By publication date

Exploited and new serious CVEs: September 2026

7,953 records · 28 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-19573No exploit	Affiliate Super Assistent <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ functionworschtebrot · affiliate super assistent · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Sep 1, 2026
28Monitor	CVE-2026-19796No exploit	Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameterwebilia · listdom: ai-powered business directory with classifieds ads listings · CWE-79 Pre-auth XSS	High7.2	—	0.2%	Sep 1, 2026
35Monitor	CVE-2026-19806No exploit	Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Tokendevitemsllc · support genix – helpdesk, ai chatbot, knowledge base & customer support ticketing system · CWE-287 Auth bypass	High8.8	—	0.3%	Sep 1, 2026
30Monitor	CVE-2026-19952Proof of concept	Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tagshabti · frontend admin by dynamiapps · CWE-22 pre-auth RCE Auth bypass Path traversal	High7.5	—	0.9%	Sep 1, 2026
28Monitor	CVE-2026-75921No exploit	Master Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extractionpixarlabs · master addons for elementor – elementor addons, widgets, mega menu builder, popup builder, widget builder & template kits · CWE-863 RCE File upload Broken access control (IDOR)	High7.2	—	1.1%	Sep 1, 2026
25Monitor	CVE-2026-75965No exploit	User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attributecozmoslabs · user profile builder – beautiful user registration forms, user profiles & user role editor · CWE-79 XSS	Medium6.4	—	0.3%	Sep 1, 2026
35Monitor	CVE-2026-83772No exploit	Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injectioncobham · satcom vsat7090 maritime satellite router · CWE-74 RCE Command injection	High8.6	—	3.2%	Sep 1, 2026
37Monitor	CVE-2026-78319No exploit	TOCTOU Vulnerability in file exchangesauter · modu680-as · CWE-367 Pre-auth Race condition	Critical9.3	—	0.6%	Sep 1, 2026
34Monitor	CVE-2026-65643Proof of concept	Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.cpanel · cpanel · CWE-95 RCE	High8.7	—	0.8%	Sep 1, 2026
28Monitor	CVE-2026-19914No exploit	Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameteruscnanbu · welcart e-commerce · CWE-79 Pre-auth XSS	High7.2	—	0.3%	Sep 1, 2026
30Monitor	CVE-2026-25706No exploit	yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)suse · yast2-samba-client · CWE-78 pre-auth RCE Command injection	High7.5	—	0.4%	Sep 1, 2026
34Monitor	CVE-2026-59680No exploit	yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attributesuse · yast2-users · CWE-78 RCE Command injection	High8.6	—	1.5%	Sep 1, 2026
34Monitor	CVE-2026-59681No exploit	yast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD joinsuse · yast2-auth-client · CWE-78 pre-auth RCE Command injection	High8.7	—	1.4%	Sep 1, 2026
37Monitor	CVE-2026-4813Proof of concept	Code injection in the Lutece Corelutece · lutece core · CWE-94 RCE	Critical9.4	—	0.5%	Sep 1, 2026
34Monitor	CVE-2026-84165No exploit	Lack of authorisation in OpenNebula by OpenNebula Systemsopennebula systems · opennebula · CWE-284 Broken access control (IDOR)	High8.7	—	0.4%	Sep 1, 2026
39Monitor	CVE-2026-18550No exploit	Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameterscriptsbundle · nokri – job board wordpress theme · CWE-269 Pre-auth	Critical9.8	—	0.3%	Sep 1, 2026
28Monitor	CVE-2026-83595No exploit	AVideo Cross-Site Request Forgery via plugin/API/set.json.phpwwbn · avideo · CWE-352 Pre-auth CSRF	High7.2	—	0.2%	Sep 1, 2026
35Monitor	CVE-2026-84187No exploit	AVideo on_publish.php Missing Authentication Check via RTMP Callbackwwbn · avideo · CWE-284 Pre-auth Auth bypass Broken access control (IDOR)	High8.8	—	0.5%	Sep 1, 2026
34Monitor	CVE-2026-84194No exploit	LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostnamelibrenms · librenms · CWE-78 RCE Command injection	High8.6	—	1.5%	Sep 1, 2026
33Monitor	CVE-2026-84195No exploit	Kyverno before 1.16.4 Credential Leak via apiCallkyverno · kyverno · CWE-200 Info leak	High8.3	—	0.3%	Sep 1, 2026
33Monitor	CVE-2026-84196No exploit	Kyverno before 1.18.0 Server-Side Request Forgery via apiCallkyverno · kyverno · CWE-918 SSRF	High8.3	—	0.3%	Sep 1, 2026
37Monitor	CVE-2026-84200No exploit	Kyverno before v1.13.0 Policy Bypass via Multiple Exceptionskyverno · kyverno · CWE-284 Broken access control (IDOR)	Critical9.4	—	0.2%	Sep 1, 2026
39Monitor	CVE-2026-18765No exploit	SQL Injection in Teracity Sotware's Teracity E-OSB Platformteracity software technologies inc. · e-osb · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.2%	Sep 1, 2026
