By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 10 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-81543No exploit	Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalationtyche softwares · abandoned cart pro for woocommerce · CWE-269	High8.8	—	0.4%	Sep 5, 2026
28Monitor	CVE-2026-83625No exploit	Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Headersupsysticcom · contact form by supsystic · CWE-79 Pre-auth Auth bypass XSS	High7.2	—	0.5%	Sep 5, 2026
28Monitor	CVE-2026-86111No exploit	BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statusesbookwyrm-social · bookwyrm · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Sep 5, 2026
28Monitor	CVE-2026-86113No exploit	BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Recordsbookwyrm-social · bookwyrm · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Sep 5, 2026
28Monitor	CVE-2026-86114No exploit	Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpointsgetarcaneapp · arcane · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Sep 5, 2026
28Monitor	CVE-2026-86116No exploit	Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management APImetabase · metabase · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Sep 5, 2026
36Monitor	CVE-2026-86117No exploit	Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matchingcoollabsio · coolify · CWE-287 Pre-auth Auth bypass	Critical9.2	—	0.6%	Sep 5, 2026
36Monitor	CVE-2026-86119No exploit	Webstudio through 0.296.0 SSRF via /cgi proxy routeswebstudio-is · webstudio · CWE-918 Pre-auth SSRF	Critical9.2	—	0.5%	Sep 5, 2026
37Monitor	CVE-2026-86121No exploit	Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Controltrycua · cua-computer-server · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	1.1%	Sep 5, 2026
37Monitor	CVE-2026-86123No exploit	SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpointssqlchat · sqlchat · CWE-918 pre-auth RCE Auth bypass SSRF	Critical9.4	—	0.4%	Sep 5, 2026
37Monitor	CVE-2026-86124No exploit	AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Serverhkuds · autoagent · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	0.9%	Sep 5, 2026
34Monitor	CVE-2026-86169No exploit	Axolotl before 0.19.0 Remote Code Execution via Multipack Patchingaxolotl-ai-cloud · axolotl · CWE-829 pre-auth RCE	High8.7	—	0.9%	Sep 5, 2026
34Monitor	CVE-2026-86173No exploit	MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawlermindsdb · mindsdb · CWE-918 Pre-auth Auth bypass SSRF	High8.7	—	0.6%	Sep 5, 2026
28Monitor	CVE-2026-86175No exploit	NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIsnetbox-community · netbox · CWE-522 Info leak	High7.1	—	0.4%	Sep 5, 2026
34Monitor	CVE-2026-86177No exploit	Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Taskspterodactyl · panel · CWE-862 RCE Broken access control (IDOR)	High8.7	—	0.5%	Sep 5, 2026
36Monitor	GHSA-22mg-8gw7-636xNo exploit	Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operatorCWE-22 Pre-auth Path traversal	Critical9.1	—	—	Sep 5, 2026
30Monitor	GHSA-3xjw-9qpc-53mhNo exploit	Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/editCWE-22 Pre-auth Path traversal	High7.5	—	—	Sep 5, 2026
39Monitor	CVE-2026-10196Proof of concept	Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fieldsgetwpfunnels · mail mint – email marketing, newsletter, email automation & woocommerce emails · CWE-502 Pre-auth Deserialization	Critical9.8	—	1.1%	Sep 5, 2026
37Monitor	CVE-2026-86184No exploit	Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Routelaradashboard · laradashboard · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	1.0%	Sep 5, 2026
34Monitor	CVE-2026-86185No exploit	Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypassbilibili · bilibili desktop · CWE-295 pre-auth RCE Weak crypto	High8.6	—	0.1%	Sep 5, 2026
39Monitor	CVE-2024-11080No exploit	Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injectionpickplugins · post grid · CWE-94 pre-auth RCE	Critical9.8	—	0.8%	Sep 5, 2026
29Monitor	CVE-2026-86187No exploit	WWBN AVideo Weak PRNG Password Generation via External Loginwwbn · avideo · CWE-330 Weak crypto	High7.4	—	0.3%	Sep 5, 2026
