CVE-2026 list

CVE-2026 records published in September 2026

Page 15 of 15: records 14,001 to 14,718 of the 14,718 published in September 2026, newest first. The first page carries the figures for September 2026.

CVE-2026 records published in September 2026, newest first: records 14,001 to 14,718 of 14,718
CVE Summary CVSS EPSS Published Signals
CVE-2026-84676Jenkins Parameterized Remote Trigger Plugin missing encryption4.3CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-84675Jenkins TICS Plugin OS command injection7.4CISA ADP v3.11.2%2026-09-02Fix
CVE-2026-84674Jenkins XebiaLabs XL Deploy Plugin missing authorization5.4CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-84673Jenkins Customizable Header Plugin cross-site scripting8.8CISA ADP v3.10.5%2026-09-02Fix
CVE-2026-84672Jenkins Microsoft Entra ID (previously Azure AD) Plugin insecure direct object reference8.8CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-84671Jenkins File Parameter Plugin path traversal8.8CISA ADP v3.10.8%2026-09-02Fix
CVE-2026-84670Jenkins Performance Plugin deserialization of untrusted data8.8CISA ADP v3.10.6%2026-09-02Fix
CVE-2026-84669Jenkins Allure Plugin path traversal8.8CISA ADP v3.10.5%2026-09-02Fix
CVE-2026-84668Jenkins SAML Plugin improper access control8.8CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-84667Jenkins ThinBackup Plugin path traversal7.1CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-84666Jenkins Job Configuration History Plugin download without integrity check5.4CISA ADP v3.10.1%2026-09-02Fix
CVE-2026-84665Jenkins SonarQube Scanner Plugin cross-site scripting8.0CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-84664Jenkins GitLab Plugin modification of assumed-immutable data5.4CISA ADP v3.10.1%2026-09-02Fix
CVE-2026-84663Jenkins Pipeline: Groovy Libraries Plugin cross-site request forgery5.4CISA ADP v3.10.1%2026-09-02Fix
CVE-2026-84662Jenkins LDAP Plugin open redirect4.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-84661Jenkins Pipeline: Build Step Plugin A missing authorization5.4CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-84660Jenkins Pipeline: Build Step Plugin A missing authorization5.4CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-84659Jenkins Script Security Plugin missing authorization4.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-84658Jenkins Script Security Plugin information disclosure4.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-84657Jenkins missing authorization4.2CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-84656Jenkins A missing authorization4.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-84655Jenkins improper output encoding4.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-84654Jenkins web parameter tampering5.4CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-84653Jenkins missing authorization3.5CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-84652Jenkins session fixation7.3CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-84651Jenkins improper access control6.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-84650Jenkins deserialization of untrusted data8.8CISA ADP v3.10.5%2026-09-02Fix
CVE-2026-84649Jenkins cross-site request forgery8.8CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-84648Jenkins cross-site scripting8.8CISA ADP v3.10.6%2026-09-02Fix
CVE-2026-84647Jenkins deserialization of untrusted data8.8CISA ADP v3.10.5%2026-09-02Fix
CVE-2026-84646Jenkins deserialization of untrusted data4.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-84645Jenkins mass assignment8.8CISA ADP v3.10.8%2026-09-02Exploit codeFix
CVE-2026-84485APITable missing authentication on the Internal Organization Load or Search endpoint8.7CNA v4.00.6%2026-09-02
CVE-2026-84484ION-DTN out-of-bounds read via decodeSdnv8.7CNA v4.00.9%2026-09-02Fix
CVE-2026-84452Microsoft winml-cli windows ML CLI: CORS misconfig enables localhost RCE8.6CNA v4.01.6%2026-09-02Fix
CVE-2026-84442MapQuest Get Directions app share intent file path resolution path traversal4.8CNA v4.00.2%2026-09-02
CVE-2026-84441Piwigo Image Derivative i.php path traversal6.9CNA v4.00.6%2026-09-02
CVE-2026-84438OpenCart Autocomplete Workflow edit.php cross-site scripting5.1CNA v4.00.3%2026-09-02
CVE-2026-84437OpenCart Autocomplete Workflow address.php cross-site scripting5.1CNA v4.00.3%2026-09-02
CVE-2026-84431AirAsia MOVE App com.AirAsia.mobile com.AirAsia.core.utils.RealPathUtil.getRealPath path traversal4.8CNA v4.00.2%2026-09-02
CVE-2026-84430gouguoa edit_personal Endpoint Index.php update dynamically-determined object attributes5.3CNA v4.00.4%2026-09-02Fix
CVE-2026-84427zhayujie CowAgent Bash tool bash.py denial of service5.3CNA v4.00.5%2026-09-02
CVE-2026-84425zhayujie CowAgent Browser tool browser_tool.py BrowserTool denial of service5.3CNA v4.00.5%2026-09-02
CVE-2026-84394fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority7.5CNA v3.10.4%2026-09-02Fix
CVE-2026-84382HTTPX2: Streaming response decompression does not bound peak memory (decompression amplification)7.5CNA v3.10.6%2026-09-02Fix
CVE-2026-84381HTTPX2: Secure WebSocket traffic sent without TLS through SOCKS proxies8.1CNA v3.10.1%2026-09-02Fix
CVE-2026-84380HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated5.6CNA v3.10.2%2026-09-02Fix
CVE-2026-84379HTTPX2: Multipart part header injection via unvalidated file Content-Type and custom headers5.3CNA v3.10.3%2026-09-02Fix
CVE-2026-84378HTTPX2: Quadratic SSE line buffering can cause CPU denial of service5.9CNA v3.10.3%2026-09-02Fix
CVE-2026-84377LiteLLM: Authenticated SSRF and provider-credential exfiltration6.5CNA v3.10.5%2026-09-02Fix
CVE-2026-84376Astro configured base path stripping authorization bypass6.3CNA v4.00.7%2026-09-02Fix
CVE-2026-84292fast-uri vulnerable to authority injection via an unvalidated port in serialize7.5CNA v3.10.2%2026-09-02Fix
CVE-2026-84217Classified Listing WordPress plugin broken access control5.4CNA v3.10.3%2026-09-02Fix
CVE-2026-84175Eclipse Ditto uncontrolled recursion5.3CNA v4.00.4%2026-09-02Fix
CVE-2026-83562WCFM Marketplace WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2026-09-02Fix
CVE-2026-83547Xpro Elementor Addons - Contributor+ stored XSS via multiple widgets6.8CNA v3.10.4%2026-09-02Fix
CVE-2026-83533WP Express Checkout WordPress plugin unauthenticated Payment bypass via wpec_process_payment5.3CNA v3.10.2%2026-09-02Fix
CVE-2026-82968Red Hat Keycloak first-broker-login flow insecure direct object reference6.4CNA v3.10.3%2026-09-02
CVE-2026-82958Eclipse Ditto server-side template injection7.6CNA v4.00.4%2026-09-02
CVE-2026-82955Eclipse aeriOS improper certificate validation9.0CNA v4.00.2%2026-09-02
CVE-2026-82884All in One SEO WordPress plugin Contributor+ stored XSS via ai-assistant block6.8CNA v3.10.4%2026-09-02Fix
CVE-2026-82883Login With Ajax WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-09-02
CVE-2026-82524UnoPim file upload RCE via TinyMCE Image upload endpoint8.6CNA v4.00.6%2026-09-02Fix
CVE-2026-82522libjxl Container Box parser integer underflow via 32-bit Size Truncation5.3CNA v4.00.4%2026-09-02Fix
CVE-2026-82404TOON: Prototype pollution when decoding untrusted TOON input8.3CNA v3.10.7%2026-09-02Fix
CVE-2026-82293Incorrect authorization in Kibana leading to unauthorized resource consumption4.3CNA v3.10.4%2026-09-02Fix
CVE-2026-82223WP Event SOlution WordPress plugin broken access control6.5CNA v3.10.3%2026-09-02Fix
CVE-2026-82183OAuth Single Sign On - unauthenticated account takeover via Unverified Steam OpenID Assertion8.1CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-82182WPvivid Backup and Migration WordPress plugin Admin+ SQLi via upload Cleaner Isolation4.1CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81807Simple Ajax Chat WordPress plugin unauthenticated stored XSS via Chat Message Linkification8.8CISA ADP v3.10.5%2026-09-02Fix
CVE-2026-81775Estatik WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-09-02
CVE-2026-81774WooCommerce Product Attachment WordPress plugin sensitive data exposure7.5CNA v3.10.4%2026-09-02
CVE-2026-81772Ninja Forms - Layout and Styles WordPress plugin PHP object injection8.8CNA v3.10.5%2026-09-02Fix
CVE-2026-81771TrustedSite WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-09-02Fix
CVE-2026-81770Interactive Geo Maps WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2026-09-02
CVE-2026-81769Booking Hub WordPress plugin privilege escalation8.8CNA v3.10.4%2026-09-02
CVE-2026-81737FAQ Builder AYS - unauthenticated stored XSS via ays_get_user_information8.8CISA ADP v3.10.5%2026-09-02Fix
CVE-2026-81583Theme My Login - Subscriber+ Unauthorised Multisite Site Creation and privilege escalation5.4CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81571Brave Popup Builder WordPress plugin unauthenticated arbitrary shortcode execution via UTM parameter4.8CNA v3.10.2%2026-09-02Fix
CVE-2026-81432JetStyleManager WordPress plugin Skin deletion and modification via CSRF4.3CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-81428WC Vendors WordPress plugin Vendor+ Cross-Vendor Product and arbitrary post modification via IDOR6.5CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81427WC Vendors WordPress plugin Vendor+ Cross-Vendor order Shipment Status Change4.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81426WC Vendors WordPress plugin order Shipment Status Change via CSRF4.3CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-81294Authorizer WordPress plugin privilege escalation9.8CNA v3.10.5%2026-09-02Exploit codeFix
CVE-2026-81289MP3 Audio Player for Music, Radio and Podcast by Sonaar WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-09-02Fix
CVE-2026-81288Upsell Order Bump Offer for WooCommerce WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2026-09-02Fix
