CVE-2026-90526: Schwachstellen-Eintrag (NVD)
A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/save_class.php. The manipulation of the argument Category leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | 2026-08-29 | 2026-09-15 |
|---|---|---|
| ≥90 % | 4 | 0 |
| ≥50 % | 4 | 0 |
| ≥10 % | 3 | 0 |
| <10 % | 304 | 300 |
CVE-2026-92008 | Mozilla Firefox up to 115.40/140.15/153.2/155 CanvasWebGL privileges management (Nessus ID 345908)
A vulnerability, which was classified as critical, has been found in Mozilla Firefox up to 115.40/140.15/153.2/155. This affects an unknown part of the component CanvasWebGL. The manipulation leads to improper privilege management. This vul
CVE-2026-92007 | Mozilla Firefox up to 115.40/140.15/153.2/155 CanvasWebGL privileges management (Nessus ID 345908)
A vulnerability classified as critical was found in Mozilla Firefox up to 115.40/140.15/153.2/155. Affected by this issue is some unknown functionality of the component CanvasWebGL. Executing a manipulation can lead to improper privilege ma
CVE-2026-92006 | Mozilla Firefox up to 115.40/140.15/153.2/155 CanvasWebGL privileges management (Nessus ID 345908)
A vulnerability classified as critical has been found in Mozilla Firefox up to 115.40/140.15/153.2/155. Affected by this vulnerability is an unknown functionality of the component CanvasWebGL. Performing a manipulation results in improper p
CVE-2026-92005 | Mozilla Firefox up to 140.15/153.2/155 Web Codecs use after free (Nessus ID 345908)
A vulnerability described as critical has been identified in Mozilla Firefox up to 140.15/153.2/155. This affects an unknown part of the component Web Codecs. Executing a manipulation can lead to use after free. The identification of this v
CVE-2026-92073 | Mozilla Firefox up to 153.2/155 Enterprise Policies privileges management (Nessus ID 345908)
A vulnerability was found in Mozilla Firefox up to 153.2/155. It has been rated as critical. This impacts an unknown function of the component Enterprise Policies. This manipulation causes improper privilege management. This vulnerability i
CVE-2022-44027 | NetScout nGeniusONE up to 6.3.2 P9 cross site scripting (EUVD-2022-46989)
A vulnerability categorized as problematic has been discovered in NetScout nGeniusONE up to 6.3.2 P9. This vulnerability affects unknown code. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CV
CVE-2022-44026 | NetScout nGeniusONE up to 6.3.2 P9 cross site scripting (EUVD-2022-46988)
A vulnerability was found in NetScout nGeniusONE up to 6.3.2 P9. It has been declared as problematic. Affected by this issue is some unknown functionality. Such manipulation leads to cross site scripting. This vulnerability is listed as CVE
CVE-2022-44025 | NetScout nGeniusONE up to 6.3.2 P9 cross site scripting (EUVD-2022-46987)
A vulnerability was found in NetScout nGeniusONE up to 6.3.2 P9. It has been classified as problematic. Affected by this vulnerability is an unknown functionality. This manipulation causes cross site scripting. This vulnerability is tracked
CVE-2022-44024 | NetScout nGeniusONE up to 6.3.2 P9 cross site scripting (EUVD-2022-46986)
A vulnerability was found in NetScout nGeniusONE up to 6.3.2 P9 and classified as problematic. Affected is an unknown function. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2022-44024. The attack
CVE-2026-91726 | Google Chrome up to 153.0.8010.36 WebGL out-of-bounds (EUVD-2026-79954)
A vulnerability categorized as critical has been discovered in Google Chrome. The affected element is an unknown function of the component WebGL. Such manipulation leads to out-of-bounds read. This vulnerability is uniquely identified as CV
CVE-2026-91717 | Google Chrome up to 153.0.8010.36 missing authentication (EUVD-2026-79971)
A vulnerability classified as problematic has been found in Google Chrome. This affects an unknown part. This manipulation causes missing authentication. This vulnerability is registered as CVE-2026-91717. The attack needs to be launched lo
CVE-2026-91735 | Google Chrome up to 153.0.8010.36 WebUI sandbox (EUVD-2026-79972)
A vulnerability classified as critical was found in Google Chrome. Affected by this issue is some unknown functionality of the component WebUI. Such manipulation leads to sandbox issue. This vulnerability is listed as CVE-2026-91735. The at
CVE-2026-91708 | Google Chrome up to 153.0.8010.36 Network race condition (EUVD-2026-79973)
A vulnerability, which was classified as problematic, was found in Google Chrome. Impacted is an unknown function of the component Network. Executing a manipulation can lead to race condition. This vulnerability appears as CVE-2026-91708. T
CVE-2026-91740 | Google Chrome up to 153.0.8010.36 Skia uninitialized resource (EUVD-2026-79975)
A vulnerability was found in Google Chrome. It has been declared as problematic. Impacted is an unknown function of the component Skia. Such manipulation leads to uninitialized resource. This vulnerability is documented as CVE-2026-91740. T
CVE-2026-91736 | Google Chrome up to 153.0.8010.36 DOM use after free (EUVD-2026-79974)
A vulnerability, which was classified as critical, was found in Google Chrome. This vulnerability affects unknown code of the component DOM. Executing a manipulation can lead to use after free. This vulnerability is registered as CVE-2026-9