34Monitor	CVE-2026-19472No exploit	Rockwell Automation ArmorStart® LT Denial Of Servicerockwell automation · armorstart® lt · CWE-770 Pre-auth Denial of service	High8.7	—	0.3%	Sep 1, 2026
39Monitor	CVE-2026-51741No exploit	Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
36Monitor	CVE-2026-51743No exploit	Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guCWE-284 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.5%	Sep 1, 2026
39Monitor	CVE-2026-51744No exploit	Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
39Monitor	CVE-2026-51747No exploit	Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect meCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
35Monitor	CVE-2026-84117No exploit	Privilege escalation in Firefox for Androidmozilla · firefox mobile · CWE-284 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Sep 1, 2026
21Monitor	CVE-2026-84118Proof of concept	Use-after-free in the JavaScript: GC componentmozilla · firefox · CWE-416 Pre-auth Memory safety	Medium5.4	—	0.2%	Sep 1, 2026
38Monitor	CVE-2026-84119No exploit	Sandbox escape due to use-after-free in the DOM: Navigation componentmozilla · firefox · CWE-416 Pre-auth Memory safety	Critical9.6	—	0.3%	Sep 1, 2026
38Monitor	CVE-2026-84121No exploit	Sandbox escape due to use-after-free in the DOM: Security componentmozilla · firefox · CWE-416 Pre-auth Memory safety	Critical9.6	—	0.3%	Sep 1, 2026
35Monitor	CVE-2026-84123No exploit	Privilege escalation due to use-after-free in the Graphics: WebGPU componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.4%	Sep 1, 2026
35Monitor	CVE-2026-84128No exploit	Privilege escalation in the WebDriver BiDi componentmozilla · firefox · CWE-284 Pre-auth Broken access control (IDOR)	High8.8	—	0.4%	Sep 1, 2026
39Monitor	CVE-2026-84129No exploit	Site isolation issue in the DOM: Navigation componentmozilla · firefox · CWE-346 Pre-auth	Critical9.8	—	0.1%	Sep 1, 2026
30Monitor	CVE-2026-84130No exploit	Information disclosure in the Graphics: WebGPU componentmozilla · firefox · CWE-200 Pre-auth Info leak	High7.5	—	0.4%	Sep 1, 2026
35Monitor	CVE-2026-84131No exploit	Privilege escalation due to invalid pointer in the Graphics componentmozilla · firefox · CWE-763 Pre-auth	High8.8	—	0.3%	Sep 1, 2026
30Monitor	CVE-2026-84132No exploit	Information disclosure in the Networking: HTTP componentmozilla · firefox · CWE-200 Pre-auth Info leak	High7.5	—	0.2%	Sep 1, 2026
39Monitor	CVE-2026-84133No exploit	Site isolation issue in the DOM: Push Subscriptions componentmozilla · firefox · CWE-346 Pre-auth	Critical9.8	—	0.1%	Sep 1, 2026
39Monitor	CVE-2026-84134No exploit	Other issue in the Profile Backup componentmozilla · firefox · CWE-200 Pre-auth Info leak	Critical9.8	—	0.5%	Sep 1, 2026
39Monitor	CVE-2026-84135No exploit	Other issue in Firefox Focus for Androidmozilla · firefox mobile · CWE-20 Pre-auth	Critical9.8	—	0.4%	Sep 1, 2026
39Monitor	CVE-2026-84140No exploit	Site isolation issue in the DOM: Navigation componentmozilla · firefox · CWE-346 Pre-auth	Critical9.8	—	0.1%	Sep 1, 2026
39Monitor	CVE-2026-84141No exploit	Integer overflow in the Graphics: ImageLib componentmozilla · firefox · CWE-190 Pre-auth Memory safety	Critical9.8	—	0.3%	Sep 1, 2026
39Monitor	CVE-2026-84142No exploit	Internally found bugs fixed in Thunderbird 155mozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.8	—	0.5%	Sep 1, 2026
39Monitor	CVE-2026-84143No exploit	Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15mozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.8	—	0.3%	Sep 1, 2026
30Monitor	CVE-2026-84144No exploit	Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2mozilla · firefox · CWE-119 Pre-auth Memory safety	High7.5	—	0.4%	Sep 1, 2026
30Monitor	CVE-2026-84145No exploit	Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15mozilla · firefox · CWE-119 Pre-auth Memory safety	High7.5	—	0.3%	Sep 1, 2026
40Plan	CVE-2026-84147No exploit	Remote Code Execution Vulnerability in Manacle Technologies ERP Systemmanacle technologies · multi-tenant erp system · CWE-434 pre-auth RCE Auth bypass File upload	Critical10.0	—	0.9%	Sep 1, 2026
36Monitor	CVE-2026-84148No exploit	Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP Systemmanacle technologies · multi-tenant erp system · CWE-639 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.2	—	0.6%	Sep 1, 2026
36Monitor	CVE-2026-84149No exploit	Information Disclosure Vulnerability in Manacle Technologies ERP Systemmanacle technologies · multi-tenant erp system · CWE-527 Pre-auth	Critical9.2	—	0.5%	Sep 1, 2026
