Total
396904 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-38352 | 2 Debian, Linux | 2 Debian Linux, Linux Kernel | 2026-09-08 | N/A | 7.8 HIGH |
| In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case. | |||||
| CVE-2026-69855 | 1 Microsoft | 1 Azure Copilot | 2026-09-08 | N/A | 7.7 HIGH |
| Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network. | |||||
| CVE-2026-77642 | 1 Torproject | 1 Tor | 2026-09-08 | N/A | 7.5 HIGH |
| tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019. | |||||
| CVE-2026-84327 | 1 Google | 2 Android, Chrome | 2026-09-08 | N/A | 6.5 MEDIUM |
| Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | |||||
| CVE-2026-70178 | 1 Microsoft | 1 Fabric | 2026-09-08 | N/A | 8.5 HIGH |
| Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-84330 | 1 Google | 2 Android, Chrome | 2026-09-08 | N/A | 5.4 MEDIUM |
| UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium) | |||||
| CVE-2026-83959 | 1 Adobe | 1 Substance 3d Sampler | 2026-09-08 | N/A | 7.8 HIGH |
| Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | |||||
| CVE-2026-80098 | 1 Microsoft | 1 Copilot Studio | 2026-09-08 | N/A | 9.3 CRITICAL |
| Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-84333 | 1 Google | 2 Android, Chrome | 2026-09-08 | N/A | 9.6 CRITICAL |
| Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | |||||
| CVE-2026-65818 | 1 Microsoft | 1 Power Platform | 2026-09-08 | N/A | 8.5 HIGH |
| Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-84352 | 1 Google | 2 Android, Chrome | 2026-09-08 | N/A | 9.6 CRITICAL |
| Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-84353 | 1 Google | 2 Android, Chrome | 2026-09-08 | N/A | 9.6 CRITICAL |
| Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | |||||
| CVE-2026-16693 | 1 Ibm | 1 I | 2026-09-08 | N/A | 4.4 MEDIUM |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to the use of hardcoded cryptographic constants to obfuscate encryption keys. | |||||
| CVE-2026-16892 | 1 Ibm | 1 I | 2026-09-08 | N/A | 5.4 MEDIUM |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication during service-name matching. | |||||
| CVE-2026-17207 | 1 Ibm | 1 I | 2026-09-08 | N/A | 6.5 MEDIUM |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow. | |||||
| CVE-2026-86510 | 2026-09-08 | 9.0 HIGH | 9.9 CRITICAL | ||
| A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2026-86296 | 2026-09-08 | 10.0 HIGH | 10.0 CRITICAL | ||
| A vulnerability was determined in D-Link DIR-822A A_101. This vulnerability affects the function strcpy of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. | |||||
| CVE-2026-86274 | 2026-09-08 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-86221 | 2026-09-08 | 7.5 HIGH | 7.3 HIGH | ||
| A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. The impacted element is the function mysqli_query of the file /admin/modal_add_course1.php. This manipulation of the argument course causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used. | |||||
| CVE-2026-85621 | 2026-09-08 | N/A | 6.5 MEDIUM | ||
| LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each adapter; the QQ adapter performs no Ed25519 signature verification on dispatched message events, and the Feishu adapter only performs an optional static-token comparison that is skipped when no token is configured (the default) and is not a body signature. An unauthenticated attacker who knows the public webhook URL can POST forged inbound messages with an attacker-chosen sender identity and arbitrary text, causing the bot owner's agent to process attacker-controlled input and treat the attacker as a trusted platform sender. | |||||