Skip to content
Noroxi
By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 23 of 80

  • CVE-2026-87654
    38Monitor

    Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside t

    CriticalCVSS 9.6No exploitEPSS 0%

    google · chromeSep 8, 2026

  • GHSA-26w7-cxv4-gfx2
    39Monitor

    Astro: Remote code execution through AVIF image optimization

    CriticalCVSS 9.8No exploit

    npm · astroSep 8, 2026

  • GHSA-2q42-4q24-7rgv
    28Monitor

    OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree

    HighCVSS 7.1No exploit

    npm · @typespec/openapi3Sep 8, 2026

  • CVE-2026-13359
    28Monitor

    Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter

    HighCVSS 7.2No exploitEPSS 0%

    bestweblayout · contact form to db by bestwebsoft – messages database plugin for wordpressSep 8, 2026

  • CVE-2026-15406
    30Monitor

    Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter

    HighCVSS 7.5No exploitEPSS 1%

    arraytics · eventin – event calendar, tickets, registration, booking & woocommerceSep 8, 2026

  • CVE-2026-15667
    30Monitor

    Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter

    HighCVSS 7.5No exploitEPSS 0%

    arraytics · eventin – event calendar, tickets, registration, booking & woocommerceSep 8, 2026

  • CVE-2026-76801
    35Monitor

    FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation

    HighCVSS 8.8No exploitEPSS 0%

    fireplugins · firebox – woocommerce popup builder, exit intent popup, email optin & cart abandonmentSep 8, 2026

  • CVE-2026-87021
    28Monitor

    Tanium addressed an unauthorized code execution vulnerability in Comply.

    HighCVSS 7.2No exploitEPSS 0%

    tanium · complySep 8, 2026

  • CVE-2026-87023
    34Monitor

    Tanium addressed a path traversal vulnerability in Comply.

    HighCVSS 8.5No exploitEPSS 0%

    tanium · complySep 8, 2026

  • CVE-2026-87030
    34Monitor

    Tanium addressed a path traversal vulnerability in Comply.

    HighCVSS 8.5No exploitEPSS 0%

    tanium · complySep 8, 2026

  • CVE-2026-87034
    33Monitor

    Tanium addressed a SQL injection vulnerability in Comply.

    HighCVSS 8.3No exploitEPSS 0%

    tanium · complySep 8, 2026

  • CVE-2026-87036
    32Monitor

    Tanium addressed an improper access controls vulnerability in Comply.

    HighCVSS 8.1No exploitEPSS 0%

    tanium · complySep 8, 2026

  • CVE-2026-87072
    28Monitor

    Tanium addressed an improper access controls vulnerability in Comply.

    HighCVSS 7.1No exploitEPSS 0%

    tanium · complySep 8, 2026

  • CVE-2026-87075
    32Monitor

    Tanium addressed an improper access controls vulnerability in Comply.

    HighCVSS 8.1No exploitEPSS 0%

    tanium · complySep 8, 2026

  • CVE-2026-87084
    30Monitor

    Tanium addressed a server-side request forgery vulnerability in Enforce.

    HighCVSS 7.7No exploitEPSS 0%

    tanium · enforceSep 8, 2026

  • CVE-2026-87088
    28Monitor

    Tanium addressed an unauthorized code execution vulnerability in Enforce.

    HighCVSS 7.0No exploitEPSS 0%

    tanium · enforceSep 8, 2026

  • CVE-2026-17553
    28Monitor

    Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action

    HighCVSS 7.2No exploitEPSS 0%

    levelfourstorefront · shopping cart & ecommerce storeSep 9, 2026

  • CVE-2026-49310
    34Monitor

    Permission control vulnerability in the event notification module.

    HighCVSS 8.6No exploitEPSS 0%

    huawei · harmonyosSep 9, 2026

  • CVE-2026-49314
    29Monitor

    OOB write vulnerability in the rendering and composition module.