37Monitor	CVE-2026-86189No exploit	WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.phpwwbn · avideo · CWE-73 Pre-auth Auth bypass Path traversal	Critical9.3	—	0.7%	Sep 5, 2026
37Monitor	CVE-2026-86190No exploit	WWBN AVideo Broken Access Control via videoViewsInfo hash Parameterwwbn · avideo · CWE-200 Pre-auth Broken access control (IDOR) Info leak	Critical9.3	—	0.4%	Sep 5, 2026
28Monitor	CVE-2026-86192No exploit	SiYuan before v3.8.2 Information Disclosure via Attribute-Viewsiyuan-note · siyuan · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Sep 5, 2026
34Monitor	CVE-2026-86193No exploit	Grav API Plugin Authentication Bypass via Group-Inherited Supergetgrav · grav-plugin-api · CWE-863 Auth bypass Broken access control (IDOR)	High8.7	—	0.3%	Sep 5, 2026
34Monitor	CVE-2026-86195No exploit	grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flaggetgrav · grav-plugin-api · CWE-269	High8.7	—	0.3%	Sep 5, 2026
34Monitor	CVE-2026-86196No exploit	Grav API Plugin before 1.0.20 Authentication Bypass via Host Headergetgrav · grav-plugin-api · CWE-290 Pre-auth Auth bypass	High8.7	—	0.4%	Sep 5, 2026
35Monitor	CVE-2025-9049No exploit	Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeoverscriptsbundle · nokri – job board wordpress theme · CWE-862 Broken access control (IDOR)	High8.8	—	0.4%	Sep 5, 2026
34Monitor	CVE-2026-0799No exploit	OOBR and OOBW in libpcap before 1.10.7the tcpdump group · libpcap · CWE-125 Memory safety	High8.7	—	0.1%	Sep 5, 2026
30Monitor	CVE-2026-86207Proof of concept	Authentication bypass leads to unauthorised access to N-centraln-able · n-central · CWE-305 Auth bypass	High7.7	—	1.2%	Sep 5, 2026
39Monitor	CVE-2026-67276Proof of concept	SSH user impersonation possible in Mikrotik RouterOSmikrotik · routeros · CWE-347 Pre-auth Weak crypto	Critical9.2	—	8.9%	Sep 5, 2026
65This week	CVE-2026-67277Weaponized	Kernel memory disclosure and denial of service in MikroTik RouterOS btest servicemikrotik · routeros · CWE-306 Pre-auth Auth bypass	High8.8	KEV	1.5%	Sep 5, 2026
25Monitor	CVE-2026-67278No exploit	TLS server impersonation possible in Mikrotik RouterOSmikrotik · routeros · CWE-347 Pre-auth Weak crypto	Medium6.3	—	0.2%	Sep 5, 2026
60This week	CVE-2026-67279Weaponized	SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOSmikrotik · routeros · CWE-841 Pre-auth	Medium6.9	KEV	2.2%	Sep 5, 2026
34Monitor	CVE-2026-67281Proof of concept	Unauthenticated file read in Mikrotik RouterOSmikrotik · routeros · CWE-22 Pre-auth Path traversal	High8.7	—	0.7%	Sep 5, 2026
68This week	CVE-2026-86060Weaponized	SSH session privilege manipulation via a crafted username in Mikrotik RouterOSmikrotik · routeros · CWE-88 Pre-auth	Critical9.2	KEV	6.3%	Sep 5, 2026
27Monitor	CVE-2026-86206Proof of concept	Access control filter bypass allows unauthorised access to APIsn-able · n-central · CWE-791 Pre-auth	Medium6.9	—	1.1%	Sep 5, 2026
38Monitor	CVE-2026-86148No exploit	Tenda CP3 Kylin system.c SystemAsh os command injectiontenda · cp3 · CWE-77 RCE Command injection	Critical9.4	—	2.9%	Sep 5, 2026
38Monitor	CVE-2026-86149No exploit	Tenda CP3 NetCheckPing.cpp os command injectiontenda · cp3 · CWE-77 RCE Command injection	Critical9.4	—	2.9%	Sep 5, 2026
30Monitor	CVE-2026-6554No exploit	infinte loop in libpcap before 1.10.7the tcpdump group · libpcap · CWE-835 Pre-auth Denial of service	High7.5	—	0.4%	Sep 5, 2026
38Monitor	CVE-2026-86151No exploit	Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injectiontenda · cp3 · CWE-77 RCE Command injection	Critical9.4	—	2.9%	Sep 5, 2026
41Plan	CVE-2026-86152No exploit	Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injectiontenda · cp3 · CWE-77 pre-auth RCE Command injection	Critical10.0	—	2.8%	Sep 5, 2026
37Monitor	CVE-2026-86153No exploit	Tenda CP3 Redirect.cpp SetRedirectEnable privileges managementtenda · cp3 · CWE-266	Critical9.4	—	0.7%	Sep 5, 2026
39Monitor	CVE-2026-16310No exploit	MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameterlearndash · memberdash · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	Sep 5, 2026
30Monitor	CVE-2026-18056No exploit	HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticatorhivepress · hivepress authentication · CWE-287 Pre-auth Auth bypass	High7.5	—	0.5%	Sep 5, 2026