CVE-2026-81286WCFM Marketplace WordPress plugin SQL injection9.3CNA v3.10.4%2026-09-02Fix
CVE-2026-81283WP User Frontend WordPress plugin PHP object injection8.8CNA v3.10.5%2026-09-02Fix
CVE-2026-81269Data field Moderately critical information disclosure SA-CONTRIB-2026-1085.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81205LDAP / Active Directory Integration Moderately critical information disclosure SA-CONTRIB-2026-1155.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81201Monster Menus Moderately critical cross-site scripting SA-CONTRIB-2026-1166.1CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81199MasterStudy LMS WordPress plugin student/stats REST route information disclosure5.3CISA ADP v3.10.5%2026-09-02NucleiFix
CVE-2026-81198MasterStudy LMS WordPress plugin Instructor+ Cross-Course Curriculum deletion and tampering via IDOR3.8CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81197MasterStudy LMS WordPress plugin course-list REST route information disclosure5.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81196MasterStudy LMS WordPress plugin Instructor+ Quiz Answer disclosure via IDOR2.7CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81195MasterStudy LMS WordPress plugin student-courses REST route information disclosure5.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81194MasterStudy LMS WordPress plugin Cross-Instructor order data disclosure4.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81168CAPTCHA Protected Page Moderately critical Cookie Forgery SA-CONTRIB-2026-1053.7CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81167Address Suggestion Moderately critical cross-site scripting SA-CONTRIB-2026-1034.8CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-81166Digital Signage Framework Moderately critical Access bypass SA-CONTRIB-2026-1095.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81165Blazy Less critical Access bypass SA-CONTRIB-2026-1045.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81164Entity PDF Moderately critical Access bypass SA-CONTRIB-2026-1145.4CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-81162Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal information disclosure5.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81161Content Moderation Notifications Moderately critical Access bypass SA-CONTRIB-2026-1073.3CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-81160Slick Carousel Moderately critical cross-site scripting SA-CONTRIB-2026-1176.1CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81159Commerce CyberSource Moderately critical insufficient input validation SA-CONTRIB-2026-1063.7CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-81158Entity API Moderately critical information disclosure SA-CONTRIB-2026-1135.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-80467Advanced Custom Fields: Extended - unauthenticated privilege escalation8.1CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-79991craftcms cms authenticated SQL injection via nested eager-loading criteria7.1CNA v4.00.5%2026-09-02Fix
CVE-2026-79990Craft CMS GraphQL entry mutation resolvers insecure direct object reference8.7CNA v4.00.4%2026-09-02Fix
CVE-2026-79989craftcms cms arbitrary user password reset leading to administrator account takeover8.7CNA v4.00.4%2026-09-02Fix
CVE-2026-79756Nuclio: Unauthenticated OS command injection8.7CNA v4.07.5%2026-09-02Reported exploitedFix
CVE-2026-79755Nuclio: Unauthenticated OS command injection8.0CNA v3.10.7%2026-09-02Fix
CVE-2026-79754Nuclio: Kaniko build tempDir command injection7.1CNA v4.00.7%2026-09-02Fix
CVE-2026-79621CatalogX WordPress plugin unauthenticated email content injection via Shared Transient4.3CISA ADP v3.10.1%2026-09-02Fix
CVE-2026-78689F5 NGINX JavaScript XML namespace prefix parser out-of-bounds write9.2CNA v4.00.8%2026-09-02Fix
CVE-2026-78662crypto/ssh channel multiplexer deadlock7.5CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-78657SigmaForms Pro WordPress plugin unauthenticated arbitrary file deletion9.8CNA v3.11.0%2026-09-02Fix
CVE-2026-78609Incorrect authorization in Elastic Cloud on Kubernetes leading to unauthorized modification of Data5.4CNA v3.10.2%2026-09-02Fix
CVE-2026-78604Elastic Agent incorrect permission assignment7.8CNA v3.10.1%2026-09-02Fix
CVE-2026-78602Elastic Maps Server path traversal5.3CNA v3.10.6%2026-09-02Fix
CVE-2026-78601Missing authorization in Kibana leading to Unauthorized Elasticsearch Index data exposure5.5CNA v3.10.3%2026-09-02Fix
CVE-2026-78600Elastic Cloud on Kubernetes incomplete cleanup3.5CNA v3.10.3%2026-09-02Fix
CVE-2026-78599Stored path traversal in Kibana leading to Unauthorized Deletion of Internal Resources6.5CNA v3.10.5%2026-09-02Fix
CVE-2026-78598Elastic Kibana incorrect authorization5.4CNA v3.10.2%2026-09-02Fix
CVE-2026-78594Improper Handling of Highly Compressed Data in APM Server leading to Persistent denial of service4.9CNA v3.10.5%2026-09-02Fix
CVE-2026-78591Elastic Kibana Fleet administration path traversal6.3CNA v3.10.4%2026-09-02Fix
CVE-2026-78590Elastic Kibana Fleet path traversal7.3CNA v3.10.4%2026-09-02Fix
CVE-2026-78588Allocation of resources without limits or throttling in Filebeat leading to denial of service6.5CNA v3.10.4%2026-09-02Fix
CVE-2026-78587Incorrect authorization in Fleet Server leading to denial of service of agent Upload Operations3.1CNA v3.10.3%2026-09-02Fix
CVE-2026-78586Allocation of resources without limits or throttling in Kibana leading to denial of service6.5CNA v3.10.5%2026-09-02Fix
CVE-2026-78584Observable response discrepancy in Kibana leading to Cross-Space information disclosure4.3CNA v3.10.3%2026-09-02Fix
CVE-2026-78410util-linux restricted bind mounts race condition7.8CNA v3.10.2%2026-09-02Fix
CVE-2026-78409util-linux x-mount.subdir resolution vulnerability7.0CNA v3.10.2%2026-09-02Fix
CVE-2026-78408util-linux nsenter cgroup join vulnerability7.9CNA v3.10.2%2026-09-02Fix
CVE-2026-78222F5 NGINX JavaScript ngx.fetch response handling null pointer dereference8.7CNA v4.00.6%2026-09-02Fix
CVE-2026-78153The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users.5.3CNA v3.10.4%2026-09-02Fix
CVE-2026-78151FormLayer form submission handler information disclosure5.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-77794RegistrationMagic - Unauthenticated Payment Bypass via Zero Quantity5.3CNA v3.10.3%2026-09-02Fix
CVE-2026-77793RegistrationMagic WordPress plugin unauthenticated Payment bypass via Omitted Price field5.3CNA v3.10.3%2026-09-02Fix
CVE-2026-77792RegistrationMagic WordPress plugin unauthenticated stored XSS via Rating field7.5CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-77788Rank Math SEO WordPress plugin Author+ arbitrary post and user Metadata Overwrite via updateSchemas4.9CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-77787Rank Math SEO bulk metadata update missing authorization2.7CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-77785Rank Math SEO WordPress plugin Author+ Non-Public post content disclosure via Abilities API2.7CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-77784Rank Math SEO mark_page_as meta update insecure direct object reference2.7CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-77783Rank Math SEO WordPress plugin unauthenticated Non-Public post Schema and content disclosure3.7CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-77782Rank Math SEO password-protected post metadata information disclosure5.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-77764GamiPress WordPress plugin arbitrary user Points and Achievement Award via Watch-Video Listeners4.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-77180F5 NGINX Ingress Controller configuration generator vulnerability8.7CNA v4.00.5%2026-09-02Fix
CVE-2026-77125Nexus Repository 3 incorrect authorization on Blobstore Group endpoints7.1CNA v4.00.3%2026-09-02Fix
CVE-2026-77124Nexus Repository 3 Script Execution Disable setting not Enforced7.5CNA v4.00.7%2026-09-02Fix
CVE-2026-77123Nexus Repository 3 Webhook secret disclosure via Capability Read API6.0CNA v4.00.5%2026-09-02Fix
CVE-2026-77122Nexus Repository 3 incorrect authorization allows Disclosure of Member Repository Metadata5.3CNA v4.00.3%2026-09-02Fix
CVE-2026-77121Nexus Repository 3 denial of service via Unbounded Maven POM Metadata fields5.3CNA v4.00.3%2026-09-02Fix
CVE-2026-77009WatchMan-Site7 - Subscriber+ RCE via Debug console9.9CNA v3.10.5%2026-09-02
CVE-2026-76782Screenshot Critical Unsupported SA-CONTRIB-2026-1027.3CISA ADP v3.10.3%2026-09-02
CVE-2026-76759Screenshot Critical Unsupported SA-CONTRIB-2026-1027.3CISA ADP v3.10.3%2026-09-02
CVE-2026-76758Link content parser Critical Unsupported SA-CONTRIB-2026-1015.9CISA ADP v3.10.3%2026-09-02
CVE-2026-76757Gammu SMS Daemon Critical Unsupported SA-CONTRIB-2026-1005.9CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-76756Gammu SMS Daemon Critical Unsupported SA-CONTRIB-2026-1005.9CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-76755Gammu SMS Daemon Critical Unsupported SA-CONTRIB-2026-1005.9CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-75528Broken Link Checker WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.5%2026-09-02Fix
CVE-2026-75137UpSignOn sensitive data exposure in Process Memory after Lock6.9CNA v4.00.1%2026-09-02Fix
CVE-2026-75136UpSignOn Biometric key exposure via Windows PasswordVault6.9CNA v4.00.2%2026-09-02Fix
CVE-2026-75135UpSignOn Sensitive Key Retention in Memory6.9CNA v4.00.1%2026-09-02Fix
CVE-2026-75134SEOWriting WordPress plugin stored XSS via iframe onload5.1CNA v4.00.3%2026-09-02