    HighCVSS 7.3No exploitEPSS 0%

    huawei · harmonyosSep 9, 2026

  • CVE-2026-49315
    28Monitor

    DoS vulnerability in the input device module.

    HighCVSS 7.1No exploitEPSS 0%

    huawei · harmonyosSep 9, 2026

  • CVE-2026-6485
    32Monitor

    UEFI BIOS embedded Shell can be used to bypass Secure Boot

    HighCVSS 8.2No exploitEPSS 0%

    insyde software · insydeh2oSep 9, 2026

  • CVE-2026-84293
    28Monitor

    Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values

    HighCVSS 7.2No exploitEPSS 0%

    addonsorg · repeater fields for gravity formsSep 9, 2026

  • CVE-2026-21085
    33Monitor

    Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory.

    HighCVSS 8.4No exploitEPSS 0%

    samsung · androidSep 9, 2026

  • CVE-2026-21087
    34Monitor

    Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privi

    HighCVSS 8.6No exploitEPSS 0%

    samsung · androidSep 9, 2026

  • CVE-2026-21092
    35Monitor

    Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege.

    HighCVSS 8.8No exploitEPSS 0%

    samsung · androidSep 9, 2026

  • CVE-2026-21095
    36Monitor

    Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbit

    CriticalCVSS 9.2No exploitEPSS 0%

    samsung · androidSep 9, 2026

  • CVE-2026-21096
    36Monitor

    Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbi

    CriticalCVSS 9.2Proof of conceptEPSS 0%

    samsung · androidSep 9, 2026

  • CVE-2026-21101
    33Monitor

    Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitra

    HighCVSS 8.4No exploitEPSS 0%

    samsung · androidSep 9, 2026

  • CVE-2026-21102
    37Monitor

    Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege.

    CriticalCVSS 9.3No exploitEPSS 0%

    samsung · androidSep 9, 2026

  • CVE-2026-21104
    28Monitor

    Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code

    HighCVSS 7.1No exploitEPSS 0%

    samsung · androidSep 9, 2026

  • CVE-2026-87734
    30Monitor

    An issue was discovered in the utcp package before 0.0.6 for OCaml.

    HighCVSS 7.5No exploitEPSS 0%

    ocaml · utcpSep 9, 2026

  • CVE-2026-14962
    34Monitor

    ELEX WooCommerce Request a Quote < 2.4.1 - Unauthenticated SQLi via variation_id

    HighCVSS 8.6No exploitEPSS 0%

    unknown · elex woocommerce request a quoteSep 9, 2026

  • CVE-2026-16960
    30Monitor

    Loops & Logic < 4.3.0 - Unauthenticated User Data and Site Option Disclosure

    HighCVSS 7.5No exploitEPSS 0%

    unknown · loops & logicSep 9, 2026

  • CVE-2026-76009
    32Monitor

    Next-Cart Store to WooCommerce Migration <= 3.9.8 - Unauthenticated Authentication Bypass via Default '__token__' Fallback in REST Migration Endpoint

    HighCVSS 8.1No exploitEPSS 0%

    martinnguyen1990 · next-cart store to woocommerce migrationSep 9, 2026

  • CVE-2026-83593
    28Monitor

    WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    quantumcloud · wpbot – ai chatbot for live support, lead generation, ai servicesSep 9, 2026

  • CVE-2026-84068
    34Monitor

    Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn_wp' Parameter

    HighCVSS 8.6No exploitEPSS 0%

    unknown · quentn wpSep 9, 2026

  • CVE-2026-75927
    28Monitor

    PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

    HighCVSS 7.2No exploitEPSS 0%

    publishpress · user role editor – publishpress capabilities: access control and user rolesSep 9, 2026

  • CVE-2026-79636
    28Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Validati

    HighCVSS 7.0No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-80123
    30Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Reques

    HighCVSS 7.5No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-12855
    32Monitor

    H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution.