39Monitor	CVE-2026-75816Proof of concept	Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifiershabti · frontend admin by dynamiapps · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.9%	Sep 5, 2026
75This week	CVE-2026-86218Weaponized	pre-authentication remote code executionn-able · n-central · CWE-96 pre-auth RCE	Critical10.0	KEV	15.3%	Sep 5, 2026
35Monitor	CVE-2026-86165No exploit	Tenda HG10 formURL buffer overflowtenda · hg10 · CWE-119 Pre-auth Memory safety	High8.9	—	1.1%	Sep 6, 2026
29Monitor	CVE-2026-86166No exploit	Tenda HG10 Boa Web Server formWanRedirect buffer overflowtenda · hg10 · CWE-119 Memory safety	High7.4	—	0.8%	Sep 6, 2026
35Monitor	CVE-2026-86167No exploit	Tenda HG10 Boa formgponConf os command injectiontenda · hg10 · CWE-77 RCE Command injection	High8.6	—	2.7%	Sep 6, 2026
35Monitor	CVE-2026-18480No exploit	SureCart < 4.6.3 - Subscriber+ Administrator Account Takeoverunknown · surecart · CWE-269	High8.8	—	0.4%	Sep 6, 2026
30Monitor	CVE-2026-84219No exploit	Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decodingunknown · kirki · CWE-79 Pre-auth XSS	High7.5	—	0.3%	Sep 6, 2026
33Monitor	CVE-2026-86242Proof of concept	Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Buildsmaximhq · bifrost · CWE-94 pre-auth RCE	High8.1	—	3.5%	Sep 6, 2026
34Monitor	CVE-2026-86250No exploit	h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookieh3js · h3 · CWE-400 Pre-auth Denial of service	High8.7	—	0.4%	Sep 6, 2026
32Monitor	CVE-2026-86251No exploit	h3 before 1.15.9 Path Traversal via Double Decodingh3js · h3 · CWE-22 Pre-auth Path traversal	High8.2	—	0.4%	Sep 6, 2026
32Monitor	CVE-2026-86253No exploit	h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segmentsh3js · h3 · CWE-22 Pre-auth Path traversal	High8.2	—	0.6%	Sep 6, 2026
28Monitor	CVE-2026-86255No exploit	wger before 2.5 Uncontrolled Resource Consumption via date_sequencewger-project · wger · CWE-400 Denial of service	High7.1	—	0.4%	Sep 6, 2026
32Monitor	CVE-2026-86258No exploit	nbviewer through 1.0.1 Path Traversal via LocalFileHandlerjupyter · nbviewer · CWE-22 Pre-auth Path traversal	High8.2	—	0.5%	Sep 6, 2026
36Monitor	CVE-2026-86259Proof of concept	OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validationthu-maic · openmaic · CWE-306 Pre-auth Auth bypass SSRF	Critical9.0	—	0.4%	Sep 6, 2026
28Monitor	CVE-2026-86283Proof of concept	MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Datamisp · misp · CWE-285 Broken access control (IDOR)	High7.1	—	0.3%	Sep 6, 2026
35Monitor	CVE-2026-19633No exploit	PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueriesdalibo · postgresql anonymizer · CWE-89 RCE SQL injection	High8.8	—	0.6%	Sep 6, 2026
28Monitor	CVE-2020-37277No exploit	PocketMine-MP before 3.15.4 Denial of Service via InventoryTransactionpmmp · pocketmine-mp · CWE-400 Denial of service	High7.1	—	0.5%	Sep 6, 2026
28Monitor	CVE-2021-48007No exploit	PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacketpmmp · pocketmine-mp · CWE-20	High7.1	—	0.5%	Sep 6, 2026
34Monitor	CVE-2022-51009No exploit	PocketMine-MP before 4.7.2 Denial of Service via Skin Geometrypmmp · pocketmine-mp · CWE-248 Pre-auth	High8.7	—	0.6%	Sep 6, 2026
33Monitor	CVE-2026-82750No exploit	Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegationzenhive · mpp · CWE-1284 Pre-auth	High8.3	—	0.5%	Sep 6, 2026
33Monitor	CVE-2026-82751No exploit	Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioningzenhive · mpp · CWE-1284 Pre-auth	High8.3	—	0.5%	Sep 6, 2026
29Monitor	CVE-2026-13608No exploit	OpenLDAP SASL authentication bypasshaxx · curl · CWE-923 Pre-auth Auth bypass	High7.4	—	0.5%	Sep 6, 2026
36Monitor	CVE-2026-18924No exploit	HTTP/2 server push UAFhaxx · curl · CWE-416 Pre-auth Memory safety	Critical9.1	—	0.5%	Sep 6, 2026
39Monitor	CVE-2026-19931No exploit	Negotiate ambient user conn reusehaxx · curl · CWE-488 Pre-auth	Critical9.8	—	0.7%	Sep 6, 2026
30Monitor	CVE-2026-80229No exploit	OpenSSL provider use-after-freehaxx · curl · CWE-416 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Sep 6, 2026