34Monitor	CVE-2026-84235No exploit	Rockwell Automation 1756-ENBT Denial of Service Vulnerabilityrockwell automation · 1756-enbt module · CWE-400 Pre-auth Denial of service	High8.7	—	0.4%	Sep 1, 2026
32Monitor	CVE-2024-10085No exploit	CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communicschneider electric · ecostruxure™ opc ua server expert · CWE-770 Pre-auth Denial of service	High8.2	—	0.3%	Sep 1, 2026
28Monitor	CVE-2024-14047No exploit	Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Serviceelastic · winlogbeat · CWE-59 Local privilege escalation	High7.1	—	0.1%	Sep 1, 2026
34Monitor	CVE-2025-12768No exploit	FactoryTalk® Historian Machine Edition - Out-of-Bounds Write Vulnerabilityrockwell automation · factorytalk® historian machine edition · CWE-787 RCE Memory safety	High8.6	—	0.3%	Sep 1, 2026
28Monitor	CVE-2026-12663No exploit	ControlFLASH ® – Improper Access Controlrockwell automation · controlflash ® · CWE-306 RCE Auth bypass	High7.0	—	0.1%	Sep 1, 2026
29Monitor	CVE-2026-13336No exploit	CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause exeschneider electric · netbotz 5 - 750/755 · CWE-78 RCE Command injection	High7.3	—	0.6%	Sep 1, 2026
34Monitor	CVE-2026-16675No exploit	Rockwell Automation FactoryTalk® Activation Manager - Privilege Escalationrockwell automation · factorytalk® activation manager · CWE-307 Local privilege escalation	High8.5	—	0.1%	Sep 1, 2026
39Monitor	CVE-2026-18210No exploit	SQL Injection in TRtek Technological Products's Storetrtek technological products computer software hardware industry and trade limited company · products's store · CWE-89 Pre-auth SQL injection	Critical9.8	—	0.3%	Sep 1, 2026
39Monitor	CVE-2026-18808No exploit	Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIOklemsan electrical electronics inc. · kio (klemsan internet objects) · CWE-94 pre-auth RCE	Critical9.8	—	0.3%	Sep 1, 2026
32Monitor	CVE-2026-19513No exploit	Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusiongravity forms · gravity forms · CWE-434 pre-auth RCE File upload	High8.1	—	0.5%	Sep 1, 2026
39Monitor	CVE-2026-51750No exploit	Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan anCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
39Monitor	CVE-2026-51751No exploit	Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a spCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
39Monitor	CVE-2026-51754No exploit	Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwritCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
39Monitor	CVE-2026-51757No exploit	Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a fiCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
39Monitor	CVE-2026-51760No exploit	Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-triggCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
39Monitor	CVE-2026-51762No exploit	Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or cleanCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
39Monitor	CVE-2026-51763No exploit	Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
39Monitor	CVE-2026-51764No exploit	Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
39Monitor	CVE-2026-51765No exploit	Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to inserCWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 1, 2026
30Monitor	CVE-2026-51766No exploit	Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reboot the loCWE-284 Pre-auth Broken access control (IDOR) Denial of service	High7.5	—	0.6%	Sep 1, 2026
31Monitor	CVE-2026-80047No exploit	Hugging Face Transformers library writes remote code to disk prior to consent checkhugging face · transformers · CWE-273	High7.8	—	0.0%	Sep 1, 2026
32Monitor	CVE-2026-84218No exploit	Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)red hat · red hat amq broker 7 · CWE-184 Pre-auth	High8.1	—	0.9%	Sep 1, 2026
36Monitor	CVE-2026-9621No exploit	RSLinx Classic® - Multiple Vulnerabilitiesrockwell automation · rslinx classic® · CWE-190 Pre-auth Memory safety	Critical9.2	—	0.4%	Sep 1, 2026
34Monitor	CVE-2026-9622No exploit	RSLinx Classic® - Multiple Vulnerabilitiesrockwell automation · rslinx classic® · CWE-191 Pre-auth Memory safety	High8.7	—	0.4%	Sep 1, 2026
34Monitor	CVE-2026-9624No exploit	RSLinx Classic® - Multiple Vulnerabilitiesrockwell automation · rslinx classic® · CWE-191 Pre-auth Memory safety	High8.7	—	0.4%	Sep 1, 2026
34Monitor	CVE-2026-9625No exploit	RSLinx Classic® - Multiple Vulnerabilitiesrockwell automation · rslinx classic® · CWE-120 Pre-auth Memory safety	High8.7	—	0.4%	Sep 1, 2026
