Total
397135 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-81161 | 2026-09-02 | N/A | 3.3 LOW | ||
| Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0. | |||||
| CVE-2026-81158 | 2026-09-02 | N/A | 5.3 MEDIUM | ||
| Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0. | |||||
| CVE-2026-76782 | 2026-09-02 | N/A | 7.3 HIGH | ||
| Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. | |||||
| CVE-2026-76759 | 2026-09-02 | N/A | 7.3 HIGH | ||
| Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. | |||||
| CVE-2026-76758 | 2026-09-02 | N/A | 5.9 MEDIUM | ||
| Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*. | |||||
| CVE-2026-73717 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 7.5 HIGH |
| A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise. | |||||
| CVE-2026-73716 | 1 Arubanetworks | 1 Fabric Composer | 2026-09-02 | N/A | 7.5 HIGH |
| A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system, leading to complete compromise of the HPE Networking Fabric Composer host. | |||||
| CVE-2026-59285 | 1 Vmware | 1 Spring For Graphql | 2026-09-02 | N/A | 8.1 HIGH |
| Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spring for GraphQL 2.0.0 - 2.0.4 | |||||
| CVE-2026-51769 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to restart the cloud update check workflow via sending a crafted MQTT message to the cs_broker component. | |||||
| CVE-2026-51705 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| Incorrect access control in the setWiFiMeshName function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rename mesh entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | |||||
| CVE-2026-51611 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message. | |||||
| CVE-2026-37072 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| Veno File Manager Project Veno File Manager Project 4.4.9 is vulnerable to Incorrect Access Control in admin-head-updates.php. | |||||
| CVE-2026-37071 | 2026-09-02 | N/A | 9.8 CRITICAL | ||
| Arbitrary File Rename Leading to Privilege Escalation in Actions::renameFile() function in Veno File Manager Project 4.4.9 allows an authenticated attacker with 'reanme' permission to take over the super administrator account via a specially crafted POST request to the affected endpoint renaming the application configuration file and triggering a rebuild of configuration and resetting super administrator credentials to default values. | |||||
| CVE-2026-37070 | 2026-09-02 | N/A | 6.5 MEDIUM | ||
| Incorrect access control in /vfm-admin/ajax/streamvid.php in Veno File Manager Project in 4.4.9 allows an authenticated attacker to read any uploaded files by other users as long as it knows the path and filename via a specially crafted GET request to the affected endpoint. | |||||
| CVE-2026-37069 | 2026-09-02 | N/A | 5.3 MEDIUM | ||
| Absolute Path Disclosure in /vfm-admin/assets/zipstream/grandt/relativepath/RelativePath.Example1.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to know in which system directory the application code is running by sending a GET request to the endpoint. | |||||
| CVE-2026-37068 | 2026-09-02 | N/A | 8.1 HIGH | ||
| Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint. | |||||
| CVE-2026-37066 | 2026-09-02 | N/A | 6.5 MEDIUM | ||
| Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints. | |||||
| CVE-2026-37065 | 2026-09-02 | N/A | 9.1 CRITICAL | ||
| Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=. | |||||
| CVE-2026-19591 | 2026-09-02 | N/A | 8.8 HIGH | ||
| OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations. | |||||
| CVE-2026-78676 | 1 Gitpython Project | 1 Gitpython | 2026-09-02 | N/A | 9.8 CRITICAL |
| GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated GitPython config write, enabling arbitrary code execution via hook invocation. | |||||