30Monitor	CVE-2026-80230No exploit	OpenSSL pinning bypasshaxx · curl · CWE-295 Pre-auth Weak crypto Denial of service	High7.5	—	0.3%	Sep 6, 2026
30Monitor	CVE-2026-80231No exploit	native CA store conn reusehaxx · curl · CWE-488 Pre-auth Denial of service	High7.5	—	0.8%	Sep 6, 2026
30Monitor	CVE-2026-80255No exploit	secure cookie attribute bypass with tabhaxx · curl · CWE-201 Pre-auth	High7.5	—	0.4%	Sep 6, 2026
30Monitor	CVE-2026-82208No exploit	wolfSSL CA-cache hit overrides callbackhaxx · curl · CWE-295 Pre-auth Weak crypto	High7.5	—	0.4%	Sep 6, 2026
32Monitor	CVE-2026-82209No exploit	domain-scoped PSL domain cookiehaxx · curl · CWE-201 Pre-auth	High8.2	—	0.3%	Sep 6, 2026
39Monitor	CVE-2026-86219No exploit	Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_stepCWE-294 Pre-auth Auth bypass	Critical9.8	—	0.6%	Sep 6, 2026
39Monitor	CVE-2026-86304No exploit	MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust aCWE-347 Pre-auth Auth bypass Weak crypto	Critical9.8	—	0.3%	Sep 6, 2026
37Monitor	CVE-2026-16876No exploit	An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V.nec corporation · univerge ix-r/ix-v · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	0.5%	Sep 6, 2026
33Monitor	CVE-2026-20501No exploit	In vdec, there is a possible out of bounds write due to a heap buffer overflow.mediatek · mt2718 firmware · CWE-122 Local privilege escalation Memory safety	High8.4	—	0.1%	Sep 6, 2026
33Monitor	CVE-2026-20502No exploit	In vdec, there is a possible out of bounds write due to a missing bounds check.mediatek · mt2718 firmware · CWE-122 Local privilege escalation Memory safety	High8.4	—	0.1%	Sep 6, 2026
22Monitor	CVE-2026-20516Proof of concept	In MiracastService, there is a possible escalation of privilege due to a confused deputy.mediatek, inc. · mediatek chipset · CWE-926 Local privilege escalation Denial of service	Medium5.5	—	0.1%	Sep 6, 2026
35Monitor	CVE-2026-79697No exploit	Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injectionadvantech · wise-6610-nb · CWE-74 RCE Command injection	High8.6	—	4.9%	Sep 7, 2026
35Monitor	CVE-2026-79698No exploit	Advantech WISE-6610-NB Node-RED nodered_lib_apply command injectionadvantech · wise-6610-nb · CWE-74 RCE Command injection	High8.6	—	3.1%	Sep 7, 2026
31Monitor	CVE-2026-86313No exploit	Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow Buffers.samsung opensource · walrus · CWE-787 Memory safety	High7.8	—	0.1%	Sep 7, 2026
30Monitor	CVE-2026-14296No exploit	nRF54H20: MCUBoot can be tricked to executing unauthenticated codenordic semiconductor asa · nrf54h20 · CWE-347 Pre-auth Weak crypto	High7.5	—	0.1%	Sep 7, 2026
29Monitor	CVE-2026-78254No exploit	Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file writeapache · ant · CWE-23 Pre-auth Path traversal	High7.4	—	0.5%	Sep 7, 2026
34Monitor	CVE-2026-84226No exploit	OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting aopenvpn · openvpn · CWE-426	High8.5	—	0.1%	Sep 7, 2026
34Monitor	CVE-2026-14297No exploit	The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixednordic semiconductor asa · nrf connect sdk · CWE-787 Pre-auth Memory safety	High8.7	—	0.2%	Sep 7, 2026
34Monitor	CVE-2026-84732No exploit	Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service viaopenvpn · openvpn · CWE-190 Pre-auth Memory safety	High8.7	—	0.3%	Sep 7, 2026
33Monitor	CVE-2026-84173No exploit	In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow ruleclipse foundation · eclipse ankaios · CWE-863 Broken access control (IDOR)	High8.3	—	0.1%	Sep 7, 2026
28Monitor	CVE-2026-86347No exploit	MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustionmisp-project · misp · CWE-400 Path traversal Denial of service	High7.1	—	0.4%	Sep 7, 2026
34Monitor	CVE-2026-19204No exploit	A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memoryeclipse foundation · eclipse jetty · CWE-770 Pre-auth Denial of service	High8.7	—	0.4%	Sep 7, 2026
38Monitor	CVE-2026-86296No exploit	D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflowd-link · dir-822a · CWE-119 Pre-auth Memory safety	Critical9.3	—	2.3%	Sep 7, 2026
32Monitor	CVE-2026-86297No exploit	D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-oned-link · dir-605 · CWE-189 Pre-auth	High8.2	—	1.1%	Sep 7, 2026