28Monitor	CVE-2026-9633No exploit	Redundancy Module Configuration Tool - Multiple Vulnerabilitiesrockwell automation · redundancy module configuration tool · CWE-276 Local privilege escalation	High7.0	—	0.1%	Sep 1, 2026
28Monitor	CVE-2026-9634No exploit	Redundancy Module Configuration Tool - Multiple Vulnerabilitiesrockwell automation · redundancy module configuration tool · CWE-276 Local privilege escalation	High7.0	—	0.1%	Sep 1, 2026
34Monitor	CVE-2026-9637No exploit	CompactLogix® 5380 / ControlLogix® 5580 - Multiple Vulnerabilitiesrockwell automation · compactlogix® 5380 / controllogix® 5580 · CWE-119 Pre-auth Memory safety	High8.7	—	0.4%	Sep 1, 2026
35Monitor	CVE-2026-18630No exploit	SQL Injection in TMT Machine's Talassoft Industrial Management Softwaretmt machine industry and trade ltd. co. · talassoft industrial management software · CWE-89 SQL injection	High8.8	—	0.2%	Sep 1, 2026
30Monitor	CVE-2026-18771No exploit	Missing Authentication for Critical Function in TMT Machine's Talassoft Industrial Management Softwaretmt machine industry and trade ltd. co. · talassoft industrial management software · CWE-306 Pre-auth Auth bypass Denial of service	High7.5	—	0.4%	Sep 1, 2026
28Monitor	CVE-2026-18780No exploit	CSRF in TMT Machine's Talassoft Industrial Management Softwaretmt machine industry and trade ltd. co. · talassoft industrial management software · CWE-352 Pre-auth CSRF	High7.1	—	0.1%	Sep 1, 2026
32Monitor	CVE-2026-55951No exploit	httpc memory exhaustion via unbounded response header accumulationerlang · otp · CWE-770 Pre-auth Denial of service	High8.2	—	0.6%	Sep 1, 2026
33Monitor	CVE-2026-66357No exploit	inets,httpd:HTTP Request Smuggling via obs-fold Header Continuationerlang · otp · CWE-444 Pre-auth	High8.3	—	0.5%	Sep 1, 2026
32Monitor	CVE-2026-66835No exploit	httpd mod_auth directory protection bypassed by a doubled slash in the request patherlang · otp · CWE-50 Pre-auth	High8.2	—	0.9%	Sep 1, 2026
34Monitor	CVE-2026-69664No exploit	httpd parks a request worker indefinitely on a malformed chunk size sent after the headerserlang · otp · CWE-772 Pre-auth	High8.7	—	0.9%	Sep 1, 2026
34Monitor	CVE-2026-70399No exploit	httpd does not enforce the documented default max_clients connection limiterlang · otp · CWE-770 Pre-auth Denial of service	High8.7	—	0.9%	Sep 1, 2026
34Monitor	CVE-2026-71380No exploit	httpd applies no timeout while receiving a request body, parking a worker on a stalled clienterlang · otp · CWE-772 Pre-auth	High8.7	—	0.6%	Sep 1, 2026
32Monitor	CVE-2026-73270No exploit	httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystemserlang · otp · CWE-178 Pre-auth	High8.2	—	0.9%	Sep 1, 2026
33Monitor	CVE-2026-73276No exploit	inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping ierlang · otp · CWE-444 Pre-auth	High8.3	—	0.5%	Sep 1, 2026
33Monitor	CVE-2026-73812No exploit	inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Lengtherlang · otp · CWE-444 Pre-auth	High8.3	—	0.5%	Sep 1, 2026
34Monitor	CVE-2026-74835No exploit	inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Receptionerlang · otp · CWE-770 Pre-auth Denial of service	High8.7	—	0.5%	Sep 1, 2026
32Monitor	CVE-2026-75538No exploit	A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peererlang · otp · CWE-122 pre-auth RCE Memory safety	High8.2	—	0.8%	Sep 1, 2026
37Monitor	CVE-2026-78012No exploit	Stack-based Buffer Overflow in Pyramid Solutions NetStaX EtherNet/IP Stackpyramid solutions · ethernet/ip adapter dll kit (eipa) · CWE-121 Pre-auth Memory safety	Critical9.3	—	0.6%	Sep 1, 2026
34Monitor	CVE-2026-83605No exploit	xmldom: Attribute name injection via setAttribute() bypasses requireWellFormedxmldom · xmldom · CWE-91 Pre-auth	High8.7	—	0.6%	Sep 1, 2026
34Monitor	CVE-2026-83606No exploit	xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructionsxmldom · xmldom · CWE-400 Pre-auth Denial of service	High8.7	—	0.5%	Sep 1, 2026
34Monitor	CVE-2026-83607No exploit	xmldom: Element name injection via createElement() bypasses requireWellFormedxmldom · xmldom · CWE-91 Pre-auth XSS	High8.7	—	0.6%	Sep 1, 2026
34Monitor	CVE-2026-83608No exploit	xmldom: DocType `name` Injection Bypasses requireWellFormedxmldom · xmldom · CWE-91 Pre-auth	High8.7	—	0.6%	Sep 1, 2026
34Monitor	CVE-2026-83609No exploit	xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization pathxmldom · xmldom · CWE-91 Pre-auth	High8.7	—	0.5%	Sep 1, 2026
