Total
397453 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-72686 | 1 Elastic | 1 Elasticsearch | 2026-09-01 | N/A | 6.5 MEDIUM |
| A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the affected node process, producing a denial of service. | |||||
| CVE-2026-19616 | 2026-09-01 | N/A | 7.5 HIGH | ||
| Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects KitLogistic: before v2.2.2. | |||||
| CVE-2026-19702 | 2026-09-01 | N/A | 7.8 HIGH | ||
| Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8. | |||||
| CVE-2026-5956 | 2026-09-01 | N/A | 8.8 HIGH | ||
| Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Ankara Hosting Site Management Panel allows SQL Injection. This issue affects Site Management Panel: through 15062026. | |||||
| CVE-2026-72687 | 1 Elastic | 1 Elasticsearch | 2026-09-01 | N/A | 6.5 MEDIUM |
| A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service. | |||||
| CVE-2026-79770 | 1 Nokogiri | 1 Nokogiri | 2026-09-01 | N/A | 7.5 HIGH |
| Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service. | |||||
| CVE-2026-79771 | 1 Nokogiri | 1 Nokogiri | 2026-09-01 | N/A | 5.3 MEDIUM |
| Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes. | |||||
| CVE-2026-79772 | 1 Nokogiri | 1 Nokogiri | 2026-09-01 | N/A | 5.3 MEDIUM |
| Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid. | |||||
| CVE-2026-19694 | 1 Wireshark | 1 Wireshark | 2026-09-01 | N/A | 4.7 MEDIUM |
| TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service | |||||
| CVE-2026-19695 | 1 Wireshark | 1 Wireshark | 2026-09-01 | N/A | 4.7 MEDIUM |
| Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service | |||||
| CVE-2026-19696 | 2 Microsoft, Wireshark | 2 Windows, Wireshark | 2026-09-01 | N/A | 6.6 MEDIUM |
| Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows | |||||
| CVE-2026-72636 | 1 Elastic | 1 Elasticsearch | 2026-09-01 | N/A | 6.5 MEDIUM |
| Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully. | |||||
| CVE-2026-42170 | 1 Redhat | 1 Enterprise Linux | 2026-09-01 | N/A | 7.8 HIGH |
| A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution. | |||||
| CVE-2026-78465 | 1 Gimp | 1 Gimp | 2026-09-01 | N/A | 7.0 HIGH |
| A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service. | |||||
| CVE-2026-72638 | 1 Elastic | 1 Elasticsearch | 2026-09-01 | N/A | 6.5 MEDIUM |
| Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node. | |||||
| CVE-2026-79902 | 1 Gimp | 1 Gimp | 2026-09-01 | N/A | 5.5 MEDIUM |
| A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service. | |||||
| CVE-2026-82833 | 2026-09-01 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. Affected by this issue is the function ExampleDetail of the file /v1/projects/1/examples/ of the component Project Example Detail Endpoint. Such manipulation leads to improper access controls. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-82487 | 2026-09-01 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-82482 | 2026-09-01 | 4.0 MEDIUM | 3.5 LOW | ||
| A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the component edit_profile Endpoint. The manipulation of the argument Biography leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.6.29 mitigates this issue. Upgrading the affected component is recommended. | |||||
| CVE-2026-78576 | 2026-09-01 | N/A | N/A | ||
| Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage. | |||||