30Monitor	CVE-2026-84256No exploit	An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to exopenvpn · openvpn · CWE-78 RCE Command injection	High7.7	—	0.3%	Sep 7, 2026
35Monitor	CVE-2026-86299No exploit	Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injectionlinksys · re7000 · CWE-77 RCE Command injection	High8.6	—	3.7%	Sep 7, 2026
29Monitor	CVE-2026-61409No exploit	Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements usedell · secure connect gateway · CWE-78 pre-auth RCE Command injection	High7.3	—	1.4%	Sep 7, 2026
37Monitor	CVE-2026-61410No exploit	Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorizatdell · secure connect gateway · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.4	—	0.8%	Sep 7, 2026
28Monitor	CVE-2026-6431No exploit	User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Fieldcozmoslabs · user profile builder – beautiful user registration forms, user profiles & user role editor · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Sep 7, 2026

CVE-2026-81543
35Monitor
Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
HighCVSS 8.8No exploitEPSS 0%
tyche softwares · abandoned cart pro for woocommerceSep 5, 2026
CVE-2026-83625
28Monitor
Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
- XSS
supsysticcom · contact form by supsysticSep 5, 2026
CVE-2026-86111
28Monitor
BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
bookwyrm-social · bookwyrmSep 5, 2026
CVE-2026-86113
28Monitor
BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
bookwyrm-social · bookwyrmSep 5, 2026
CVE-2026-86114
28Monitor
Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
getarcaneapp · arcaneSep 5, 2026
CVE-2026-86116
28Monitor
Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
metabase · metabaseSep 5, 2026
CVE-2026-86117
36Monitor
Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
coollabsio · coolifySep 5, 2026
CVE-2026-86119
36Monitor
Webstudio through 0.296.0 SSRF via /cgi proxy routes
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- SSRF
webstudio-is · webstudioSep 5, 2026
CVE-2026-86121
37Monitor
Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Auth bypass
trycua · cua-computer-serverSep 5, 2026
CVE-2026-86123
37Monitor
SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints
CriticalCVSS 9.4No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
- SSRF
sqlchat · sqlchatSep 5, 2026
CVE-2026-86124
37Monitor
AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
hkuds · autoagentSep 5, 2026
CVE-2026-86169
34Monitor
Axolotl before 0.19.0 Remote Code Execution via Multipack Patching
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
axolotl-ai-cloud · axolotlSep 5, 2026
CVE-2026-86173
34Monitor
MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- SSRF
mindsdb · mindsdbSep 5, 2026
CVE-2026-86175
28Monitor
NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs
HighCVSS 7.1No exploitEPSS 0%
- Info leak
netbox-community · netboxSep 5, 2026
CVE-2026-86177
34Monitor
Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
pterodactyl · panelSep 5, 2026
GHSA-22mg-8gw7-636x
36Monitor
Path traversal and arbitrary directory deletion/overwrite via agent profile import in local-operator
CriticalCVSS 9.1No exploit
- Pre-auth
- Path traversal
Sep 5, 2026
GHSA-3xjw-9qpc-53mh
30Monitor
Arbitrary file read via workspace confinement bypass in local-operator /v1/chat/agents/{id}/edit
HighCVSS 7.5No exploit
- Pre-auth
- Path traversal
Sep 5, 2026
CVE-2026-10196
39Monitor
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- Deserialization
getwpfunnels · mail mint – email marketing, newsletter, email automation & woocommerce emailsSep 5, 2026
CVE-2026-86184
37Monitor
Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Auth bypass
laradashboard · laradashboardSep 5, 2026
CVE-2026-86185
34Monitor
Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
- Weak crypto
bilibili · bilibili desktopSep 5, 2026
CVE-2024-11080
39Monitor
Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
pickplugins · post gridSep 5, 2026
CVE-2026-86187
29Monitor
WWBN AVideo Weak PRNG Password Generation via External Login