34Monitor	CVE-2026-83612No exploit	xmldom: HTML raw-text closing-tag case mismatch causes output amplificationxmldom · xmldom · CWE-178 Pre-auth	High8.7	—	0.5%	Sep 1, 2026

CVE-2026-19573
28Monitor
Affiliate Super Assistent <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
worschtebrot · affiliate super assistentSep 1, 2026
CVE-2026-19796
28Monitor
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
webilia · listdom: ai-powered business directory with classifieds ads listingsSep 1, 2026
CVE-2026-19806
35Monitor
Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token
HighCVSS 8.8No exploitEPSS 0%
- Auth bypass
devitemsllc · support genix – helpdesk, ai chatbot, knowledge base & customer support ticketing systemSep 1, 2026
CVE-2026-19952
30Monitor
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
HighCVSS 7.5Proof of conceptEPSS 0%
- pre-auth RCE
- Auth bypass
- Path traversal
shabti · frontend admin by dynamiappsSep 1, 2026
CVE-2026-75921
28Monitor
Master Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction
HighCVSS 7.2No exploitEPSS 1%
- RCE
- File upload
- Broken access control (IDOR)
pixarlabs · master addons for elementor – elementor addons, widgets, mega menu builder, popup builder, widget builder & template kitsSep 1, 2026
CVE-2026-75965
25Monitor
User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
MediumCVSS 6.4No exploitEPSS 0%
- XSS
cozmoslabs · user profile builder – beautiful user registration forms, user profiles & user role editorSep 1, 2026
CVE-2026-83772
35Monitor
Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection
HighCVSS 8.6No exploitEPSS 3%
- RCE
- Command injection
cobham · satcom vsat7090 maritime satellite routerSep 1, 2026
CVE-2026-78319
37Monitor
TOCTOU Vulnerability in file exchange
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Race condition
sauter · modu680-asSep 1, 2026
CVE-2026-65643
34Monitor
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
HighCVSS 8.7Proof of conceptEPSS 0%
- RCE
cpanel · cpanelSep 1, 2026
CVE-2026-19914
28Monitor
Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
uscnanbu · welcart e-commerceSep 1, 2026
CVE-2026-25706
30Monitor
yast2-samba-client: OS command injection via attacker-controlled Organizational Unit (Active Directory-supplied)
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Command injection
suse · yast2-samba-clientSep 1, 2026
CVE-2026-59680
34Monitor
yast2-users: OS command injection via LDAP-supplied shadowLastChange/shadowExpire attribute
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
suse · yast2-usersSep 1, 2026
CVE-2026-59681
34Monitor
yast2-auth-client: OS command injection via unsanitized Organizational Unit / dnsHostName in AD join
HighCVSS 8.7No exploitEPSS 1%
- pre-auth RCE
- Command injection
suse · yast2-auth-clientSep 1, 2026
CVE-2026-4813
37Monitor
Code injection in the Lutece Core
CriticalCVSS 9.4Proof of conceptEPSS 0%
- RCE
lutece · lutece coreSep 1, 2026
CVE-2026-84165
34Monitor
Lack of authorisation in OpenNebula by OpenNebula Systems
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
opennebula systems · opennebulaSep 1, 2026
CVE-2026-18550
39Monitor
Nokri - Job Board WordPress Theme <= 1.6.6 - Unauthenticated Privilege Escalation via 'token' Parameter
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
scriptsbundle · nokri – job board wordpress themeSep 1, 2026
CVE-2026-83595
28Monitor
AVideo Cross-Site Request Forgery via plugin/API/set.json.php
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- CSRF
wwbn · avideoSep 1, 2026
CVE-2026-84187
35Monitor
AVideo on_publish.php Missing Authentication Check via RTMP Callback
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
wwbn · avideoSep 1, 2026
CVE-2026-84194
34Monitor
LibreNMS 23.10.0 before 26.4.0 OS Command Injection via Hostname
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
librenms · librenmsSep 1, 2026
CVE-2026-84195
33Monitor
Kyverno before 1.16.4 Credential Leak via apiCall
HighCVSS 8.3No exploitEPSS 0%
- Info leak
kyverno · kyvernoSep 1, 2026
CVE-2026-84196
33Monitor
Kyverno before 1.18.0 Server-Side Request Forgery via apiCall
HighCVSS 8.3No exploitEPSS 0%
- SSRF
kyverno · kyvernoSep 1, 2026
CVE-2026-84200
37Monitor
Kyverno before v1.13.0 Policy Bypass via Multiple Exceptions
CriticalCVSS 9.4No exploitEPSS 0%
- Broken access control (IDOR)
kyverno · kyvernoSep 1, 2026
CVE-2026-18765
39Monitor
SQL Injection in Teracity Sotware's Teracity E-OSB Platform
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
teracity software technologies inc. · e-osbSep 1, 2026
CVE-2026-19472
34Monitor