CVE-2026-74927MultiVendorX - Unauthenticated Vendor PII and Payout data disclosure via stores REST endpoint5.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-73478Diff Moderately critical Access bypass SA-CONTRIB-2026-0965.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-73477Quick Tabs Moderately critical Access bypass SA-CONTRIB-2026-0995.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-73476External Authentication Moderately critical Access bypass SA-CONTRIB-2026-0985.4CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-73475Commerce PayPal Moderately critical Access bypass SA-CONTRIB-2026-0959.1CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-73474Entity Share Websub Moderately critical server-side request forgery (SSRF) SA-CONTRIB-2026-0975.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-66842F5 BIG-IP and BIG-IQ Configuration utility privilege escalation8.7CNA v4.00.5%2026-09-02Fix
CVE-2026-66786Red Hat Advanced Cluster Management for Kubernetes Submariner code injection9.1CNA v3.11.4%2026-09-02Fix
CVE-2026-66652Grand Tour WordPress theme cross-site request forgery (CSRF)5.4CNA v3.10.1%2026-09-02
CVE-2026-66362F5 NGINX Gateway Fabric NGINX configuration generator vulnerability8.6CNA v4.00.6%2026-09-02Fix
CVE-2026-63020F5 BIG-IP Configuration utility UI misrepresentation2.3CNA v4.00.2%2026-09-02Fix
CVE-2026-56855golang.org/x/crypto/ssh channel message handling deadlock7.5CISA ADP v3.10.5%2026-09-02Fix
CVE-2026-55421openedx-platform Open edX Platform: SSRF in Studio Video Download endpoint6.8CNA v3.10.5%2026-09-02
CVE-2026-55221malach-it boruta-server boruta: OAuth credentials exposed in Boruta business logs6.5CNA v3.10.5%2026-09-02Fix
CVE-2026-53706PREVAIL ALU32 pointer verification incorrect calculation8.8CNA v4.00.5%2026-09-02Fix
CVE-2026-53683Red Hat FreeIPA reset_password.html open redirect4.3CNA v3.10.3%2026-09-02
CVE-2026-53671PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification9.3CNA v4.00.5%2026-09-02Fix
CVE-2026-53670PREVAIL eBPF verifier offset tracking incorrect calculation9.3CNA v4.00.5%2026-09-02Fix
CVE-2026-53649Joro: Unauthenticated Cross-Origin plugin upload leads to RCE9.6CNA v3.10.3%2026-09-02Fix
CVE-2026-53636openedx-platform Open edX LTI OAuth Replay Attack4.7CNA v3.10.3%2026-09-02
CVE-2026-53635openedx-platform Open edX Platform: Insufficient permission on set_course_mode_price7.6CNA v3.10.4%2026-09-02
CVE-2026-53611AS203038 looking-glass Looking Glass: Remote code execution9.8CNA v3.12.0%2026-09-02Fix
CVE-2026-53600async-tar PAX extension-header desync enables tar entry/content smuggling6.3CNA v4.00.4%2026-09-02Fix
CVE-2026-52833Nuclio Java runtime build.gradle generation code injection8.0CNA v3.10.6%2026-09-02Fix
CVE-2026-52832Nuclio handler field parser path traversal4.9CNA v3.10.6%2026-09-02Exploit codeFix
CVE-2026-52831Nuclio cron trigger command builder OS command injection8.0CNA v3.10.5%2026-09-02Fix
CVE-2026-49833DSpace: Path traversal possible in LDN message generation5.5CNA v3.10.4%2026-09-02Fix
CVE-2026-49832DSpace: Remote code execution (RCE) possible in Velocity templates used by LDN8.0CNA v3.10.9%2026-09-02Fix
CVE-2026-49831DSpace has a possible path traversal vulnerability in its Curation Task Reporter output path5.5CNA v3.10.5%2026-09-02Fix
CVE-2026-49830DSpace: ORE resource URI does not validate scheme for non-web resources4.4CNA v3.10.5%2026-09-02Fix
CVE-2026-49249malach-it Boruta user settings controller resource exhaustion7.1CNA v4.00.4%2026-09-02Fix
CVE-2026-45730Nuclio dashboard project API missing authorization8.3CNA v3.10.5%2026-09-02Fix
CVE-2026-32773Apache Spark: XSS vulnerability in Spark Web6.1CISA ADP v3.10.7%2026-09-02Fix
CVE-2026-20355Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty5.9CNA v3.10.2%2026-09-02Fix
CVE-2026-20354Cisco Secure Email S/MIME Ciphertext Decryption Vulnerabilty5.9CNA v3.10.2%2026-09-02Fix
CVE-2026-20281Cisco Session Initiation Protocol (SIP) Software HTTP packet processing memory leak7.5CNA v3.10.4%2026-09-02Fix
CVE-2026-20280Cisco IOS XR Software Security Hardening Release: September 20268.8CNA v3.10.3%2026-09-02Fix
CVE-2026-20279Cisco IOS XR Software Security Hardening Release: September 20269.8CNA v3.10.3%2026-09-02Fix
CVE-2026-20278Cisco IOS XR Software Security Hardening Release: September 20268.8CNA v3.10.3%2026-09-02Fix
CVE-2026-20277Cisco IOS XR Software Security Hardening Release: September 20268.2CNA v3.10.2%2026-09-02Fix
CVE-2026-20276Cisco IOS XR Software Security Hardening Release: September 20268.6CNA v3.10.3%2026-09-02Fix
CVE-2026-20275Cisco IOS XR Software Security Hardening Release: September 20268.8CNA v3.10.2%2026-09-02Fix
CVE-2026-20274Cisco IOS XR Software Security Hardening Release: September 20269.8CNA v3.10.7%2026-09-02Fix
CVE-2026-20212Cisco NX-OS Software Silicon One hardware abstraction layer remote code execution9.8CNA v3.10.7%2026-09-02Fix
CVE-2026-19754Baserow SQL injection in formula index JSONB array extraction8.6CNA v4.00.4%2026-09-02Fix
CVE-2026-19723Social Media Share Buttons and Social Sharing Icons WordPress plugin reflected XSS7.1CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-19719Social Media Share Buttons and Social Sharing Icons WordPress plugin stored XSS6.8CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-19704Comments wpDiscuz WordPress plugin unauthenticated comment disclosure via SQLi5.3CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-19698GutenKit WordPress plugin Contributor+ stored CSS injection3.5CNA v3.10.2%2026-09-02Fix
CVE-2026-19475SQL Data Source Plugin: OOM DoS via $__timeGroup macro6.5CNA v3.10.4%2026-09-02Fix
CVE-2026-19453JetBackup - Subscriber+ privilege escalation via Restore Admin User Selection7.1CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-19251Ultimate Member WordPress plugin unauthenticated Unapproved comment disclosure via Profile Activity5.3CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-19219DialogHandler UploadPaths tampering vulnerability in Telerik UI for ASP.NET AJAX8.1CNA v3.10.2%2026-09-02Fix
CVE-2026-19117Delinea Secret Server FIDO2 credential registration authentication bypass9.8CNA v3.10.3%2026-09-02Fix
CVE-2026-19116WP User Frontend WordPress plugin Subscriber+ PHP object injection via Frontend post Edit form8.8CISA ADP v3.10.4%2026-09-02Fix
CVE-2026-18986Entity Browser Moderately critical cross-site scripting SA-CONTRIB-2026-0944.8CISA ADP v3.10.1%2026-09-02Fix
CVE-2026-18672Progress Telerik UI for ASP.NET AJAX RadImageEditor path traversal7.5CNA v3.10.4%2026-09-02Fix
CVE-2026-18329F5 NGINX JavaScript module js_access handler vulnerability8.8CNA v4.00.4%2026-09-02Fix
CVE-2026-18058Motorola Smart Connect Application missing authorization7.3CNA v4.00.1%2026-09-02Fix
CVE-2026-17563WP User Frontend WordPress plugin unauthenticated post creation via Subscription-Gated form5.3CNA v3.10.2%2026-09-02Fix
CVE-2026-16983Gutentor WordPress plugin Subscriber+ password Protected post password disclosure via REST API4.3CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-16966Solace Extra Site Builder information disclosure5.3CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-16647Drupal Disable Login Page authentication bypass4.1v3.10.3%2026-09-02Fix
CVE-2026-15232Appointment Booking Lite WordPress plugin unauthenticated arbitrary Reservation deletion5.3CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-14982WP File Download WordPress plugin arbitrary file deletion8.1CNA v3.10.5%2026-09-02Fix
CVE-2026-14957The Libreswan Project libreswan FIPS mode assertion failure via malicious CERT payload7.5CNA v3.10.5%2026-09-02Fix
CVE-2026-14828Zoho ManageEngine Password Manager Pro SQL injection8.8CNA v3.11.4%2026-09-02Fix
CVE-2026-14357DevKit Pro WordPress plugin missing authorization8.8CNA v3.10.6%2026-09-02Fix
CVE-2026-14326Timetics WordPress plugin Staff+ Cross-Staff Appointment modification via IDOR3.8CNA v3.10.2%2026-09-02Fix
CVE-2026-14255IFC File Parsing uncontrolled recursion in certain Autodesk Products5.5CNA v3.10.1%2026-09-02Fix
CVE-2026-14215Booking for Appointments and Events Calendar post-booking action chain missing authorization6.5CISA ADP v3.10.3%2026-09-02Fix
CVE-2026-14199Grafana Enterprise session takeover via Auth Proxy cache key collision7.1CNA v3.10.3%2026-09-02Fix
CVE-2026-12865Photo Gallery by 10Web WordPress plugin reflected XSS via title and paged parameters7.1CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-12704Grafana Enterprise SAML assertion replay via skipped InResponseTo validation6.8CNA v3.10.3%2026-09-02Fix
CVE-2026-12526Advanced Custom Fields: Extended WordPress plugin unauthenticated Administrator account takeover8.1CISA ADP v3.10.2%2026-09-02Fix
CVE-2026-10821Yoast SEO Premium WordPress plugin Author+ arbitrary .htaccess Directive injection to RCE6.6CNA v3.10.5%2026-09-02Fix
CVE-2026-9055Booking for Appointments and Events Calendar WordPress plugin privilege escalation9.8CNA v3.10.5%2026-09-02Reported exploitedFix
CVE-2026-8151Simple Membership MailChimp Integration WordPress plugin API Key update via CSRF5.4CNA v3.10.1%2026-09-02Fix
CVE-2026-4357Embed HTML5 Game WordPress plugin unauthenticated arbitrary file upload10.0CNA v3.10.5%2026-09-02
CVE-2026-3851Divi WordPress theme stored cross-site scripting6.4CNA v3.10.3%2026-09-02Fix
CVE-2026-3850Divi WordPress theme stored cross-site scripting6.4CNA v3.10.3%2026-09-02Fix
CVE-2026-2811Ajaxify Comments WordPress plugin unauthenticated HTTP header injection5.4CNA v3.10.3%2026-09-02Fix
CVE-2026-2688CM HIPAA Forms WordPress plugin unauthenticated authorization bypass6.5CNA v3.10.4%2026-09-02Fix
CVE-2026-84642Mozilla Thunderbird allowed UNC hostnames for attachments interpreted as a regular expression7.5CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84641Mozilla Thunderbird information disclosure due to malicious IMAP server response7.5CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84640Mozilla Thunderbird one byte overflow read in mail parser7.5CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84639Mozilla Thunderbird uninitialized memory in MIME parsing9.1CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84637Mozilla Thunderbird calendar invitation attachments could launch local executables9.8CISA ADP v3.10.6%2026-09-01Fix