HighCVSS 7.4No exploitEPSS 0%
- Weak crypto
wwbn · avideoSep 5, 2026
CVE-2026-86189
37Monitor
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Path traversal
wwbn · avideoSep 5, 2026
CVE-2026-86190
37Monitor
WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Info leak
wwbn · avideoSep 5, 2026
CVE-2026-86192
28Monitor
SiYuan before v3.8.2 Information Disclosure via Attribute-View
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
siyuan-note · siyuanSep 5, 2026
CVE-2026-86193
34Monitor
Grav API Plugin Authentication Bypass via Group-Inherited Super
HighCVSS 8.7No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
getgrav · grav-plugin-apiSep 5, 2026
CVE-2026-86195
34Monitor
grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag
HighCVSS 8.7No exploitEPSS 0%
getgrav · grav-plugin-apiSep 5, 2026
CVE-2026-86196
34Monitor
Grav API Plugin before 1.0.20 Authentication Bypass via Host Header
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
getgrav · grav-plugin-apiSep 5, 2026
CVE-2025-9049
35Monitor
Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
scriptsbundle · nokri – job board wordpress themeSep 5, 2026
CVE-2026-0799
34Monitor
OOBR and OOBW in libpcap before 1.10.7
HighCVSS 8.7No exploitEPSS 0%
- Memory safety
the tcpdump group · libpcapSep 5, 2026
CVE-2026-86207
30Monitor
Authentication bypass leads to unauthorised access to N-central
HighCVSS 7.7Proof of conceptEPSS 1%
- Auth bypass
n-able · n-centralSep 5, 2026
CVE-2026-67276
39Monitor
SSH user impersonation possible in Mikrotik RouterOS
CriticalCVSS 9.2Proof of conceptEPSS 8%
- Pre-auth
- Weak crypto
mikrotik · routerosSep 5, 2026
CVE-2026-67277
65This week
Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
HighCVSS 8.8KEVWeaponizedEPSS 1%
- Pre-auth
- Auth bypass
mikrotik · routerosSep 5, 2026
CVE-2026-67278
25Monitor
TLS server impersonation possible in Mikrotik RouterOS
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
mikrotik · routerosSep 5, 2026
CVE-2026-67279
60This week
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
MediumCVSS 6.9KEVWeaponizedEPSS 2%
- Pre-auth
mikrotik · routerosSep 5, 2026
CVE-2026-67281
34Monitor
Unauthenticated file read in Mikrotik RouterOS
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
mikrotik · routerosSep 5, 2026
CVE-2026-86060
68This week
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
CriticalCVSS 9.2KEVWeaponizedEPSS 6%
- Pre-auth
mikrotik · routerosSep 5, 2026
CVE-2026-86206
27Monitor
Access control filter bypass allows unauthorised access to APIs
MediumCVSS 6.9Proof of conceptEPSS 1%
- Pre-auth
n-able · n-centralSep 5, 2026
CVE-2026-86148
38Monitor
Tenda CP3 Kylin system.c SystemAsh os command injection
CriticalCVSS 9.4No exploitEPSS 2%
- RCE
- Command injection
tenda · cp3Sep 5, 2026
CVE-2026-86149
38Monitor
Tenda CP3 NetCheckPing.cpp os command injection
CriticalCVSS 9.4No exploitEPSS 2%
- RCE
- Command injection
tenda · cp3Sep 5, 2026
CVE-2026-6554
30Monitor
infinte loop in libpcap before 1.10.7
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
the tcpdump group · libpcapSep 5, 2026
CVE-2026-86151
38Monitor
Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection
CriticalCVSS 9.4No exploitEPSS 2%
- RCE
- Command injection
tenda · cp3Sep 5, 2026
CVE-2026-86152
41Plan
Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection
CriticalCVSS 10.0No exploitEPSS 2%
- pre-auth RCE
- Command injection
tenda · cp3Sep 5, 2026
CVE-2026-86153
37Monitor
Tenda CP3 Redirect.cpp SetRedirectEnable privileges management
CriticalCVSS 9.4No exploitEPSS 0%
tenda · cp3Sep 5, 2026
CVE-2026-16310
39Monitor
MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
learndash · memberdashSep 5, 2026
CVE-2026-18056
30Monitor
HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
hivepress · hivepress authenticationSep 5, 2026
CVE-2026-75816
39Monitor
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
shabti · frontend admin by dynamiappsSep 5, 2026
CVE-2026-86218
75This week
pre-authentication remote code execution
CriticalCVSS 10.0KEVWeaponizedEPSS 15%
- pre-auth RCE
n-able · n-centralSep 5, 2026
CVE-2026-86165
35Monitor
