Tue, Sep 15 · 08:17 PM CDTCVE-2026-76672
9.9/10 · Must read/watchNVDvuln
Summary
A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint. Successful exploitation could
CVECVE-2026-76672
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 15 · 08:17 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-39919
9.8/10 · Must read/watchNVDvuln
Summary
Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing a JPEG 2000 image with mismatched component subsampling factors. When image components declare diff
CVECVE-2026-39919
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 15 · 03:17 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-61516
9.8/10 · Must read/watchNVDvuln
Summary
Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the exposed credential aga
CVECVE-2026-61516
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 08 · 03:18 PM CDT
ModifiedSat, Sep 19 · 03:16 PM CDT
CVE-2026-92018
9.6/10 · Must read/watchNVDvuln
Summary
Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVECVE-2026-92018
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-45363
9.1/10 · Must read/watchNVDvuln
Summary
ruby-jwt is a Ruby implementation of the RFC 7519 OAuth JSON Web Token standard. Prior to 2.10.3 and 3.2.0, JWT.decode(token, '', true, algorithm: 'HS256') accepts an attacker-forged token because OpenSSL::HMAC.digest('SHA256', '', payload) returns a valid digest under an empty key and no empty-key precondition exists
CVECVE-2026-45363
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jul 14 · 10:16 PM CDT
ModifiedSat, Sep 19 · 06:16 PM CDT
CVE-2026-12954
8.8/10 · Worth your timeNVDvuln
Summary
The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the `my_profile_update()` function. This is due to the function performing no nonce verification, no capability check, and no allowlist validation on the meta key supplied via the `acf-ph
CVECVE-2026-12954
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 18 · 08:16 AM CDT
ModifiedSat, Sep 19 · 03:16 PM CDT
CVE-2026-82536
8.8/10 · Worth your timeNVDvuln
Summary
Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute denied shell commands by exploiting the omission of the bash pipe operator from the command parser's operator token set. Attackers can craft a command line with an allowlisted prefix
CVECVE-2026-82536
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 08 · 07:20 PM CDT
ModifiedSat, Sep 19 · 03:17 PM CDT
CVE-2026-92016
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVECVE-2026-92016
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92021
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16.
CVECVE-2026-92021
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92022
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVECVE-2026-92022
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92023
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVECVE-2026-92023
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92024
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVECVE-2026-92024
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92028
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVECVE-2026-92028
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92029
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3.
CVECVE-2026-92029
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92040
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156.
CVECVE-2026-92040
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92046
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVECVE-2026-92046
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92049
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVECVE-2026-92049
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92056
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVECVE-2026-92056
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:16 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92058
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVECVE-2026-92058
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:17 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92060
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVECVE-2026-92060
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:17 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-92067
8.8/10 · Worth your timeNVDvuln
Summary
Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3.
CVECVE-2026-92067
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 01:17 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2024-3727
8.3/10 · Worth your timeNVDvuln
Summary
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
CVECVE-2024-3727
SeverityHIGH
TypeUPDATED
PublishedTue, May 14 · 03:42 PM CDT
ModifiedSat, Sep 19 · 12:16 PM CDT
CVE-2026-13327
8.3/10 · Worth your timeNVDvuln
Summary
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate.
CVECVE-2026-13327
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 08:17 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-91935
8.3/10 · Worth your timeNVDvuln
Summary
Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers with chatflows:create or chatflows:update permissions can exfiltrate LLM provider API keys by redirecting requests to cloud metadata services or internal hosts.
CVECVE-2026-91935
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 04:17 PM CDT
ModifiedSun, Sep 20 · 01:16 AM CDT
CVE-2026-56795
8.2/10 · Worth your timeNVDvuln
Summary
Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
CVECVE-2026-56795
SeverityHIGH
TypeUPDATED
PublishedThu, Sep 17 · 04:17 PM CDT
ModifiedSat, Sep 19 · 03:16 PM CDT