CVE-2026-84483WWBN AVideo Unauthenticated Password Hash Oracle via encryptPass.json.php6.9CNA v4.00.4%2026-09-01
CVE-2026-84482WWBN AVideo cross-site request forgery via get_domain validation8.7CNA v4.00.2%2026-09-01
CVE-2026-84481WWBN AVideo information disclosure via MobileManager6.9CNA v4.00.4%2026-09-01
CVE-2026-84480WWBN AVideo Password Recovery Token Expiration Bypass9.3CNA v4.00.5%2026-09-01Fix
CVE-2026-84479WWBN AVideo authentication bypass via User-Agent header9.3CNA v4.00.5%2026-09-01
CVE-2026-84478WWBN AVideo Unauthenticated arbitrary Log file deletion6.9CNA v4.00.6%2026-09-01
CVE-2026-84477AVideo stored XSS via Live Schedule Title Description5.1CNA v4.00.3%2026-09-01
CVE-2026-84476WWBN AVideo authentication bypass via X-Real-IP header8.7CNA v4.00.4%2026-09-01
CVE-2026-84470Red Hat Ansible Automation Platform bulk job launch instance group check missing authorization6.4CNA v3.10.3%2026-09-01Fix
CVE-2026-84423Casdoor upload-resource API resource.go missing authentication6.9CNA v4.00.7%2026-09-01
CVE-2026-84375js-yaml YAML merge key processing denial of service7.5CNA v3.10.5%2026-09-01Fix
CVE-2026-84374SpartnerNL Laravel Excel export file path resolution path traversal7.5CNA v3.10.8%2026-09-01Fix
CVE-2026-84373Vitest: Path traversal / arbitrary file read via @vitest/mocker Redirect Mock5.9CNA v3.10.5%2026-09-01Fix
CVE-2026-84372Predis: Redis command injection and denial of service9.8CNA v3.10.7%2026-09-01Fix
CVE-2026-84371ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass5.4CNA v3.10.3%2026-09-01Fix
CVE-2026-84370SVGO: RemoveScripts allows executable links through namespace and control-character bypasses8.2CNA v3.10.5%2026-09-01Fix
CVE-2026-84369SVGO: RemoveScripts incompletely sanitizes executable HTML in SVG foreignObject elements6.1CNA v3.10.4%2026-09-01Fix
CVE-2026-84368joi custom validation messages prototype pollution3.7CNA v3.10.4%2026-09-01Fix
CVE-2026-84367joi schema key renaming prototype pollution3.7CNA v3.10.4%2026-09-01Fix
CVE-2026-84366Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default7.4CNA v3.10.3%2026-09-01Fix
CVE-2026-84365Hono: Incomplete fix for `toSSG` still writes files outside the output directory6.5CNA v3.10.4%2026-09-01Fix
CVE-2026-84364Hono: Unbounded dot-notation nesting in `parseBody` can cause memory exhaustion5.3CNA v3.10.5%2026-09-01Fix
CVE-2026-84363Hono query parameter parsing vulnerability5.9CNA v3.10.4%2026-09-01Fix
CVE-2026-84361Composer: Perforce source URL permits P4PORT `rsh:` command execution7.7CNA v4.00.5%2026-09-01Fix
CVE-2026-84359Google Chrome Skia information disclosure3.1CISA ADP v3.10.2%2026-09-01Fix
CVE-2026-84358Google Chrome Downloads improper privilege management4.2CISA ADP v3.10.2%2026-09-01Fix
CVE-2026-84357Google Chrome Omnibox improper input validation6.5CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84356Google Chrome FullScreen UI misrepresentation4.3CISA ADP v3.10.2%2026-09-01Fix
CVE-2026-84355Google Chrome Navigation incorrect authorization3.1CISA ADP v3.10.2%2026-09-01Fix
CVE-2026-84354Google Chrome FileSystem incorrect authorization9.6CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84353Google Android use-after-free9.6CISA ADP v3.10.5%2026-09-01Fix
CVE-2026-84352Google Android WebGL in Google Chrome on use-after-free9.6CISA ADP v3.10.5%2026-09-01Fix
CVE-2026-84351Google Chrome GPU buffer overflow8.3CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84350Google Chrome TabStrip use-after-free8.8CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84349Google Chrome Browser use-after-free8.3CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84348Google Chrome MediaCapture information disclosure6.5CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84347Google Chrome WebRTC use-after-free8.8CISA ADP v3.10.5%2026-09-01Fix
CVE-2026-84335Google Chrome TabStrip incorrect authorization8.3CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84334Google Chrome Chromoting incorrect authorization8.1CISA ADP v3.10.1%2026-09-01Fix
CVE-2026-84333Google Android Dawn in Google Chrome on use-after-free9.6CISA ADP v3.10.5%2026-09-01Fix
CVE-2026-84332Google Chrome SiteSettings incorrect authorization6.5CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84331Google Chrome Actor incorrect authorization3.1CISA ADP v3.10.2%2026-09-01Fix
CVE-2026-84330Google Android FullScreen in Google Chrome on UI misrepresentation5.4CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84329Google Chrome CredentialProvider confused deputy5.3CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84328Google Chrome FileSystem missing authorization3.1CISA ADP v3.10.2%2026-09-01Fix
CVE-2026-84327Google Android Autofill in Google Chrome on incorrect authorization6.5CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84326Google Chrome V8 uninitialized resource use8.8CISA ADP v3.10.5%2026-09-01Fix
CVE-2026-84325Google Chrome DataTransfer improper input validation9.8CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84324Google Chrome Proxy use-after-free9.0CISA ADP v3.10.5%2026-09-01Fix
CVE-2026-84323Google Chrome FileSystem missing authorization5.3CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84311pypdf PageObject denial of service4.8CNA v4.00.1%2026-09-01Fix
CVE-2026-84310pypdf document outline retrieval denial of service4.8CNA v4.00.1%2026-09-01Fix
CVE-2026-84309pypdf outline tree node insertion infinite loop6.9CNA v4.00.2%2026-09-01Fix
CVE-2026-84308phpseclib non-constant-time X25519 scalar multiplication permits full private-key recovery6.3CNA v3.10.3%2026-09-01Fix
CVE-2026-84307Filament: Password validity disclosure for accounts denied panel access on login page3.7CNA v3.10.5%2026-09-01Fix
CVE-2026-84306Filament: Multi-factor authentication (app) codes can still be used after a newer code has been used6.5CNA v3.10.4%2026-09-01Fix
CVE-2026-84305sqlparse reindent filter algorithmic complexity5.1CNA v4.00.2%2026-09-01Fix
CVE-2026-84304gRPC-Go: Heap memory exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation8.7CNA v4.00.6%2026-09-01Fix
CVE-2026-84303gRPC-Go: XDS RBAC HTTP Filter bypass via mixed-case Header Matching and gRFC A41 validation evasion6.3CNA v4.00.3%2026-09-01Fix
CVE-2026-84289NousResearch hermes-agent MCP tool mcp_tool.py list_tools memory allocation5.3CNA v4.00.5%2026-09-01
CVE-2026-84288NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service5.3CNA v4.00.5%2026-09-01
CVE-2026-84287NousResearch hermes-agent Session Chat api_server.py denial of service5.3CNA v4.00.5%2026-09-01
CVE-2026-84270Gvfs: Mtp: Out-of-bounds read in do_read4.3CNA v3.10.2%2026-09-01Fix
CVE-2026-84269Gvfs: Afp: Heap-based buffer overflow in dsi read path6.5CNA v3.10.5%2026-09-01Fix
CVE-2026-84268Gvfs: Sftp: Heap-based buffer overflow in read_reply8.8CNA v3.10.5%2026-09-01Fix
CVE-2026-84267Gvfs: Sftp: Uninitialized heap disclosure in read_string4.3CNA v3.10.4%2026-09-01Fix
CVE-2026-84235Rockwell Automation 1756-ENBT denial of service8.7CNA v4.00.4%2026-09-01
CVE-2026-84233Red Hat Hardened Images rpm: Command execution7.0CNA v3.10.2%2026-09-01Fix
CVE-2026-84232Red Hat Ansible Automation Platform 2 pulpcore: Python-pulpcore: Stored cross-site scripting5.4CNA v3.10.2%2026-09-01
CVE-2026-84218Red Hat AMQ Broker 7 org.jolokia/jolokia-core: Incomplete jndi denylist in jolokia jsr-160 proxy8.1CNA v3.10.9%2026-09-01Fix
CVE-2026-84208AVideo User_Location plugin unauthenticated SQL injection8.7CNA v4.00.5%2026-09-01Fix
CVE-2026-84207Heym SSRF via WebSocket endpoints5.3CNA v4.00.3%2026-09-01Fix
CVE-2026-84206Snipe-IT authorization bypass via Bulk Restore5.3CNA v4.00.4%2026-09-01Fix
CVE-2026-84205GROWI authorization bypass through user-controlled key on apiv3 Revision Retrieval7.1CNA v4.00.4%2026-09-01
CVE-2026-84204GROWI missing authorization on apiv3 Attachment Retrieval7.1CNA v4.00.4%2026-09-01
CVE-2026-84203Memos insufficient session expiration on Password Change8.6CNA v4.00.4%2026-09-01
CVE-2026-84202ModelScope Unsafe YAML deserialization in Model Config Loading8.7CNA v4.00.7%2026-09-01Fix
CVE-2026-84201appium-mcp-server path traversal in write_file and write_files_batch6.9CNA v4.00.2%2026-09-01
CVE-2026-84200Kyverno Policy Bypass via multiple Exceptions9.4CNA v4.00.3%2026-09-01Fix
CVE-2026-84199Kyverno SSRF via APICall feature6.9CNA v4.00.4%2026-09-01Fix
CVE-2026-84196Kyverno server-side request forgery via apiCall8.3CNA v4.00.4%2026-09-01Fix
CVE-2026-84195Kyverno credential leak via apiCall8.3CNA v4.00.4%2026-09-01Fix
CVE-2026-84194LibreNMS OS command injection via Hostname8.6CNA v4.01.5%2026-09-01Fix
CVE-2026-84193LibreNMS stored cross-site scripting via SNMP5.8CNA v4.00.3%2026-09-01
CVE-2026-84192LibreNMS stored XSS via SNMP/Syslog Data7.1CNA v4.00.3%2026-09-01Fix
CVE-2026-84191LibreNMS stored XSS via SNMP VRF fields5.3CNA v4.00.3%2026-09-01Fix
CVE-2026-84190LibreNMS remote code execution via AboutController8.7CNA v4.00.9%2026-09-01Fix
CVE-2026-84189LibreNMS stored XSS via Oxidized API9.2CNA v4.00.4%2026-09-01Fix
CVE-2026-84188librenms stored XSS via graph_descr settings4.8CNA v4.00.3%2026-09-01Fix
CVE-2026-84187AVideo on_publish.php missing authentication Check via RTMP Callback8.8CNA v4.00.5%2026-09-01
CVE-2026-84165OpenNebula one.vm.exec function improper access control8.7CNA v4.00.4%2026-09-01Fix
CVE-2026-84153Xinhu Rainrock RockOA index.php toaddval SQL injection5.3CNA v4.00.3%2026-09-01
CVE-2026-84149Information disclosure vulnerability in Manacle Technologies ERP System9.2CNA v4.00.5%2026-09-01Fix
CVE-2026-84148Insecure direct object reference vulnerability in Manacle Technologies ERP System9.2CNA v4.00.7%2026-09-01Fix
CVE-2026-84147Remote code execution vulnerability in Manacle Technologies ERP System10.0CNA v4.01.0%2026-09-01Fix