Tenda HG10 formURL buffer overflow
HighCVSS 8.9No exploitEPSS 1%
- Pre-auth
- Memory safety
tenda · hg10Sep 6, 2026
CVE-2026-86166
29Monitor
Tenda HG10 Boa Web Server formWanRedirect buffer overflow
HighCVSS 7.4No exploitEPSS 0%
- Memory safety
tenda · hg10Sep 6, 2026
CVE-2026-86167
35Monitor
Tenda HG10 Boa formgponConf os command injection
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
tenda · hg10Sep 6, 2026
CVE-2026-18480
35Monitor
SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover
HighCVSS 8.8No exploitEPSS 0%
unknown · surecartSep 6, 2026
CVE-2026-84219
30Monitor
Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · kirkiSep 6, 2026
CVE-2026-86242
33Monitor
Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds
HighCVSS 8.1Proof of conceptEPSS 3%
- pre-auth RCE
maximhq · bifrostSep 6, 2026
CVE-2026-86250
34Monitor
h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
h3js · h3Sep 6, 2026
CVE-2026-86251
32Monitor
h3 before 1.15.9 Path Traversal via Double Decoding
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
h3js · h3Sep 6, 2026
CVE-2026-86253
32Monitor
h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
h3js · h3Sep 6, 2026
CVE-2026-86255
28Monitor
wger before 2.5 Uncontrolled Resource Consumption via date_sequence
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
wger-project · wgerSep 6, 2026
CVE-2026-86258
32Monitor
nbviewer through 1.0.1 Path Traversal via LocalFileHandler
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
jupyter · nbviewerSep 6, 2026
CVE-2026-86259
36Monitor
OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation
CriticalCVSS 9.0Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- SSRF
thu-maic · openmaicSep 6, 2026
CVE-2026-86283
28Monitor
MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data
HighCVSS 7.1Proof of conceptEPSS 0%
- Broken access control (IDOR)
misp · mispSep 6, 2026
CVE-2026-19633
35Monitor
PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SQL injection
dalibo · postgresql anonymizerSep 6, 2026
CVE-2020-37277
28Monitor
PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
pmmp · pocketmine-mpSep 6, 2026
CVE-2021-48007
28Monitor
PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket
HighCVSS 7.1No exploitEPSS 0%
pmmp · pocketmine-mpSep 6, 2026
CVE-2022-51009
34Monitor
PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
pmmp · pocketmine-mpSep 6, 2026
CVE-2026-82750
33Monitor
Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
zenhive · mppSep 6, 2026
CVE-2026-82751
33Monitor
Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
zenhive · mppSep 6, 2026
CVE-2026-13608
29Monitor
OpenLDAP SASL authentication bypass
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
haxx · curlSep 6, 2026
CVE-2026-18924
36Monitor
HTTP/2 server push UAF
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
haxx · curlSep 6, 2026
CVE-2026-19931
39Monitor
Negotiate ambient user conn reuse
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
haxx · curlSep 6, 2026
CVE-2026-80229
30Monitor
OpenSSL provider use-after-free
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
haxx · curlSep 6, 2026
CVE-2026-80230
30Monitor
OpenSSL pinning bypass
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
- Denial of service
haxx · curlSep 6, 2026
CVE-2026-80231
30Monitor
native CA store conn reuse
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
haxx · curlSep 6, 2026
CVE-2026-80255
30Monitor
secure cookie attribute bypass with tab
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
haxx · curlSep 6, 2026
CVE-2026-82208
30Monitor
wolfSSL CA-cache hit overrides callback
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
haxx · curlSep 6, 2026
CVE-2026-82209
32Monitor
domain-scoped PSL domain cookie
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
haxx · curlSep 6, 2026
CVE-2026-86219
39Monitor
Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
Sep 6, 2026
CVE-2026-86304
39Monitor
MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust a
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
Sep 6, 2026
CVE-2026-16876
37Monitor
An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V.
