CVEs.

Matching CVEs

1. 7.8High

   CVE-2026-47504 ↗ (opens in a new tab)

   NVIDIA Linux GPU Display Driver contains a vulnerability in the NGX updater where an outdated embedded cryptographic library is susceptible to type confusion. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, or data tampering.

   NVNVIDIA· Sep 30, 2026

2. 7.8High

   CVE-2026-47503 ↗ (opens in a new tab)

   NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a guest VM user may cause an out-of-bounds write by sending a crafted RPC message with invalid performance state list size parameters. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

   NVNVIDIA· Sep 30, 2026

3. 7.8High

   CVE-2026-47502 ↗ (opens in a new tab)

   NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer, where a guest user could cause an integer overflow leading to memory corruption. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

   NVNVIDIA· Sep 30, 2026

4. 7.8High

   CVE-2026-47501 ↗ (opens in a new tab)

   NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write by supplying mismatched memory buffers during event buffer setup. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

   NVNVIDIA· Sep 30, 2026

5. 7.8High

   CVE-2026-47500 ↗ (opens in a new tab)

   NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where improper cleanup of reference counts during error paths could lead to a use-after-free condition. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

   NVNVIDIA· Sep 30, 2026

6. 7.8High

   CVE-2026-47499 ↗ (opens in a new tab)

   NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a guest could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

   NVNVIDIA· Sep 30, 2026

7. 7.8High

   CVE-2026-47498 ↗ (opens in a new tab)

   NVIDIA vGPU Manager contains a vulnerability in the GPU System Processor (GSP) plugin where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC message. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

   NVNVIDIA· Sep 30, 2026

8. 7.8High

   CVE-2026-47497 ↗ (opens in a new tab)

   NVIDIA Virtual GPU Manager contains a vulnerability in the GPU System Processor (GSP) tracing component where a guest VM user may cause improper access by sending crafted data through a shared buffer. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

   NVNVIDIA· Sep 30, 2026

9. 7.3High

   CVE-2026-47496 ↗ (opens in a new tab)

   NVIDIA GPU Display Driver for Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where a guest VM user may cause an out-of-bounds write by sending a specially crafted RPC call to the host. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, and denial of service.

   NVNVIDIA· Sep 30, 2026

10. 7.8High

    CVE-2026-47495 ↗ (opens in a new tab)

    NVIDIA vGPU Virtual GPU Manager for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Sep 30, 2026

11. 7.8High

    CVE-2026-47494 ↗ (opens in a new tab)

    NVIDIA GPU Display Driver for Linux contains a vulnerability where a user might be able to cause a format string issue. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Sep 30, 2026

12. 7.8High

    CVE-2026-47493 ↗ (opens in a new tab)

    NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU resources for which it is not authorized. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Sep 30, 2026

13. 7.8High

    CVE-2026-47491 ↗ (opens in a new tab)

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can cause improper release of memory resources, leaving a mapping accessible after the underlying memory is reused. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Sep 30, 2026

14. 7.8High

    CVE-2026-47489 ↗ (opens in a new tab)

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where permissions on read-only memory might not be preserved. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

    NVNVIDIA· Sep 30, 2026

15. 8.7High

    CVE-2026-86134 ↗ (opens in a new tab)

    A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface, resulting in a denial of service.

    WAWatchGuard· Sep 30, 2026

16. 7.1High

    CVE-2026-90441 ↗ (opens in a new tab)

    A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

    WAWatchGuard· Sep 30, 2026

17. 7.1High

    CVE-2026-86136 ↗ (opens in a new tab)

    A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a specially crafted management API request.

    WAWatchGuard· Sep 30, 2026

18. 8.2High

    CVE-2026-86133 ↗ (opens in a new tab)

    An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted IKEv2 message, resulting in a denial of service.

    WAWatchGuard· Sep 30, 2026

19. 8.2High

    CVE-2026-86132 ↗ (opens in a new tab)

    An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with an AES-GCM cipher suite.

    WAWatchGuard· Sep 30, 2026

20. 8.2High

    CVE-2026-86128 ↗ (opens in a new tab)

    A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.

    WAWatchGuard· Sep 30, 2026

21. 8.7High

    CVE-2026-86104 ↗ (opens in a new tab)

    An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.

    WAWatchGuard· Sep 30, 2026

22. 7.2High

    CVE-2026-86101 ↗ (opens in a new tab)

    An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.

    WAWatchGuard· Sep 30, 2026

23. 8.6High

    CVE-2026-18145 ↗ (opens in a new tab)

    A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request.

    WAWatchGuard· Sep 30, 2026

24. 7.1High

    CVE-2026-18105 ↗ (opens in a new tab)

    An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.

    WAWatchGuard· Sep 30, 2026

25. 8.2High

    CVE-2026-13224 ↗ (opens in a new tab)

    A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.

    WAWatchGuard· Sep 30, 2026

26. 7.5High

    CVE-2026-13046 ↗ (opens in a new tab)

    A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execute arbitrary code in the context of the samld service by causing samld to load a maliciously crafted session file.

    WAWatchGuard· Sep 30, 2026

27. 7.0High

    CVE-2026-92371 ↗ (opens in a new tab)

    TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations on the affected system.

    TETeamViewer· Sep 29, 2026

28. 8.8High

    CVE-2026-92370 ↗ (opens in a new tab)

    An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for restricted features, an attacker can perform actions that were explicitly denied by the victim's configuration. This may result in unauthorized actions and potentially lead to remote code execution on the target system.

    TETeamViewer· Sep 29, 2026

29. 7.3High

    CVE-2026-92369 ↗ (opens in a new tab)

    TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUHORITY/SYSTEM. Exploitation requires successful timing of the race condition and a rollback during installation or update.