CVE-2026-91746 | Google Chrome up to 153.0.8010.36 Compositing integer overflow (EUVD-2026-79979)
A vulnerability, which was classified as problematic, was found in Google Chrome. Affected by this issue is some unknown functionality of the component Compositing. Executing a manipulation can lead to integer overflow. This vulnerability i
CVE-2026-14199 | Grafana Enterprise/OSS up to 13.2.0 Auth Proxy privileges management (Nessus ID 342727 / WID-SEC-2026-3190)
A vulnerability classified as critical has been found in Grafana Enterprise and OSS up to 13.2.0. The impacted element is an unknown function of the component Auth Proxy. Performing a manipulation results in improper privilege management. T
CVE-2026-63020 | F5 BIG-IP prior 17.1.3.4/17.5.1.8/21.0.0.3/21.1.0.1 Configuration Utility Page clickjacking
A vulnerability was found in F5 BIG-IP and classified as problematic. This vulnerability affects unknown code of the component Configuration Utility Page. Such manipulation leads to clickjacking. This vulnerability is uniquely identified as
CVE-2026-73750 | HPE AOS-CX up to 10.18.0001 Authentication access control
A vulnerability, which was classified as very critical, has been found in HPE AOS-CX up to 10.10.1180/10.13.1180/10.16.1051/10.17.1021/10.18.0001. Impacted is an unknown function of the component Authentication Module. The manipulation lead
CVE-2026-52023 | Kamailio up to 6.1.1 ims_registrar_pcscf sec_agree.c parse_sec_agree denial of service (Nessus ID 342476)
A vulnerability labeled as problematic has been found in Kamailio up to 6.1.1. The impacted element is the function parse_sec_agree of the file sec_agree.c of the component ims_registrar_pcscf. Such manipulation leads to denial of service.
CVE-2026-61783 | Wazuh up to 4.14.6 RBAC ossec.conf mask_sensitive_config raw permission
A vulnerability, which was classified as problematic, has been found in Wazuh up to 4.14.6. This affects the function mask_sensitive_config of the file ossec.conf of the component RBAC. Performing a manipulation of the argument raw results
CVE-2026-75050 | JetBrains YouTrack allocation of resources
A vulnerability was found in JetBrains YouTrack and classified as critical. The impacted element is an unknown function. The manipulation results in allocation of resources. This vulnerability is reported as CVE-2026-75050. The attack can b
CVE-2026-44901 | Wazuh DAPI Protocol deserialization
A vulnerability, which was classified as very critical, has been found in Wazuh. Impacted is an unknown function of the component DAPI Protocol. This manipulation causes deserialization. This vulnerability is handled as CVE-2026-44901. The
CVE-2025-65835 | Cordova Plugin 6.0.4 on Android nl.xservices.plugins.ShareChooserPendingIntent denial of service
A vulnerability has been found in Cordova Plugin 6.0.4 on Android and classified as problematic. The affected element is an unknown function of the component nl.xservices.plugins.ShareChooserPendingIntent. Performing a manipulation results
CVE-2026-66014 | JFrog Artifactory up to 7.161.14 privileges management
A vulnerability was found in JFrog Artifactory up to 7.161.14. It has been declared as critical. Impacted is an unknown function. Such manipulation leads to improper privilege management. This vulnerability is traded as CVE-2026-66014. The
CVE-2026-12478 | Red Hat Linux 3.6.6 WebSocket Frame integer overflow
A vulnerability has been found in Red Hat Linux 3.6.6 and classified as critical. This issue affects some unknown processing of the component WebSocket Frame Handler. This manipulation causes integer overflow. This vulnerability appears as
U.S. CISA adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Cisco Secure Email Gateway flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a Cisco Secure Email Ga
CVE-2026-75501 | Calix EXOS up to 6.6.47 UPnP WANIPConnection service missing authentication (EUVD-2026-63988)
A vulnerability, which was classified as critical, has been found in Calix EXOS up to 6.6.47. Affected is an unknown function of the component UPnP WANIPConnection service. This manipulation causes missing authentication. The identification
CVE-2026-76692 | HPE EdgeConnect SD-WAN Gateways up to 9.4.8.2/9.5.8.1/9.6.3.1/9.7.0.0 missing initialization (EUVD-2026-79218)
A vulnerability was found in HPE EdgeConnect SD-WAN Gateways up to 9.4.8.2/9.5.8.1/9.6.3.1/9.7.0.0. It has been classified as critical. The affected element is an unknown function. Performing a manipulation results in missing initialization
CVE-2026-55225 | Strimzi Kafka Operator up to 1.0.0 Cluster Operator watchedNamespace privileges management (EUVD-2026-78883)
A vulnerability described as critical has been identified in Strimzi Kafka Operator up to 1.0.0. The impacted element is an unknown function of the component Cluster Operator. Such manipulation of the argument watchedNamespace leads to impr
CVE-2026-12354 | IBM MQ up to 10.0.0.0 Resource Adapter deserialization (EUVD-2026-78878)
A vulnerability classified as critical has been found in IBM MQ up to 10.0.0.0. The impacted element is an unknown function of the component Resource Adapter. This manipulation causes deserialization. The identification of this vulnerabilit