CVE-2026-84145Internally found bugs fixed in Thunderbird 155, Thunderbird ESR and Thunderbird ESR7.5CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84144Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR7.5CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84143Internally found bugs fixed in Thunderbird 155, Thunderbird ESR and Thunderbird ESR9.8v3.10.4%2026-09-01Fix
CVE-2026-84142Internally found bugs fixed in Thunderbird 1559.8v3.10.3%2026-09-01Fix
CVE-2026-84141Mozilla Firefox integer overflow in the Graphics: ImageLib component9.8v3.10.3%2026-09-01Fix
CVE-2026-84140Mozilla Firefox site isolation issue in the DOM: Navigation component9.8v3.10.2%2026-09-01Fix
CVE-2026-84139Mozilla Firefox clickjacking issue in the DOM: Events component6.1NVD v3.10.3%2026-09-01Fix
CVE-2026-84138Mozilla Firefox denial of service in the PDF Viewer component6.5NVD v3.10.4%2026-09-01Fix
CVE-2026-84137Mozilla Firefox spoofing issue in the DOM: Core and HTML component4.3NVD v3.10.2%2026-09-01Fix
CVE-2026-84136Mozilla Firefox other issue in the DOM: Navigation component6.1NVD v3.10.4%2026-09-01Fix
CVE-2026-84135Mozilla Firefox improper input validation9.8v3.10.3%2026-09-01Fix
CVE-2026-84134Mozilla Firefox Other issue in the Profile Backup component9.8CISA ADP v3.10.6%2026-09-01Fix
CVE-2026-84133Mozilla Firefox Site isolation issue in the DOM: Push Subscriptions component9.8CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84132Mozilla Firefox information disclosure in the Networking: HTTP component7.5CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84131Mozilla Firefox privilege escalation due to invalid pointer in the Graphics component8.8CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84130Mozilla Firefox information disclosure in the Graphics: WebGPU component7.5CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84129Mozilla Firefox site isolation issue in the DOM: Navigation component9.8CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84128Mozilla Firefox privilege escalation in the WebDriver BiDi component8.8CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84127Mozilla information disclosure in the WebExtensions component in Firefox for Android4.3CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84126Mozilla Firefox incorrect boundary conditions in the Layout: Grid component4.3CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84125Mozilla Firefox use-after-free in the DOM: Core and HTML component5.4CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84124Mozilla Firefox use-after-free in the DOM: Core and HTML component5.4CISA ADP v3.10.2%2026-09-01Fix
CVE-2026-84123Mozilla Firefox privilege escalation due to use-after-free in the Graphics: WebGPU component8.8CISA ADP v3.10.4%2026-09-01Fix
CVE-2026-84122Mozilla Firefox use-after-free in the Audio/Video component5.4CISA ADP v3.10.2%2026-09-01Fix
CVE-2026-84121Mozilla Firefox sandbox escape due to use-after-free in the DOM: Security component9.6CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84120Mozilla Firefox use-after-free in the Audio/Video component5.4CISA ADP v3.10.2%2026-09-01Fix
CVE-2026-84119Mozilla Firefox sandbox escape due to use-after-free in the DOM: Navigation component9.6CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84118Mozilla Firefox use-after-free in the JavaScript: GC component5.4CISA ADP v3.10.3%2026-09-01Exploit codeFix
CVE-2026-84117Mozilla privilege escalation in Firefox for Android8.8CISA ADP v3.10.3%2026-09-01Fix
CVE-2026-84115Cleo Harmony JWT Refresh Token connections privileges management6.9CNA v4.00.5%2026-09-01
CVE-2026-84114Cleo Harmony SAML Authentication LocalUserUtil.getNativeUserByAssertions improper authentication5.3CNA v4.00.5%2026-09-01
CVE-2026-84111Chanjet CRM jxf_dump_table.php SQL injection6.9CNA v4.00.4%2026-09-01
CVE-2026-84110Releasit COD Form and Upsells OTP validation client-side enforcement of server-side security6.9CNA v4.00.5%2026-09-01
CVE-2026-84109Xinhu Rainrock RockOA webmainAction.php getOrder SQL injection5.3CNA v4.00.3%2026-09-01
CVE-2026-84061zhongyu09 OpenChatBI generate_sql.py _validate_sql_safety SQL injection5.3CNA v4.00.3%2026-09-01
CVE-2026-84059ICP DAS UA-2200/UA-5200 CGI ArmAngstromInstructionSet command injection5.3CNA v4.02.0%2026-09-01
CVE-2026-83772Cobham SATCOM VSAT7090 Maritime Satellite Router mail report JSON parser command injection9.4CNA v4.03.2%2026-09-01
CVE-2026-83744invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery5.3CNA v4.00.3%2026-09-01
CVE-2026-83743invoiceninja Invoice Ninja Vendor Portal Profile Update profile authorization5.3CNA v4.00.4%2026-09-01Fix
CVE-2026-83619xmldom end-tag whitespace parser denial of service8.7CNA v4.00.5%2026-09-01Fix
CVE-2026-83618xmldom DocType identifier validation XML injection8.7CNA v4.00.6%2026-09-01Fix
CVE-2026-83617xmldom requireWellFormed name validation XML injection8.7CNA v4.00.6%2026-09-01Fix
CVE-2026-83616xmldom processing instruction serialization XML injection8.7CNA v4.00.6%2026-09-01Fix
CVE-2026-83615xmldom DOMParser namespace parsing denial of service8.7CNA v4.00.6%2026-09-01Fix
CVE-2026-83614xmldom malformed-input recovery parsing resource exhaustion8.7CNA v4.00.6%2026-09-01Fix
CVE-2026-83613xmldom attribute deduplication vulnerability8.7CNA v4.00.6%2026-09-01Fix
CVE-2026-83612xmldom HTML raw-text tag parsing resource exhaustion8.7CNA v4.00.5%2026-09-01Fix
CVE-2026-83611xmldom end tag parsing improper input validation6.9CNA v4.00.6%2026-09-01Fix
CVE-2026-83610xmldom entity reference serialization improper output encoding6.3CNA v4.00.6%2026-09-01Fix
CVE-2026-83609xmldom XML name validation XML injection8.7CNA v4.00.5%2026-09-01Fix
CVE-2026-83608xmldom document type name validation XML injection8.7CNA v4.00.6%2026-09-01Fix
CVE-2026-83607xmldom element name validation XML injection8.7CNA v4.00.6%2026-09-01Fix
CVE-2026-83606xmldom PI grammar regex ReDoS: Quadratic backtracking on unterminated processing instructions8.7CNA v4.00.5%2026-09-01Fix
CVE-2026-83605xmldom attribute name validation XML injection8.7CNA v4.00.6%2026-09-01Fix
CVE-2026-83595AVideo cross-site request forgery via plugin/API/set.json.php7.2CNA v4.00.2%2026-09-01Fix
CVE-2026-83557FasterXML jackson-databind DefaultBaseTypeLimitingValidator deserialization of untrusted data5.6CNA v3.10.7%2026-09-01Fix
CVE-2026-83551Cleartext storage of HMAC signing key in Amazon SageMaker Python SDK @step/@remote pipeline path8.5CNA v4.00.6%2026-09-01Fix
CVE-2026-83549SonicWall SMA1000 Appliances OS command injection7.8CISA ADP v3.110.8%2026-09-01KEVMetasploitExploit codeKCVFix
CVE-2026-83548SonicWall SMA1000 Appliances server-side request forgery10.0CISA ADP v3.18.0%2026-09-01KEVNucleiMetasploitExploit codeKCVFix
CVE-2026-82927Samsung Open Source mTower untrusted pointer dereference5.5CNA v3.10.1%2026-09-01
CVE-2026-82926Samsung Open Source mTower null pointer dereference5.5CNA v3.10.1%2026-09-01
CVE-2026-82749ash-project ash incorrect authorization5.9CNA v4.00.2%2026-09-01Fix
CVE-2026-82748ash-project ash incorrect authorization2.1CNA v4.00.2%2026-09-01Fix
CVE-2026-82747ash-project ash Ash.Policy.Authorizer returns records denied by a runtime read policy to any actor5.9CNA v4.00.2%2026-09-01Fix
CVE-2026-82746ash-project ash missing authorization5.9CNA v4.00.2%2026-09-01Fix
CVE-2026-82745ash-project ash improper access control5.9CNA v4.00.2%2026-09-01Fix
CVE-2026-82744ash-project ash Ash.Reactor change step fails open, skipping a change when its where guard raises2.1CNA v4.00.2%2026-09-01Fix
CVE-2026-82743ash-project ash Ash.Actions.Read.AsyncLimiter busy-spins a scheduler while awaiting slow async reads2.1CNA v4.00.2%2026-09-01Fix
CVE-2026-82742ash-project ash resource exhaustion5.9CNA v4.00.2%2026-09-01Fix
CVE-2026-82741ash-project ash improper type validation2.1CNA v4.00.2%2026-09-01Fix
CVE-2026-82740ash-project ash improper input validation2.1CNA v4.00.2%2026-09-01Fix
CVE-2026-82739ash-project ash information disclosure through error messages2.1CNA v4.00.2%2026-09-01Fix
CVE-2026-82738ash-project ash improper input validation5.9CNA v4.00.2%2026-09-01Fix
CVE-2026-82737ash-project ash integer overflow5.9CNA v4.00.2%2026-09-01Fix
CVE-2026-82736ash-project Ash CiString type validation vulnerability2.1CNA v4.00.2%2026-09-01Fix
CVE-2026-82735ash-project ash resource exhaustion5.9CNA v4.00.2%2026-09-01Fix
CVE-2026-82734ash-project ash non-finite Infinity/NaN decimal values bypass bounds constraints in Ash.Type.Decimal2.1CNA v4.00.2%2026-09-01Fix
CVE-2026-82733ash-project ash_typescript route handler return value echoed into AshTypescript error response6.3CNA v4.00.5%2026-09-01Fix
CVE-2026-82732ash-project ash_typescript improper input validation6.3CNA v4.00.7%2026-09-01Fix
CVE-2026-82731ash-project ash_typescript open redirect2.3CNA v4.00.5%2026-09-01Fix
CVE-2026-82730ash-project ash_typescript incorrect authorization8.2CNA v4.00.5%2026-09-01Fix
CVE-2026-81928Net::DNS versions for Perl allow memory exhaustion7.5CISA ADP v3.10.6%2026-09-01Fix
CVE-2026-81846runZero MCP Findings summaries data leak3.5CNA v3.10.3%2026-09-01Fix
CVE-2026-80047Hugging Face Transformers library writes remote code to disk prior to consent check7.8CISA ADP v3.10.1%2026-09-01Fix
CVE-2026-79687Dell PowerStore 500T missing authentication9.0CNA v3.10.3%2026-09-01Fix
CVE-2026-79686Dell PowerStore 500T protection mechanism failure8.8CNA v3.10.5%2026-09-01Fix
CVE-2026-79685Dell PowerStore 500T argument injection6.5CNA v3.10.4%2026-09-01Fix
CVE-2026-79684Dell PowerStore 500T protection mechanism failure8.8CNA v3.10.5%2026-09-01Fix
CVE-2026-79683Dell PowerStore 500T protection mechanism failure8.8CNA v3.10.5%2026-09-01Fix
CVE-2026-79682Dell PowerStore 500T command injection8.8CNA v3.10.7%2026-09-01Fix
CVE-2026-78608Missing authorization in Kibana leading to information disclosure6.5CNA v3.10.4%2026-09-01Fix
