Total
397022 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-20355 | 2026-09-02 | N/A | 5.9 MEDIUM | ||
| Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication. | |||||
| CVE-2026-20281 | 2026-09-02 | N/A | 7.5 HIGH | ||
| A vulnerability in Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 that are running Cisco Session Initiation Protocol (SIP) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper memory management when an affected device processes HTTP packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted HTTP packets to the device. A successful exploit could allow the attacker to cause the affected device to continuously consume memory, resulting in a DoS condition. A manual reboot of the device is required to recover from this condition. Note: For this vulnerability to be exploitable, the phone must be registered to Cisco Unified Communications Manager (Unified CM) and have Web Access enabled. Web Access is disabled by default. | |||||
| CVE-2026-78222 | 2026-09-02 | N/A | 7.5 HIGH | ||
| A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2026-20354 | 2026-09-02 | N/A | 5.9 MEDIUM | ||
| Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco Secure Email could allow an unauthenticated, remote attacker to recover plain text from encrypted email messages. These vulnerabilities are due to insufficient validation of message integrity. An attacker could exploit these vulnerabilities by using a machine-in-the-middle technique to intercept and modify traffic between email gateways. A successful exploit could allow the attacker to obtain plaintext content from the encrypted communication. | |||||
| CVE-2026-19754 | 2026-09-02 | N/A | N/A | ||
| Baserow 2.3.3 contains a SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The vulnerable expression is executed when Baserow recalculates formula field values. Because the generated SQL runs through Baserow's database connection, the injected SQL executes with the privileges of the Baserow PostgreSQL role rather than the permissions of the authenticated application user. This issue affects Baserow: 2.3.3. | |||||
| CVE-2026-82463 | 2026-09-02 | N/A | 8.1 HIGH | ||
| pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks. | |||||
| CVE-2026-82018 | 2026-09-02 | N/A | 6.1 MEDIUM | ||
| IGEL OS 12 before 12.9.0, 12.8.3 LTS and IGEL OS 11 before 11.11.150 contain a secure boot bypass vulnerability in the GRUB boot stage that allows physically present attackers to gain unauthorized root access by placing an unsigned empty file named igel.conf on a partition. Attackers can exploit GRUB's fail-open signature verification behavior to drop into an interactive GRUB prompt, then boot the device's own kernel with additional command-line arguments to obtain a root shell with the disk unlocked while leaving TPM PCR values unaltered. | |||||
| CVE-2026-81161 | 2026-09-02 | N/A | 3.3 LOW | ||
| Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0. | |||||
| CVE-2026-81158 | 2026-09-02 | N/A | 5.3 MEDIUM | ||
| Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0. | |||||
| CVE-2026-76782 | 2026-09-02 | N/A | 7.3 HIGH | ||
| Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. | |||||
| CVE-2026-76759 | 2026-09-02 | N/A | 7.3 HIGH | ||
| Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. | |||||
| CVE-2026-76758 | 2026-09-02 | N/A | 5.9 MEDIUM | ||
| Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*. | |||||
| CVE-2026-73717 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 7.5 HIGH |
| A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. | |||||
| CVE-2026-73716 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 7.5 HIGH |
| A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system, leading to complete compromise of the HPE Networking Fabric Composer host. | |||||
| CVE-2026-59285 | 1 Vmware | 1 Spring For Graphql | 2026-09-02 | N/A | 8.1 HIGH |
| Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4 | |||||
| CVE-2026-51769 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component. | |||||
| CVE-2026-51705 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51611 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message. | |||||
| CVE-2026-37072 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php. | |||||
| CVE-2026-37071 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values. | |||||