CVE-2026-88922 | HashiCorp go-getter Archive Decompression privileges management (EUVD-2026-79245)
A vulnerability, which was classified as problematic, was found in HashiCorp go-getter. This issue affects some unknown processing of the component Archive Decompression Handler. Such manipulation leads to improper privilege management. Thi
CVE-2026-44300 | OpenCost up to 1.120.x pkg/costmodel/router.go AddServiceKey input validation (EUVD-2026-78874)
A vulnerability, which was classified as critical, was found in OpenCost up to 1.120.x. Affected by this vulnerability is the function AddServiceKey of the file pkg/costmodel/router.go. The manipulation results in improper input validation.
CVE-2026-12728 | IBM MQ up to 10.0.0.0 deserialization (EUVD-2026-78871)
A vulnerability categorized as very critical has been discovered in IBM MQ up to 10.0.0.0. Affected by this vulnerability is an unknown functionality. Such manipulation leads to deserialization. This vulnerability is documented as CVE-2026-
CVE-2026-12752 | IBM Business Automation Workflow xml external entity reference (EUVD-2026-78865)
A vulnerability marked as critical has been reported in IBM Business Automation Workflow. The affected element is an unknown function. This manipulation causes xml external entity reference. This vulnerability appears as CVE-2026-12752. The
CVE-2026-53710 | IBM MCP Context Forge up to 1.0.1 python_sandbox_server server_fastmcp.py execute_code os command injection (EUVD-2026-78933)
A vulnerability classified as critical was found in IBM MCP Context Forge up to 1.0.1. Impacted is the function execute_code of the file mcp-servers/python/python_sandbox_server/src/python_sandbox_server/server_fastmcp.py of the component p
CVE-2026-58200 | Jhb-software Payload Plugins up to 0.3.x Cloudinary Signature getGenerateSignature.ts cloudinary.utils.api_sign_request paramsToSign improper authorization (EUVD-2026-78825)
A vulnerability identified as problematic has been detected in Jhb-software Payload Plugins up to 0.3.x. Affected by this vulnerability is the function cloudinary.utils.api_sign_request of the file cloudinary/src/getGenerateSignature.ts of
CVE-2026-55690 | StarCitizenWiki EmbedVideo Extension up to 4.0.x EmbedServiceFactory EmbedServiceFactory.php newFromName cross site scripting (EUVD-2026-78831)
A vulnerability described as problematic has been identified in StarCitizenWiki EmbedVideo Extension up to 4.0.x. Affected by this vulnerability is the function EmbedServiceFactory::newFromName of the file includes/EmbedService/EmbedService
CVE-2026-76706 | HPE EdgeConnect SD-WAN Gateways up to 9.4.10/9.5.8/9.6.3/9.7.0 API Endpoint information disclosure (EUVD-2026-79232)
A vulnerability classified as problematic has been found in HPE EdgeConnect SD-WAN Gateways up to 9.4.10/9.5.8/9.6.3/9.7.0. This vulnerability affects unknown code of the component API Endpoint. The manipulation leads to information disclos
CVE-2026-58744 | Google Android input validation (EUVD-2026-79015)
A vulnerability described as very critical has been identified in Google Android. Affected by this issue is some unknown functionality. Such manipulation leads to improper input validation. This vulnerability is referenced as CVE-2026-58744
CVE-2026-58767 | Google Android arm-smmu-v3 arm-smmu-v3.c privileges management
A vulnerability classified as critical was found in Google Android. The affected element is an unknown function of the file arm-smmu-v3.c of the component arm-smmu-v3. The manipulation results in improper privilege management. This vulnerab
CVE-2026-58747 | Google Android arm-smmu-v3 arm-smmu-v3.c smmu_detach_dev privileges management
A vulnerability classified as critical was found in Google Android. This vulnerability affects the function smmu_detach_dev of the file arm-smmu-v3.c of the component arm-smmu-v3. Executing a manipulation can lead to improper privilege mana
CVE-2026-58728 | Google Android ARM64 MMU mmu.h ARM64_TLBI race condition
A vulnerability marked as very critical has been reported in Google Android. Affected by this vulnerability is the function ARM64_TLBI of the file mmu.h of the component ARM64 MMU. This manipulation causes race condition. The identification
DFN-CERT-2026-4853 Xcode: Eine Schwachstelle ermöglicht das Ausspähen von Informationen
Gruppenleiter*in Managed Windows ServerBerlin, Home Office. SBK Siemens-Betriebskrankenkasse. IT-Anwendungsbetreuer DMS &amp; Archivsystem – d.3 ... Weiterlesen
CVE-2026-75757 | Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin's client JavaScript read its state cookies (tenant, actor_resource, actor_primary_key, actor_action, actor_domain, actor_authorizing, actor_paused) by matching the cookie name with an unanchored regular expression (new RegE
Reliance on Cookies without Validation and Integrity Checking vulnerability in ash-project ash_admin lets an attacker who controls a sibling subdomain rebind an admin's session to a different actor, tenant, or authorization mode. AshAdmin'
CVE-2026-82605 | A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading to version 16.0 is sufficient to fix this issue. The affected component should be upgraded.