CVE-2026-78607Missing authorization in Elasticsearch leading to information disclosure5.4CNA v3.10.3%2026-09-01Fix
CVE-2026-78606Elastic Kibana incorrect authorization4.2CNA v3.10.2%2026-09-01Fix
CVE-2026-78605Inconsistent interpretation of HTTP requests in Elasticsearch leading to information disclosure5.9CNA v3.10.3%2026-09-01Fix
CVE-2026-78603Missing authorization in Kibana leading to Unauthorized Disclosure of Fleet Deployment Metadata4.3CNA v3.10.3%2026-09-01Fix
CVE-2026-78597Missing authorization in Kibana Entity Store leading to Unauthorized API Key Creation4.3CNA v3.10.3%2026-09-01Fix
CVE-2026-78592Elastic Kibana tag management path traversal7.3CNA v3.10.4%2026-09-01Fix
CVE-2026-78363MW WP Form completion message merge tags vulnerability4.8CNA v3.10.2%2026-09-01Fix
CVE-2026-78319Sauter modu680-AS TOCTOU vulnerability in file exchange9.3CNA v4.00.6%2026-09-01Fix
CVE-2026-78012Stack-based buffer overflow in Pyramid Solutions NetStaX EtherNet/IP Stack9.3CNA v4.00.6%2026-09-01
CVE-2026-77950ash-project ash_typescript information disclosure through error messages6.3CNA v4.00.5%2026-09-01Fix
CVE-2026-77856ash-project ash_typescript resource exhaustion8.2CNA v4.00.5%2026-09-01Fix
CVE-2026-77823LearnPress WordPress plugin authenticated (Administrator+) SQL injection via orderby parameter4.9CNA v3.10.4%2026-09-01Fix
CVE-2026-77194Simple Membership WordPress plugin authentication bypass5.3CNA v3.10.6%2026-09-01Fix
CVE-2026-77189Charitable WordPress plugin authenticated (Contributor+) SQL injection via order shortcode attribute6.5CNA v3.10.5%2026-09-01Fix
CVE-2026-76851Server-side request forgery vulnerability in GitHub Enterprise Server allowed remote code execution7.7CNA v4.00.8%2026-09-01Fix
CVE-2026-76658Unauthenticated remote code execution in HPE Networking Fabric Composer SSH daemon10.0CNA v3.10.7%2026-09-01Fix
CVE-2026-76657Authentication bypass in HPE Networking Fabric Composer API allows Administrative Access10.0CNA v3.10.7%2026-09-01Fix
CVE-2026-76111Dell PowerStore 500T incorrect authorization8.8CNA v3.10.4%2026-09-01Fix
CVE-2026-76006Photo Gallery by Ays WordPress plugin authenticated (Administrator+) SQL injection via s parameter4.9CNA v3.10.6%2026-09-01Fix
CVE-2026-75980BetterDocs WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-09-01Fix
CVE-2026-75965User Profile Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-09-01Fix
CVE-2026-75964User Profile Builder WordPress plugin unauthenticated stored cross-site scripting6.1CNA v3.10.4%2026-09-01Fix
CVE-2026-75921Master Addons for Elementor WordPress plugin arbitrary file upload7.2CNA v3.11.2%2026-09-01Fix
CVE-2026-75865WPLP Cookie Consent WordPress plugin unauthenticated arbitrary file upload9.8CNA v3.10.9%2026-09-01Exploit codeFix
CVE-2026-75604Next.js: Unauthenticated remote code execution on windows-hosted servers9.0CNA v3.12.1%2026-09-01MetasploitEmerging ThreatsExploit codeFix
CVE-2026-75538Erlang OTP inet TCP driver buffer overflow8.2CNA v4.00.9%2026-09-01Fix
CVE-2026-74994Erlang OTP inets, httpd: Authentication bypass via Directory Namespace Collapse in httpd mod_auth6.0CNA v4.00.6%2026-09-01Fix
CVE-2026-74916WP Fastest Cache - unauthenticated cache poisoning via Unkeyed Tracking parameters6.5CNA v3.10.2%2026-09-01Fix
CVE-2026-74837ash-project ash_typescript resource exhaustion8.7CNA v4.00.5%2026-09-01Fix
CVE-2026-74835Erlang OTP inets,httpd: Memory exhaustion via Unenforced max_body_size during Chunked Body Reception8.7CNA v4.00.6%2026-09-01Fix
CVE-2026-73812Erlang OTP inets, httpd: HTTP request smuggling via Transfer-Encoding and Content-Length8.3CNA v4.00.5%2026-09-01Fix
CVE-2026-73783Authenticated stack overflow vulnerabilities lead to denial of service in AOS-CX4.9CNA v3.10.4%2026-09-01Fix
CVE-2026-73782Unauthenticated format string vulnerability leads to remote code execution in AOS-CX8.8CNA v3.10.4%2026-09-01Fix
CVE-2026-73781Authenticated stored cross-site scripting vulnerability in AOS-CX Web-Based Management interface8.4CNA v3.10.5%2026-09-01Fix
CVE-2026-73780Lack of cross-site request forgery Protections for Certificate-Authenticated Sessions in AOS-CX8.3CNA v3.10.2%2026-09-01Fix
CVE-2026-73779HPE AOS-CX privilege escalation8.2CNA v3.10.2%2026-09-01Fix
CVE-2026-73778HPE AOS-CX Credential Manager vulnerability allows Unauthorized Administrative Access8.1CNA v3.10.5%2026-09-01Fix
CVE-2026-73777Authorization bypass vulnerabilities leading to privilege escalation in AOS-CX API endpoint8.1CNA v3.10.5%2026-09-01Fix
CVE-2026-73776Authenticated signature verification Bypass leading to arbitrary code execution in AOS-CX7.9CNA v3.10.1%2026-09-01Fix
CVE-2026-73775Authenticated sensitive information disclosure vulnerabilities in AOS-CX7.7CNA v3.10.5%2026-09-01Fix
CVE-2026-73774Unauthenticated buffer overflow vulnerability leads to sensitive information disclosure in AOS-CX7.6CNA v3.10.3%2026-09-01Fix
CVE-2026-73773Unauthenticated denial of service (DoS) Vulnerability in AOS-CX7.5CNA v3.10.5%2026-09-01Fix
CVE-2026-73772Unauthenticated buffer overflow vulnerabilities lead to denial of service in AOS-CX6.5CNA v3.10.3%2026-09-01Fix
CVE-2026-73771Improper authentication Handling in AOS-CX Management interface and API7.5CNA v3.10.5%2026-09-01Fix
CVE-2026-73770Authenticated arbitrary file write vulnerability leading to remote code execution in AOS-CX7.3CNA v3.10.2%2026-09-01Fix
CVE-2026-73768Local privilege escalation in AOS-CX Command Line interface7.3CNA v3.10.2%2026-09-01Fix
CVE-2026-73767Authenticated remote command injection vulnerabilities in AOS-CX Command Line interface7.2CNA v3.11.7%2026-09-01Fix
CVE-2026-73766Authenticated command injection vulnerabilities in the API endpoint of AOS-CX7.2CNA v3.11.5%2026-09-01Fix
CVE-2026-73765Authenticated path traversal vulnerabilities lead to remote code execution in AOS-CX7.2CNA v3.10.9%2026-09-01Fix
CVE-2026-73764HPE AOS-CX authentication bypass7.1CNA v3.10.3%2026-09-01Fix
CVE-2026-73763HPE AOS-CX unauthenticated remote command execution in Management component7.1CNA v3.10.5%2026-09-01Fix
CVE-2026-73762Authorization bypass in the API endpoint of AOS-CX leads to unauthorized access6.6CNA v3.10.3%2026-09-01Fix
CVE-2026-73761Unauthenticated out-of-bounds read vulnerability leads to information disclosure in AOS-CX6.5CNA v3.10.3%2026-09-01Fix
CVE-2026-73760Authenticated path traversal vulnerability leads to remote unauthorized access to files in AOS-CX6.5CNA v3.10.6%2026-09-01Fix
CVE-2026-73759Unauthenticated denial of service vulnerabilities in AOS-CX6.5CNA v3.10.3%2026-09-01Fix
CVE-2026-73758Authenticated privilege escalation vulnerability via broken access control in AOS-CX6.5CNA v3.10.3%2026-09-01Fix
CVE-2026-73757Authenticated server-side request forgery (SSRF) leading to information disclosure in AOS-CX6.4CNA v3.10.3%2026-09-01Fix
CVE-2026-73756Unauthenticated sensitive information disclosure via man-in-the-middle in AOS-CX via API endpoint5.9CNA v3.10.3%2026-09-01Fix
CVE-2026-73755HPE AOS-CX privilege escalation via unauthorized access to Sensitive Session Information5.7CNA v3.10.3%2026-09-01Fix
CVE-2026-73754Authenticated denial of service vulnerabilities in the Command Line interface of AOS-CX5.3CNA v3.10.3%2026-09-01Fix
CVE-2026-73753Authenticated remote command injection vulnerabilities in AOS-CX Command Line interface8.8CNA v3.10.7%2026-09-01Fix
CVE-2026-73752Unauthenticated arbitrary file write vulnerability leads to remote code execution in AOS-CX8.8CNA v3.10.5%2026-09-01Fix
CVE-2026-73751Authenticated remote command injection in AOS-CX Web-based Management interface8.8CNA v3.10.7%2026-09-01Fix
CVE-2026-73750HPE AOS-CX authentication module buffer overflow8.8CNA v3.10.8%2026-09-01Fix
CVE-2026-73749Unauthenticated buffer overflow vulnerabilities lead to remote code execution in AOS-CX9.8CNA v3.10.8%2026-09-01Fix
CVE-2026-73748Authenticated sensitive information disclosure in HPE Networking Fabric Composer2.2CNA v3.10.2%2026-09-01Fix
CVE-2026-73747Local privilege escalation vulnerability in HPE Networking Fabric Composer2.5CNA v3.10.1%2026-09-01Fix
CVE-2026-73746Authenticated denial of service vulnerability in HPE Networking Fabric Composer API3.1CNA v3.10.3%2026-09-01Fix
CVE-2026-73745HPE Networking Fabric Composer API information disclosure3.1CNA v3.10.3%2026-09-01Fix
CVE-2026-73744HPE Fabric Composer denial of service3.5CNA v3.10.3%2026-09-01Fix
CVE-2026-73743Unauthenticated information disclosure leading to data exposure in HPE Networking Fabric Composer3.7CNA v3.10.2%2026-09-01Fix
CVE-2026-73742HPE Networking Fabric Composer API spoofing4.3CNA v3.10.3%2026-09-01Fix
CVE-2026-73741Authenticated Limited File Read allows data exposure in HPE Networking Fabric Composer API4.3CNA v3.10.3%2026-09-01Fix
CVE-2026-73740Local privilege escalation in HPE Networking Fabric Composer4.4CNA v3.10.1%2026-09-01Fix
CVE-2026-73739Authenticated sensitive information disclosure in HPE Networking Fabric Composer API4.4CNA v3.10.2%2026-09-01Fix
CVE-2026-73738Authenticated sensitive information disclosure in HPE Networking Fabric Composer4.7CNA v3.10.1%2026-09-01Fix
CVE-2026-73737HPE Fabric Composer API endpoint of HPE Networking path traversal4.8CNA v3.10.2%2026-09-01Fix
CVE-2026-73736HPE Networking Fabric Composer web interface information disclosure5.3CNA v3.10.4%2026-09-01Fix
CVE-2026-73735HPE Networking Fabric Composer API information disclosure5.4CNA v3.10.3%2026-09-01Fix
CVE-2026-73734HPE Networking Fabric Composer web interface open redirect5.4CNA v3.10.3%2026-09-01Fix
CVE-2026-73733HPE Networking Fabric Composer API authentication bypass5.4CNA v3.10.3%2026-09-01Fix
CVE-2026-73732Local authenticated sensitive information disclosure in HPE Networking Fabric Composer5.6CNA v3.10.1%2026-09-01Fix
CVE-2026-73731HPE Networking Fabric Composer web interface reflected cross-site scripting6.1CNA v3.10.3%2026-09-01Fix
