH |
| In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection. | |||||
| CVE-2026-75004 | 1 Roundcube | 1 Webmail | 2026-09-08 | N/A | 4.3 MEDIUM |
| In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin. | |||||
| CVE-2026-75006 | 1 Roundcube | 1 Webmail | 2026-09-08 | N/A | 5.8 MEDIUM |
| In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for CVE-2026-35540, CVE-2026-48843 and CVE-2026-62643. | |||||
| CVE-2026-50093 | 2026-09-08 | N/A | 9.0 CRITICAL | ||
| A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.11.2177). A vulnerability in the OIS web module allows an attacker to upload arbitrary files to the server. Successful exploitation of this vulnerability could allow an attacker to gain root access on the host system, potentially leading to a full compromise of the affected OIS environment. | |||||
| CVE-2026-62645 | 2026-09-08 | N/A | 9.8 CRITICAL | ||
| A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device. | |||||
| CVE-2026-80465 | 2026-09-08 | N/A | 8.7 HIGH | ||
| A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.27). Affected versions of the module do not properly validate the SAML response signature. This could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations. | |||||
| CVE-2026-62654 | 2026-09-08 | N/A | 6.8 MEDIUM | ||
| A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code. | |||||
| CVE-2026-62648 | 2026-09-08 | N/A | 7.5 HIGH | ||
| A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an unauthenticated remote attacker to crash the affected device, causing a reboot and resulting in a denial-of-service condition. | |||||
| CVE-2026-62650 | 2026-09-08 | N/A | 8.8 HIGH | ||
| A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level. | |||||
| CVE-2026-81302 | 2026-09-08 | N/A | 7.8 HIGH | ||
| PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product. | |||||
| CVE-2026-20515 | 2026-09-08 | N/A | 5.5 MEDIUM | ||
| In gpu, there is a possible system crash due to use after free. This could lead to local information disclosure with User execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11122991; Issue ID: MSV-8132. | |||||
| CVE-2026-66840 | 2026-09-08 | N/A | 7.5 HIGH | ||
| XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked. | |||||
| CVE-2026-20510 | 2026-09-08 | N/A | 6.7 MEDIUM | ||
| In camera middleware, there is a possible escalation of privilege due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11134622; Issue ID: MSV-8894. | |||||