A vulnerability has been found in BareBones BBEdit up to 15.5.5. The affected element is an unknown function of the component Lasso Language Tokenizer. Such manipulation leads to infinite loop. The attack can be executed remotely. Upgrading
CVE-2026-82604 | A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to version 16.0 is recommended to address this issue. You should upgrade the affected component.
A flaw has been found in BareBones BBEdit up to 15.5.5. Impacted is an unknown function of the component Java Language Module. This manipulation causes uncontrolled recursion. Remote exploitation of the attack is possible. Upgrading to vers
CVE-2026-82603 | A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The attack may be launched remotely. The exploit is now public and may be used.
A vulnerability was detected in SeaCMS up to 13.6. This issue affects some unknown processing of the file /member.php?action=del_pl of the component Comment Cache. The manipulation of the argument itype/vid results in path traversal. The at
CVE-2026-82602 | A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclo
CVE-2026-82601 | A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.
A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross site scripting. The attack can be launched remotely. The exploit has b
CVE-2026-75760 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (An error occurred while generating embeddings: #{inspect(error)}). A plain-string add_error produces an Ash.Error.Changes.InvalidChange
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider ca
CVE-2026-82580 | Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verbatim with Exception.message/1 into the tool-result content. That content is appended to the conversation, emitted as a {:tool_result, ...} stream event, and sent back to the model, which typically relays it to the user. No
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses internal error text to chat users. In AshAi.ToolLoop and AshAi.Tools, an exception raised while executing a tool was serialized verb
CVE-2026-82579 | Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests. AshAi.ToolLoop classifies a model response of :tool_calls, then filters the calls through normalize_tool_calls/2 and unprocessed_tool_calls/2. Both can empty the list: a call missing a valid name, or one reusing a tool_call_id that already has a resul
Loop with Unreachable Exit Condition (Infinite Loop) vulnerability in ash-project ash_ai allows an attacker who can influence a model's output to hang the tool loop and drive unbounded, repeated model requests. AshAi.ToolLoop classifies a
CVE-2026-82564 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution, identity_filter/3 built the update/destroy filter directly from the raw tool arguments as [{key, Map.get(arguments, to_string(key))}] and passed it to Ash.Query.do_filter/2. A map value is parsed as a predicate expression
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy records it never identified, including every row in the table. In AshAi.Tool.Execution
CVE-2026-82600 | A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be in
CVE-2026-81315 | Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Server, with the default allowed_origins: nil, origin_allowed?/3 accepts an origin when uri.host == conn.host and the forwarded scheme is https. Both values are attacker-controlled: conn.host comes from the Host header and the
Origin Validation Error vulnerability in ash-project ash_ai allows a malicious web page to bypass the MCP server's DNS-rebinding protection and issue cross-site requests to a user's local MCP server with that user's actor. In AshAi.Mcp.Ser
CVE-2026-77956 | Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2. The documented prompt: fn input, context -> ... end form lets the prompt content be built from action arguments, so when a prompt action's text incorporates request data, that attacker-controlled text is compiled and run as
Improper Control of Generation of Code (Code Injection) vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2.
CVE-2026-82599 | A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
A vulnerability was identified in SeaCMS up to 13.6. Affected by this vulnerability is the function unlink of the file /member.php?action=chgpwdsubmit of the component Avatar Upload. Such manipulation of the argument oldpic leads to path tr
CVE-2026-82598 | A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the component Template Engine. This manipulation of the argument searchtype causes code injection. It is possible to initiate th
CVE-2026-82597 | A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ussd leads to command injection. The attack can be initiated remo