CVE-2026-73730Authenticated privilege escalation via broken access control in HPE Networking Fabric Composer API6.5CNA v3.10.3%2026-09-01Fix
CVE-2026-73729Authenticated sensitive information disclosure in HPE Networking Fabric Composer6.5CNA v3.10.1%2026-09-01Fix
CVE-2026-73728Authenticated denial of service vulnerabilities in HPE Networking Fabric Composer API6.5CNA v3.10.4%2026-09-01Fix
CVE-2026-73727Authenticated sensitive information disclosure in HPE Networking Fabric Composer API6.5CNA v3.10.3%2026-09-01Fix
CVE-2026-73726Authentication bypass in HPE Networking Fabric Composer allows Unauthorized Administrative Access6.8CNA v3.10.3%2026-09-01Fix
CVE-2026-73725Local privilege escalation leads to arbitrary code execution in HPE Networking Fabric Composer7.0CNA v3.10.1%2026-09-01Fix
CVE-2026-73724Authenticated privilege escalation via broken access control in HPE Networking Fabric Composer7.1CNA v3.10.3%2026-09-01Fix
CVE-2026-73723HPE Fabric Composer privilege escalation7.1CNA v3.10.4%2026-09-01Fix
CVE-2026-73722HPE Fabric Composer command injection7.2CNA v3.11.5%2026-09-01Fix
CVE-2026-73721Authenticated SQL injection vulnerabilities in HPE Networking Fabric Composer7.2CNA v3.10.5%2026-09-01Fix
CVE-2026-73720HPE Networking Fabric Composer API OS command injection7.2CNA v3.11.1%2026-09-01Fix
CVE-2026-73719HPE Fabric Composer API of HPE Networking arbitrary file write7.2CNA v3.10.7%2026-09-01Fix
CVE-2026-73718HPE Networking Fabric Composer web interface information disclosure7.4CNA v3.10.2%2026-09-01Fix
CVE-2026-73717HPE Fabric Composer command injection7.5CNA v3.10.8%2026-09-01Fix
CVE-2026-73716Unauthenticated remote code execution in HPE Networking Fabric Composer7.5CNA v3.10.6%2026-09-01Fix
CVE-2026-73715Unauthenticated denial of service (DoS) vulnerability in the API of HPE Networking Fabric Composer7.5CNA v3.10.6%2026-09-01Fix
CVE-2026-73714Authenticated sensitive information disclosure in HPE Networking Fabric Composer API7.6CNA v3.10.3%2026-09-01Fix
CVE-2026-73713Local privilege escalation vulnerabilities in HPE Networking Fabric Composer7.8CNA v3.10.1%2026-09-01Fix
CVE-2026-73712Unauthenticated remote code execution in HPE Networking Fabric Composer API8.1CNA v3.10.6%2026-09-01Fix
CVE-2026-73711HPE Fabric Composer API endpoint of HPE Networking privilege escalation8.1CNA v3.10.5%2026-09-01Fix
CVE-2026-73710Unauthenticated denial of service vulnerabilities in API endpoint of HPE Networking Fabric Composer8.2CNA v3.10.5%2026-09-01Fix
CVE-2026-73709Unauthenticated remote code execution during HPE Networking Fabric Composer Installation Process8.3CNA v3.10.3%2026-09-01Fix
CVE-2026-73708HPE Networking Fabric Composer API incorrect authorization8.3CNA v3.10.4%2026-09-01Fix
CVE-2026-73707Authenticated privilege escalation via broken access control in HPE Networking Fabric Composer API8.5CNA v3.10.3%2026-09-01Fix
CVE-2026-73706HPE Networking Fabric Composer API missing authentication8.6CNA v3.10.5%2026-09-01Fix
CVE-2026-73705Authenticated arbitrary file write leads to remote code execution in HPE Networking Fabric Composer8.8CNA v3.10.6%2026-09-01Fix
CVE-2026-73704HPE Fabric Composer API command sanitization command injection8.8CNA v3.10.5%2026-09-01Fix
CVE-2026-73703HPE Fabric Composer web-based management interface stored cross-site scripting8.8CNA v3.10.3%2026-09-01Fix
CVE-2026-73702Authenticated privilege escalation vulnerability in the API of HPE Networking Fabric Composer8.8CNA v3.10.4%2026-09-01Fix
CVE-2026-73701Unauthenticated remote code execution in HPE Networking Fabric Composer9.0CNA v3.10.7%2026-09-01Fix
CVE-2026-73700HPE Fabric Composer web-based management interface stored cross-site scripting9.0CNA v3.10.4%2026-09-01Fix
CVE-2026-73524Cypht XSS via FROM Email header in Contacts module5.1CNA v4.00.4%2026-09-01Fix
CVE-2026-73276Erlang OTP inets, httpd: HTTP request smuggling via Whitespace-Before-Colon Header Dropping i8.3CNA v4.00.6%2026-09-01Fix
CVE-2026-73270Erlang OTP case sensitivity bypass8.2CNA v4.00.9%2026-09-01Fix
CVE-2026-72682Allocation of resources without limits or throttling in Kibana leading to denial of service6.5CNA v3.10.4%2026-09-01Fix
CVE-2026-72654Execution with unnecessary privileges in Kibana leading to information disclosure6.5CNA v3.10.5%2026-09-01Fix
CVE-2026-72652Allocation of resources without limits or throttling in Kibana leading to denial of service6.5CNA v3.10.4%2026-09-01Fix
CVE-2026-72649Deserialization of untrusted data in Elasticsearch leading to remote code execution8.8CNA v3.10.9%2026-09-01Fix
CVE-2026-72644Uncaught exception in Kibana leading to denial of service6.5CNA v3.10.4%2026-09-01Fix
CVE-2026-72641Incorrect authorization in Kibana leading to unauthorized modification of Data5.4CNA v3.10.3%2026-09-01Fix
CVE-2026-72633Incorrect authorization in Kibana leading to Unauthorized Disabling of Privilege Monitoring4.3CNA v3.10.3%2026-09-01Fix
CVE-2026-72628Improper Handling of Highly Compressed Data in Kibana leading to denial of service6.5CNA v3.10.5%2026-09-01Fix
CVE-2026-71981Cypht PHP object injection RCE via back_query parameter8.7CNA v4.01.0%2026-09-01Exploit codeFix
CVE-2026-71562Erlang OTP httpc does not bound server-supplied numeric header values before integer conversion6.3CNA v4.00.6%2026-09-01Fix
CVE-2026-71380Erlang OTP missing resource release8.7CNA v4.00.7%2026-09-01Fix
CVE-2026-70409Erlang OTP eldap does not bound the port component of a referral URL before integer conversion6.3CNA v4.00.6%2026-09-01Fix
CVE-2026-70405Erlang OTP snmp BER integer decoder applies no size limit to attacker-supplied integer fields6.3CNA v4.00.7%2026-09-01Fix
CVE-2026-70399Erlang OTP httpd does not enforce the documented default max_clients connection limit8.7CNA v4.00.9%2026-09-01Fix
CVE-2026-69664Erlang OTP missing resource release8.7CNA v4.00.9%2026-09-01Fix
CVE-2026-67395Sage Employee Self Service path traversal5.9CNA v3.01.1%2026-09-01Fix
CVE-2026-67394WebPros Plesk OS command injection9.0CNA v4.01.3%2026-09-01Fix
CVE-2026-66835Erlang OTP httpd mod_auth directory protection bypassed by a doubled slash in the request path8.2CNA v4.01.0%2026-09-01Fix
CVE-2026-66357Erlang OTP inets,httpd:HTTP request smuggling via obs-fold Header Continuation8.3CNA v4.00.6%2026-09-01Fix
CVE-2026-65643WebPros cPanel eval injection8.8NVD v3.10.9%2026-09-01Exploit codeFix
CVE-2026-63435Mail: Email address spoofing via malformed RFC 2047 encoded-words5.3CNA v3.10.4%2026-09-01Fix
CVE-2026-63138Elastic Kibana Data Query Logic improper neutralization6.5CNA v3.10.5%2026-09-01Fix
CVE-2026-63137Incorrect authorization in Kibana leading to privilege escalation8.3CNA v3.10.5%2026-09-01Fix
CVE-2026-61779NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61778NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61777NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61776NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61775NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61774NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61773NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61772NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61771NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61770NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61769NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61768NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61767NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61766NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61765NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61764NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61763NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61762NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61761NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61760NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61759NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61758NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61757NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61756NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61755NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61754NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61753NVIDIA Megatron Bridge path traversal7.8CNA v3.10.5%2026-09-01Fix
CVE-2026-61752NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61751NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-61750NVIDIA Megatron Bridge deserialization of untrusted data7.8CNA v3.10.4%2026-09-01Fix
CVE-2026-59696Erlang OTP uri_string does not bound the port component of a URI before integer conversion6.9CNA v4.00.7%2026-09-01Fix
CVE-2026-59681SUSE yast2-auth-client OS command injection8.7CNA v4.01.5%2026-09-01Fix
CVE-2026-59680SUSE yast2-users password settings dialog OS command injection8.6CNA v4.01.6%2026-09-01Fix
CVE-2026-58575Dell PowerStore 500T authentication bypass by spoofing8.8CNA v3.10.5%2026-09-01Fix
CVE-2026-58572Dell PowerStore 500T code injection8.8CNA v3.10.3%2026-09-01Fix
CVE-2026-58571Dell PowerStore 500T OS command injection8.8CNA v3.10.7%2026-09-01Fix
CVE-2026-58569Dell PowerStore 500T inclusion of untrusted functionality8.8CNA v3.10.2%2026-09-01Fix
CVE-2026-58567Dell PowerStore 500T OS command injection8.8CNA v3.10.7%2026-09-01Fix
CVE-2026-58566Dell PowerStore 500T incorrect authorization8.8CNA v3.10.4%2026-09-01Fix
CVE-2026-56143Allocation of resources without limits or throttling in Elasticsearch leading to denial of service4.9CNA v3.10.4%2026-09-01Fix
CVE-2026-55951Erlang OTP httpc memory exhaustion via unbounded response header accumulation8.2CNA v4.00.7%2026-09-01Fix
CVE-2026-53682Red Hat Certificate System security domain hosts REST API information disclosure5.3CNA v3.10.2%2026-09-01
CVE-2026-52295FFmpeg out-of-bounds read6.2CISA ADP v3.10.2%2026-09-01Fix
CVE-2026-52132Ggml llama.cpp uncontrolled recursion7.5CISA ADP v3.10.6%2026-09-01Fix
