Archive
September 2026
Vulnerabilities first published in this month (UTC), newest first.
6,264 results · Clear filters · Feed
-
High 7.3
risesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection
A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoricProcessServiceImpl.java of the component OAuth2 Resource Filter. Performing a manipulation of the argument year/process…
-
High 8.1CVE-2026-102827 Public exploit
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option sp…
-
High 8.1CVE-2026-102826 Public exploit
simple-git allows command execution through unblocked Git configuration includes
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied th…
-
High 7.5
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
Russh is a Rust SSH client and server library. Prior to 0.63.1, client_read_authenticated in russh/src/client/encrypted.rs forwards CHANNEL_DATA, CHANNEL_EXTENDED_DATA, CHANNEL_EOF, CHANNEL_CLOSE, CHANNEL_OPEN_FAILURE, CHANNEL_SUCCESS, CHANNEL_FAILURE, and CH…
-
High 7.8
IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path.
-
High 8.6
Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX
Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAND flash-translation-layer metadata parser that overwrites a driver function pointer in the control block, giving a demo…
-
High 8.8
DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction.
-
High 7.2
IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing an authenticated privileged CLI user to execute arbitrary commands with root privileges.
-
High 7.1
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the PPP IPCP code parses a peer's Configure-Nak without validating each option's length. A malicious PPP peer can stall the PPP thread indefinitely with a zero-length option, taking the link down…
-
High 7.5
IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be executed as operating system commands by …
-
High 7.1
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP parser uses the attribute list length from the received frame without comparing it with the packet length. An unauthenticated station on the same Layer…
-
High 7.1
NULL pointer dereference when evicting the last MSRP attribute in a participant's list
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, evicting the last attribute in an MRP participant's list writes through a null successor pointer. An unauthenticated station on the same Layer 2 segment can fau…
-
High 7.1
NULL Pointer Dereference on MSRP Attribute Table Exhaustion
In Eclipse ThreadX NetX Duo versions 6.4.0 through 6.5.2.202603a, built with VLAN and SRP support, the MSRP attribute lookup writes through the null pointer returned by its allocator when the ten-entry attribute table is full. An unauthenticated station on th…
-
High 8.1
IBM Guardium Data Protection is affected by multiple vulnerabilities.
IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authenticated remote attacker could exploit this vulnerability to delete files and potentially cause denial of service or impact…
-
High 8.6
Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictio…
-
High 8.7CVE-2026-102718 Public exploit
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the request without checking it against the bytes present, and reads past the end of the packet buffer. A remote, unauthentica…
-
High 8.7
A malformed Session header permanently orphans one packet-pool block per RTSP request
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session header and never releases the response packet it allocated. An unauthenticated client can drain the server's packet pool …
-
High 7.8
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a cached entry matched the preload it was…
-
High 7.1
mDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packet
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for a longer stored one. A host on the local link can send two mDNS records that make a device performing continuous servic…
-
High 7.1
ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanent loop
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area that ends in a one- or two-byte residue, and the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and…
-
High 8.3
Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall
In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with packet chaining, the TFTP server does not bound the length of a received DATA datagram. An unauthenticated peer can upload an oversized datagram that writes memory beyond the re…
-
High 8.5
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a use…
-
High 8.4
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the Trus…
-
High 8.2
The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed PUBLISH costs one packet…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to…
-
High 8.4
Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social eng…
-
High 8.3
Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the re…
-
High 8.3
Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had …
-
High 8.4
Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised…
-
High 8.4
Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who ha…
-
High 8.1
Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code o…
-
High 8.0
Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineer…
-
High 8.3
Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the re…
-
High 8.3
Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromi…
-
High 8.8
Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code …
-
High 8.1
Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised th…
-
High 8.3
Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromis…
-
High 8.8
Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code ins…
-
High 8.8
Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially ex…
-
High 8.8
Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging soc…