    TETeamViewer· Sep 29, 2026

30. 7.8High

    CVE-2026-92368 ↗ (opens in a new tab)

    TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user

    TETeamViewer· Sep 29, 2026

31. 7.8High

    CVE-2026-19743 ↗ (opens in a new tab)

    Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.

    TETeamViewer· Sep 29, 2026

32. 7.8High

    CVE-2026-65102 ↗ (opens in a new tab)

    NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML configuration file. A successful exploit of this vulnerability might lead to denial of service, information disclosure, data tampering.

    NVNVIDIA· Sep 29, 2026

33. 8.7High

    CVE-2026-84739 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to improper sanitization of path components in the merge request diff viewer.

    GIGitLab· Sep 29, 2026

34. 7.3High

    CVE-2026-72668 ↗ (opens in a new tab)

    Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana Agent Builder can lead to privilege escalation. A non-administrative user able to edit a shared agent could cause privileged operations to be carried out under the identity of a higher-privileged user who subsequently interacts with that agent. Where the same user can also author workflows, this can extend to full administrative control of Kibana and of the Elasticsearch cluster.

    ECElastic Cloud· Sep 26, 2026

35. 8.1High

    CVE-2026-100208 ↗ (opens in a new tab)

    Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

    M3Microsoft 365· Sep 25, 2026

36. 7.5High

    CVE-2026-96749 ↗ (opens in a new tab)

    An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single document is built from an unusually large amount of caller-supplied data. Size arithmetic is performed in a signed 32-bit type, and the guard meant to catch the overflow is written in a form whose behavior is not defined by the C language standard. A party with no privileges who can place a very large value into data that an application encodes may, depending on how the native extension was built, cause a write outside the bounds of an allocated buffer ins

    MAMongoDB Atlas· Sep 24, 2026

37. 8.3High

    CVE-2026-96748 ↗ (opens in a new tab)

    PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

    MAMongoDB Atlas· Sep 24, 2026

38. 7.3High

    CVE-2026-96750 ↗ (opens in a new tab)

    MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges. This requires the Compass user to open the shell for the affected database.

    MAMongoDB Atlas· Sep 24, 2026

39. 8.3High

    CVE-2026-96746 ↗ (opens in a new tab)

    An out-of-bounds write in the connection-monitoring logic of the MongoDB C Driver may allow an unauthenticated party who controls name resolution and the responses of the hosts named in a client's connection string to write beyond the end of a heap buffer. This may cause the application using the driver to terminate unexpectedly.

    MAMongoDB Atlas· Sep 24, 2026

40. 7.1High

    CVE-2026-96744 ↗ (opens in a new tab)

    Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value an application uses when acquiring or restoring a lock may take over or prematurely expire a lock held by another process, which can lead to duplicated or conflicting operations.

    MAMongoDB Atlas· Sep 24, 2026

41. 7.7High

    CVE-2026-92470 ↗ (opens in a new tab)

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variable values from debug-mode job traces through the Duo AI troubleshooting feature due to missing authorization checks.

    GIGitLab· Sep 24, 2026

42. 7.8High

    CVE-2026-70125 ↗ (opens in a new tab)

    Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.

    M3Microsoft 365· Sep 23, 2026

43. 7.4High

    CVE-2026-95676 ↗ (opens in a new tab)

    A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply.

    WAWatchGuard· Sep 23, 2026

44. 8.8High

    CVE-2026-96455 ↗ (opens in a new tab)

    The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daemon/app/routers/apps.py, has no authentication. The handler's only dependency is Depends(get_app_manager), which just hands back the manager object from application state, so nothing in the chain ever checks a credential. The endpoint takes an AppInfo body naming a Hugging Face Space. The daemon downloads that Space and installs it as a Python package through install_package in src/reachy_mini/apps/sources/local_common_venv.py, using uv or pip. Installing a

    JFJFrog· Sep 23, 2026

45. 8.2High

    CVE-2026-96454 ↗ (opens in a new tab)

    Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-tauri/capabilities/default.json, which grants IPC access with "remote": { "urls": ["https://*.*"] }. That wildcard tells Tauri to accept IPC from any HTTPS origin, not just the site the application was built to wrap. The second is "withGlobalTauri": true in src-tauri/tauri.conf.json, which puts window.__TAURI__.core.invoke() in reach of ordinary page JavaScript.

    JFJFrog· Sep 23, 2026

46. 7.7High

    CVE-2026-95627 ↗ (opens in a new tab)

    When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope expansion to be recursive, granting read/write access to an entire directory tree after a single user click on a normal-looking OS file dialog. The user has no indication that recursive access was granted, and the expanded scope cannot be revoked for the lifetime of the application.

    JFJFrog· Sep 23, 2026

47. 8.3High

    CVE-2026-95626 ↗ (opens in a new tab)

    Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.

    JFJFrog· Sep 23, 2026

48. 7.4High

    CVE-2026-77912 ↗ (opens in a new tab)

    A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to inject arbitrary HTML attributes into rendered Markdown because the Markdown rendering pipeline rewrote quote characters in already-sanitized HTML without re-sanitizing the result. Crafted Markdown could abuse same-origin JavaScript gadgets to bypass Content Security Policy and gain control of the page DOM when viewed by another user. Successful exploitation could allow an attacker to read content visible to the victim, extract embedded CSRF tokens, perform sta

    GIGitHub· Sep 22, 2026

49. 8.1High

    CVE-2026-87902 ↗ (opens in a new tab)Known exploited

    An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

    WCWordPress.com (Automattic)· Sep 22, 2026

50. 8.8High

    CVE-2026-65179 ↗ (opens in a new tab)

    NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

    NVNVIDIA· Sep 22, 2026