Rockwell Automation ArmorStart® LT Denial Of Service
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
rockwell automation · armorstart® ltSep 1, 2026
CVE-2026-51741
39Monitor
Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase di
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51743
36Monitor
Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable gu
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51744
39Monitor
Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51747
39Monitor
Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect me
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-84117
35Monitor
Privilege escalation in Firefox for Android
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
mozilla · firefox mobileSep 1, 2026
CVE-2026-84118
21Monitor
Use-after-free in the JavaScript: GC component
MediumCVSS 5.4Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 1, 2026
CVE-2026-84119
38Monitor
Sandbox escape due to use-after-free in the DOM: Navigation component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 1, 2026
CVE-2026-84121
38Monitor
Sandbox escape due to use-after-free in the DOM: Security component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 1, 2026
CVE-2026-84123
35Monitor
Privilege escalation due to use-after-free in the Graphics: WebGPU component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 1, 2026
CVE-2026-84128
35Monitor
Privilege escalation in the WebDriver BiDi component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
mozilla · firefoxSep 1, 2026
CVE-2026-84129
39Monitor
Site isolation issue in the DOM: Navigation component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 1, 2026
CVE-2026-84130
30Monitor
Information disclosure in the Graphics: WebGPU component
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
mozilla · firefoxSep 1, 2026
CVE-2026-84131
35Monitor
Privilege escalation due to invalid pointer in the Graphics component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 1, 2026
CVE-2026-84132
30Monitor
Information disclosure in the Networking: HTTP component
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
mozilla · firefoxSep 1, 2026
CVE-2026-84133
39Monitor
Site isolation issue in the DOM: Push Subscriptions component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 1, 2026
CVE-2026-84134
39Monitor
Other issue in the Profile Backup component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Info leak
mozilla · firefoxSep 1, 2026
CVE-2026-84135
39Monitor
Other issue in Firefox Focus for Android
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
mozilla · firefox mobileSep 1, 2026
CVE-2026-84140
39Monitor
Site isolation issue in the DOM: Navigation component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 1, 2026
CVE-2026-84141
39Monitor
Integer overflow in the Graphics: ImageLib component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 1, 2026
CVE-2026-84142
39Monitor
Internally found bugs fixed in Thunderbird 155
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 1, 2026
CVE-2026-84143
39Monitor
Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 1, 2026
CVE-2026-84144
30Monitor
Internally found bugs fixed in Thunderbird 155 and Thunderbird ESR 153.2
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 1, 2026
CVE-2026-84145
30Monitor
Internally found bugs fixed in Thunderbird 155, Thunderbird ESR 153.2 and Thunderbird ESR 140.15
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 1, 2026
CVE-2026-84147
40Plan
Remote Code Execution Vulnerability in Manacle Technologies ERP System
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
- File upload
manacle technologies · multi-tenant erp systemSep 1, 2026
CVE-2026-84148
36Monitor
Insecure Direct Object Reference Vulnerability in Manacle Technologies ERP System
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
manacle technologies · multi-tenant erp systemSep 1, 2026
CVE-2026-84149
36Monitor
Information Disclosure Vulnerability in Manacle Technologies ERP System
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
manacle technologies · multi-tenant erp systemSep 1, 2026
CVE-2026-84235
34Monitor
Rockwell Automation 1756-ENBT Denial of Service Vulnerability
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
rockwell automation · 1756-enbt moduleSep 1, 2026
CVE-2024-10085
32Monitor
CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communic
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
schneider electric · ecostruxure™ opc ua server expertSep 1, 2026