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
nec corporation · univerge ix-r/ix-vSep 6, 2026
CVE-2026-20501
33Monitor
In vdec, there is a possible out of bounds write due to a heap buffer overflow.
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
- Memory safety
mediatek · mt2718 firmwareSep 6, 2026
CVE-2026-20502
33Monitor
In vdec, there is a possible out of bounds write due to a missing bounds check.
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
- Memory safety
mediatek · mt2718 firmwareSep 6, 2026
CVE-2026-20516
22Monitor
In MiracastService, there is a possible escalation of privilege due to a confused deputy.
MediumCVSS 5.5Proof of conceptEPSS 0%
- Local privilege escalation
- Denial of service
mediatek, inc. · mediatek chipsetSep 6, 2026
CVE-2026-79697
35Monitor
Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection
HighCVSS 8.6No exploitEPSS 4%
- RCE
- Command injection
advantech · wise-6610-nbSep 7, 2026
CVE-2026-79698
35Monitor
Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection
HighCVSS 8.6No exploitEPSS 3%
- RCE
- Command injection
advantech · wise-6610-nbSep 7, 2026
CVE-2026-86313
31Monitor
Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow Buffers.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
samsung opensource · walrusSep 7, 2026
CVE-2026-14296
30Monitor
nRF54H20: MCUBoot can be tricked to executing unauthenticated code
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
nordic semiconductor asa · nrf54h20Sep 7, 2026
CVE-2026-78254
29Monitor
Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Path traversal
apache · antSep 7, 2026
CVE-2026-84226
34Monitor
OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting a
HighCVSS 8.5No exploitEPSS 0%
openvpn · openvpnSep 7, 2026
CVE-2026-14297
34Monitor
The Continuous Glucose Monitoring Service's Record Access Control Point (RACP) write handler `memcpy`s the entire attacker-supplied ATT write value into a fixed
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
nordic semiconductor asa · nrf connect sdkSep 7, 2026
CVE-2026-84732
34Monitor
Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
openvpn · openvpnSep 7, 2026
CVE-2026-84173
33Monitor
In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rul
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
eclipse foundation · eclipse ankaiosSep 7, 2026
CVE-2026-86347
28Monitor
MISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
- Denial of service
misp-project · mispSep 7, 2026
CVE-2026-19204
34Monitor
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
eclipse foundation · eclipse jettySep 7, 2026
CVE-2026-86296
38Monitor
D-Link DIR-822A udhcpcd serverpacket.c strcpy stack-based overflow
CriticalCVSS 9.3No exploitEPSS 2%
- Pre-auth
- Memory safety
d-link · dir-822aSep 7, 2026
CVE-2026-86297
32Monitor
D-Link DIR-605 L2TP Control Message tunnel.c tunnel_set_params off-by-one
HighCVSS 8.2No exploitEPSS 1%
- Pre-auth
d-link · dir-605Sep 7, 2026
CVE-2026-84256
30Monitor
An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.7 on Windows allows remote authenticated users to ex
HighCVSS 7.7No exploitEPSS 0%
- RCE
- Command injection
openvpn · openvpnSep 7, 2026
CVE-2026-86299
35Monitor
Linksys RE7000 PingTest json.cgi platform_event_pingTest os command injection
HighCVSS 8.6No exploitEPSS 3%
- RCE
- Command injection
linksys · re7000Sep 7, 2026
CVE-2026-61409
29Monitor
Dell Secure Connect Gateway (SCG) 5.0 Application, versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements use
HighCVSS 7.3No exploitEPSS 1%
- pre-auth RCE
- Command injection
dell · secure connect gatewaySep 7, 2026
CVE-2026-61410
37Monitor
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorizat
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
dell · secure connect gatewaySep 7, 2026
CVE-2026-6431
28Monitor
User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
cozmoslabs · user profile builder – beautiful user registration forms, user profiles & user role editorSep 7, 2026