CVE-2026-52131Ggml llama.cpp reachable assertion7.5CISA ADP v3.10.4%2026-09-01
CVE-2026-52130Ggml llama.cpp uncontrolled recursion7.5CISA ADP v3.10.5%2026-09-01
CVE-2026-52111fast-note-sync-service admin configuration endpoint privilege escalation9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-52023kamailio double free7.5NVD v3.10.4%2026-09-01Fix
CVE-2026-52022kamailio denial of service7.5CISA ADP v3.10.6%2026-09-01Fix
CVE-2026-51974lllyasviel Fooocus metadata parser code injection8.8CISA ADP v3.10.8%2026-09-01
CVE-2026-51956Grashjs Atlas CMMS company endpoint vulnerability8.1CISA ADP v3.10.4%2026-09-01
CVE-2026-51934Shenzhen Jixiang Tengda Technology Co buffer overflow9.8CISA ADP v3.11.2%2026-09-01
CVE-2026-51788cleverange_auth account verification denial of service7.5CISA ADP v3.10.8%2026-09-01
CVE-2026-51770TOTOLINK T6 cs_broker MQTT service improper access control9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51769TOTOLINK T6 cs_broker MQTT service improper access control9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51768TOTOLINK T6 cs_broker MQTT service improper access control7.5CISA ADP v3.10.5%2026-09-01
CVE-2026-51767TOTOLINK T6 pairing configuration reset function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51766TOTOLINK T6 device reboot function vulnerability7.5CISA ADP v3.10.6%2026-09-01
CVE-2026-51765TOTOLINK T6 mesh neighbor record function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51764TOTOLINK T6 cloud check status function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51763TOTOLINK T6 wireless client disconnect function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51762TOTOLINK T6 mesh metadata cleanup function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51761TOTOLINK T6 LAN address refresh function vulnerability5.3CISA ADP v3.10.4%2026-09-01
CVE-2026-51760TOTOLINK T6 mesh firmware update trigger function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51757TOTOLINK T6 mesh firmware update function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51756TOTOLINK T6 mesh firmware flashing function vulnerability5.9CISA ADP v3.10.4%2026-09-01
CVE-2026-51754TOTOLINK T6 slave IP inventory function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51752TOTOLINK T6 static information reporting function vulnerability5.3CISA ADP v3.10.4%2026-09-01
CVE-2026-51751TOTOLINK T6 slave device removal function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51750TOTOLINK T6 primary mesh channel function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51748TOTOLINK T6 slave inventory update function vulnerability5.9CISA ADP v3.10.4%2026-09-01
CVE-2026-51747TOTOLINK T6 mesh heartbeat function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51745TOTOLINK T6 primary station list function vulnerability5.3CISA ADP v3.10.4%2026-09-01
CVE-2026-51744TOTOLINK T6 mesh configuration sync function vulnerability9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-51743TOTOLINK T6 guest Wi-Fi sync function vulnerability9.1CISA ADP v3.10.5%2026-09-01
CVE-2026-51742TOTOLINK T6 WAN discovery function vulnerability5.9CISA ADP v3.10.4%2026-09-01
CVE-2026-51741TOTOLINK T6 clearDiagnosisLog function improper access control9.8CISA ADP v3.10.6%2026-09-01
CVE-2026-49329Openshift/oauth-server: Openshift/oauth-server: Quadratic-time DoS7.5CNA v3.10.7%2026-09-01Fix
CVE-2026-48932Node.js Node HTTP request smuggling3.7CNA v3.00.3%2026-09-01Fix
CVE-2026-45221Konga privilege escalation via Hard-coded OpenSSL Path8.5CNA v4.00.2%2026-09-01Fix
CVE-2026-33465Allocation of resources without limits or throttling in Kibana leading to denial of service6.5CNA v3.10.4%2026-09-01Fix
CVE-2026-25706SUSE yast2-samba-client OS command improper neutralization7.5CNA v4.00.5%2026-09-01Fix
CVE-2026-19952Frontend Admin by DynamiApps WordPress plugin unauthenticated arbitrary file deletion7.5CNA v3.11.0%2026-09-01Exploit codeFix
CVE-2026-19948Cozy Blocks WordPress plugin authorization bypass5.3CNA v3.10.4%2026-09-01Fix
CVE-2026-19914Welcart e-Commerce WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2026-09-01Fix
CVE-2026-19820Backblaze Client for Windows Improper Link Resolution vulnerability5.8CNA v4.00.3%2026-09-01
CVE-2026-19806Support Genix WordPress plugin authentication bypass to Administrator account takeover8.8CNA v3.10.4%2026-09-01Fix
CVE-2026-19796Webilia Listdom display style parameter stored cross-site scripting7.2CNA v3.10.2%2026-09-01Fix
CVE-2026-19766HPE Fabric Composer underlying operating system of HPE Networking authentication bypass9.6CNA v3.10.3%2026-09-01Fix
CVE-2026-19593OpenAI Codex Desktop external control of a configuration setting9.8CISA ADP v3.10.4%2026-09-01
CVE-2026-19592OpenAI Codex CLI external control of a configuration setting7.3CISA ADP v3.10.1%2026-09-01
CVE-2026-19591OpenAI Codex CLI escape sequence injection8.8CISA ADP v3.10.3%2026-09-01
CVE-2026-19590OpenAI Codex Desktop uncontrolled search path7.3CISA ADP v3.10.1%2026-09-01
CVE-2026-19573Affiliate Super Assistent WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.2%2026-09-01Fix
CVE-2026-19513Gravity Forms WordPress plugin unauthenticated arbitrary file upload via State/Chunk Hash confusion8.1CNA v3.10.5%2026-09-01Fix
CVE-2026-19472Rockwell Automation ArmorStart® LT denial of service8.7CNA v4.00.3%2026-09-01Fix
CVE-2026-19471Rockwell Automation ArmorStart® LT stored cross-site scripting6.9CNA v4.00.3%2026-09-01Fix
CVE-2026-19118GitHub Enterprise Server repository upload handling race condition7.7CNA v4.00.5%2026-09-01Fix
CVE-2026-19032jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path5.3CNA v3.10.5%2026-09-01Fix
CVE-2026-18931Hard-coded credentials in TMT Machine's Talassoft Industrial Management Software9.1CNA v3.10.2%2026-09-01Fix
CVE-2026-18808Unauthenticated remote code execution via code injection in Klemsan's KIO9.8CNA v3.10.4%2026-09-01Fix
CVE-2026-18780CSRF in TMT Machine's Talassoft Industrial Management Software7.1CNA v3.10.1%2026-09-01Fix
CVE-2026-18771TMT Machine Industry and Trade Talassoft Industrial Management Software missing authentication7.5CNA v3.10.4%2026-09-01Fix
CVE-2026-18765SQL injection in Teracity Sotware's Teracity E-OSB Platform9.8CNA v3.10.3%2026-09-01Fix
CVE-2026-18752Persistent Login WordPress plugin SQL injection6.5CNA v3.10.2%2026-09-01Fix
CVE-2026-18743rpm-software-management popt Popt-devel: Popt-static: Short realloc in poptconfigfiletostring2.5CNA v3.10.1%2026-09-01Fix
CVE-2026-18730GitHub Enterprise Server Manage API server-side request forgery8.2CNA v4.00.3%2026-09-01Fix
CVE-2026-18630SQL injection in TMT Machine's Talassoft Industrial Management Software8.8CNA v3.10.3%2026-09-01Fix
CVE-2026-18550Nokri - Job Board WordPress theme unauthenticated privilege escalation via token parameter9.8CNA v3.10.3%2026-09-01Fix
CVE-2026-18488Blocksy Companion WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-09-01Fix
CVE-2026-18210SQL injection in TRtek Technological Products's Store9.8CNA v3.10.4%2026-09-01Fix
CVE-2026-17589Shopping Cart and eCommerce Store WordPress plugin SQL injection4.9CNA v3.10.3%2026-09-01Fix
CVE-2026-16788Live Composer WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-09-01Fix
CVE-2026-16787Live Composer WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-09-01Fix
CVE-2026-16786Live Composer WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-09-01Fix
CVE-2026-16675Rockwell Automation FactoryTalk® Activation Manager privilege escalation8.5CNA v4.00.1%2026-09-01Fix
CVE-2026-15101WPBakery Page Builder WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-09-01Fix
CVE-2026-13611KiviCare REST endpoints missing authorization5.3CNA v3.10.2%2026-09-01Fix
CVE-2026-13348Schneider Electric PowerChute™ Serial Shutdown missing brute-force protection6.9CNA v4.00.3%2026-09-01Fix
CVE-2026-13337Schneider Electric NetBotz 5 SQL injection5.1CNA v4.00.2%2026-09-01Fix
CVE-2026-13336Schneider Electric NetBotz 5 OS command injection7.3CNA v4.00.6%2026-09-01Fix
CVE-2026-13203Live Composer WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-09-01Fix
CVE-2026-12747Frontend Admin by DynamiApps WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2026-09-01Fix
CVE-2026-12663ControlFLASH ® improper access control7.0CNA v4.00.1%2026-09-01Fix
CVE-2026-12661FactoryTalk® Historian Machine Edition out-of-bounds write4.8CNA v4.00.2%2026-09-01
CVE-2026-11873Red Hat Certificate System CA REST certrequests endpoint vulnerability6.5CNA v3.10.3%2026-09-01
CVE-2026-10420Samsung Open Source mTower untrusted pointer dereference5.5CNA v3.10.1%2026-09-01
CVE-2026-10195FS Poster WordPress plugin authenticated (Subscriber+) remote code execution via FFmpeg path setting8.8CNA v3.10.6%2026-09-01Fix
CVE-2026-9637Rockwell Automation CompactLogix® 5380 / ControlLogix® 5580 denial of service8.7CNA v4.00.4%2026-09-01Fix
CVE-2026-9634Rockwell Automation Redundancy Module Configuration Tool privilege escalation7.0CNA v4.00.1%2026-09-01Fix
CVE-2026-9633Rockwell Automation Redundancy Module Configuration Tool privilege escalation7.0CNA v4.00.1%2026-09-01Fix
CVE-2026-9625Rockwell Automation RSLinx Classic CIP message request handling denial of service8.7CNA v4.00.4%2026-09-01Fix
CVE-2026-9624Rockwell Automation RSLinx Classic CIP packet handling denial of service8.7CNA v4.00.4%2026-09-01Fix
CVE-2026-9622Rockwell Automation RSLinx Classic CIP Forward Close service denial of service8.7CNA v4.00.4%2026-09-01Fix
CVE-2026-9621Rockwell Automation RSLinx Classic CIP packet handling denial of service9.2CNA v4.00.4%2026-09-01Fix
CVE-2026-8712Wyoming SSRF via uri Query parameter6.9CNA v4.00.3%2026-09-01Exploit codeFix
CVE-2026-7877WP Recipe Maker Premium WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2026-09-01Fix
CVE-2026-4813Code injection in the Lutece Core9.4CNA v4.00.5%2026-09-01Exploit codeFix