CVE-2024-14047
28Monitor
Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service
HighCVSS 7.1No exploitEPSS 0%
- Local privilege escalation
elastic · winlogbeatSep 1, 2026
CVE-2025-12768
34Monitor
FactoryTalk® Historian Machine Edition - Out-of-Bounds Write Vulnerability
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Memory safety
rockwell automation · factorytalk® historian machine editionSep 1, 2026
CVE-2026-12663
28Monitor
ControlFLASH ® – Improper Access Control
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Auth bypass
rockwell automation · controlflash ®Sep 1, 2026
CVE-2026-13336
29Monitor
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause exe
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Command injection
schneider electric · netbotz 5 - 750/755Sep 1, 2026
CVE-2026-16675
34Monitor
Rockwell Automation FactoryTalk® Activation Manager - Privilege Escalation
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
rockwell automation · factorytalk® activation managerSep 1, 2026
CVE-2026-18210
39Monitor
SQL Injection in TRtek Technological Products's Store
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
trtek technological products computer software hardware industry and trade limited company · products's storeSep 1, 2026
CVE-2026-18808
39Monitor
Unauthenticated Remote Code Execution via Code Injection in Klemsan's KIO
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
klemsan electrical electronics inc. · kio (klemsan internet objects)Sep 1, 2026
CVE-2026-19513
32Monitor
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- File upload
gravity forms · gravity formsSep 1, 2026
CVE-2026-51750
39Monitor
Incorrect access control in the updatePriChannel function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to rescan an
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51751
39Monitor
Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a sp
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51754
39Monitor
Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to overwrit
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51757
39Monitor
Incorrect access control in the meshSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to start a fi
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51760
39Monitor
Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigg
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51762
39Monitor
Incorrect access control in the meshInfoKick function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to kick or clean
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51763
39Monitor
Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly dis
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51764
39Monitor
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51765
39Monitor
Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to inser
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 1, 2026
CVE-2026-51766
30Monitor
Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reboot the lo
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Denial of service
Sep 1, 2026
CVE-2026-80047
31Monitor
Hugging Face Transformers library writes remote code to disk prior to consent check
HighCVSS 7.8No exploitEPSS 0%
hugging face · transformersSep 1, 2026
CVE-2026-84218
32Monitor
Org.jolokia/jolokia-core: incomplete jndi denylist in jolokia jsr-160 proxy (bypass of cve-2018-1000130 fix)
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
red hat · red hat amq broker 7Sep 1, 2026
CVE-2026-9621
36Monitor
RSLinx Classic® - Multiple Vulnerabilities
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Memory safety
rockwell automation · rslinx classic®Sep 1, 2026
CVE-2026-9622
34Monitor
RSLinx Classic® - Multiple Vulnerabilities
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
rockwell automation · rslinx classic®Sep 1, 2026
CVE-2026-9624
34Monitor
RSLinx Classic® - Multiple Vulnerabilities
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
rockwell automation · rslinx classic®Sep 1, 2026
CVE-2026-9625
34Monitor
RSLinx Classic® - Multiple Vulnerabilities
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
rockwell automation · rslinx classic®Sep 1, 2026
CVE-2026-9633
28Monitor
Redundancy Module Configuration Tool - Multiple Vulnerabilities
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
rockwell automation · redundancy module configuration toolSep 1, 2026
CVE-2026-9634
28Monitor
Redundancy Module Configuration Tool - Multiple Vulnerabilities
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
rockwell automation · redundancy module configuration toolSep 1, 2026
CVE-2026-9637
34Monitor
CompactLogix® 5380 / ControlLogix® 5580 - Multiple Vulnerabilities
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
rockwell automation · compactlogix® 5380 / controllogix® 5580Sep 1, 2026
CVE-2026-18630
35Monitor
SQL Injection in TMT Machine's Talassoft Industrial Management Software
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
tmt machine industry and trade ltd. co. · talassoft industrial management softwareSep 1, 2026
CVE-2026-18771
30Monitor
Missing Authentication for Critical Function in TMT Machine's Talassoft Industrial Management Software
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Denial of service
tmt machine industry and trade ltd. co. · talassoft industrial management softwareSep 1, 2026
CVE-2026-18780
28Monitor
CSRF in TMT Machine's Talassoft Industrial Management Software
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- CSRF
tmt machine industry and trade ltd. co. · talassoft industrial management softwareSep 1, 2026
CVE-2026-55951
32Monitor
httpc memory exhaustion via unbounded response header accumulation
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
erlang · otpSep 1, 2026
CVE-2026-66357
33Monitor
inets,httpd:HTTP Request Smuggling via obs-fold Header Continuation
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
erlang · otpSep 1, 2026
CVE-2026-66835
32Monitor
httpd mod_auth directory protection bypassed by a doubled slash in the request path
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
erlang · otpSep 1, 2026
CVE-2026-69664
34Monitor
httpd parks a request worker indefinitely on a malformed chunk size sent after the headers
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
erlang · otpSep 1, 2026
CVE-2026-70399
34Monitor
httpd does not enforce the documented default max_clients connection limit
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
erlang · otpSep 1, 2026
CVE-2026-71380
34Monitor
httpd applies no timeout while receiving a request body, parking a worker on a stalled client
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
erlang · otpSep 1, 2026
CVE-2026-73270
32Monitor
httpd mod_auth directory protection bypassed by request path casing on case-insensitive filesystems
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
erlang · otpSep 1, 2026
CVE-2026-73276
33Monitor
inets, httpd: HTTP Request Smuggling via Whitespace-Before-Colon Header Dropping i
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
erlang · otpSep 1, 2026
CVE-2026-73812
33Monitor
inets, httpd: HTTP Request Smuggling via Transfer-Encoding and Content-Length
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
erlang · otpSep 1, 2026
CVE-2026-74835
34Monitor
inets,httpd: Memory Exhaustion via Unenforced max_body_size During Chunked Body Reception
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
erlang · otpSep 1, 2026
CVE-2026-75538
32Monitor
A Signed Length Overflow in Erlang/OTP's inet TCP Driver Overflows the Receive Buffer Into BEAM VM Memory From an Unauthenticated Peer
HighCVSS 8.2No exploitEPSS 0%
- pre-auth RCE
- Memory safety
erlang · otpSep 1, 2026
CVE-2026-78012
37Monitor
Stack-based Buffer Overflow in Pyramid Solutions NetStaX EtherNet/IP Stack
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
pyramid solutions · ethernet/ip adapter dll kit (eipa)Sep 1, 2026
CVE-2026-83605
34Monitor
xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
xmldom · xmldomSep 1, 2026
CVE-2026-83606
34Monitor
xmldom PI grammar regex ReDoS: quadratic backtracking on unterminated processing instructions
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
xmldom · xmldomSep 1, 2026
CVE-2026-83607
34Monitor
xmldom: Element name injection via createElement() bypasses requireWellFormed
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- XSS
xmldom · xmldomSep 1, 2026
CVE-2026-83608
34Monitor
xmldom: DocType `name` Injection Bypasses requireWellFormed
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
xmldom · xmldomSep 1, 2026
CVE-2026-83609
34Monitor
xmldom: Creation-time XML Name/QName validation is bypassable via an embedded line terminator, allowing injection on the default serialization path
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
xmldom · xmldomSep 1, 2026
CVE-2026-83612
34Monitor
xmldom: HTML raw-text closing-tag case mismatch causes output amplification
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
xmldom · xmldomSep 1, 2026