    HighCVSS 8.2No exploitEPSS 0%

    insyde software · insydeh2oSep 9, 2026

  • CVE-2026-12858
    34Monitor

    Local privilege escalation vulnerability in ESET AV Remover

    HighCVSS 8.5No exploitEPSS 0%

    eset spol. s.r.o. · eset av remover (standalone)Sep 9, 2026

  • CVE-2026-14359
    35Monitor

    YITH WooCommerce Waitlist Premium <= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp_ajax_yith_wcwtl_add_user

    HighCVSS 8.8No exploitEPSS 0%

    yith · yith woocommerce waitlist premiumSep 9, 2026

  • CVE-2026-14989
    28Monitor

    Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter

    HighCVSS 7.2No exploitEPSS 0%

    wplegalpages · wplp cookie consent – cookie banner & consent management for gdpr, ccpa & google consent modeSep 9, 2026

  • CVE-2026-78491
    32Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific

    HighCVSS 8.2No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-78494
    29Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific

    HighCVSS 7.4No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-79696
    40Plan

    Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist

    CriticalCVSS 10.0No exploitEPSS 0%

    google cloud · agent development kit (adk) for pythonSep 9, 2026

  • CVE-2026-80099
    36Monitor

    Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret

    HighCVSS 8.8Proof of conceptEPSS 2%

    newfold · wp plugin webSep 9, 2026

  • CVE-2026-80122
    29Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific

    HighCVSS 7.3No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-86547
    27Monitor

    mrubyc through 4.0.0 NULL Pointer Dereference via OP_ENTER

    MediumCVSS 6.9Proof of conceptEPSS 0%

    mrubyc · mrubycSep 9, 2026

  • CVE-2026-87794
    34Monitor

    bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination

    HighCVSS 8.6No exploitEPSS 0%

    nfriedly · bestzipSep 9, 2026

  • CVE-2026-87795
    35Monitor

    zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress

    HighCVSS 8.8No exploitEPSS 0%

    luben · zstd-jniSep 9, 2026

  • CVE-2026-41869
    36Monitor

    Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)

    CriticalCVSS 9.1No exploitEPSS 0%

    apache · nutchSep 9, 2026

  • CVE-2026-41870
    35Monitor

    Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)

    HighCVSS 8.8No exploitEPSS 0%

    apache · nutchSep 9, 2026

  • CVE-2026-41871
    39Monitor

    Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)

    CriticalCVSS 9.8No exploitEPSS 0%

    apache · nutchSep 9, 2026

  • CVE-2026-56207
    39Monitor

    Apache Impala: SAML authentication bypass via forged bearer token

    CriticalCVSS 9.8No exploitEPSS 0%

    apache · impalaSep 9, 2026

  • CVE-2026-57866
    35Monitor

    Apache Impala: Secrets Exfiltration via SSRF

    HighCVSS 8.8No exploitEPSS 0%

    apache · impalaSep 9, 2026

  • CVE-2026-65181
    32Monitor

    Apache Impala: RCE via External Data Source Class Loading

    HighCVSS 8.1No exploitEPSS 0%

    apache · impalaSep 9, 2026

  • CVE-2026-73334
    32Monitor

    Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

    HighCVSS 8.1No exploitEPSS 0%

    apache · parquetSep 9, 2026

  • CVE-2026-79635
    29Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Reques

    HighCVSS 7.3No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-79641
    30Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali

    HighCVSS 7.5No exploitEPSS 1%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-85978
    40Plan

    Unauthenticated Remote Code Execution in Akana API Platform

    CriticalCVSS 10.0No exploitEPSS 1%

    perforce · akanaSep 9, 2026

  • CVE-2026-87827
    40Plan

    KGUARD DVR unauthenticated remote command execution vulnerability

    CriticalCVSS 10.0No exploitEPSS 1%

    kguard · kguard_firmwareSep 9, 2026

  • CVE-2026-74761
    30Monitor

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId

    HighCVSS 7.5No exploitEPSS 0%

    apache · activemqSep 9, 2026

  • CVE-2026-78485
    29Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitati

    HighCVSS 7.3No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-78490
    30Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restrict

    HighCVSS 7.5No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-78492
    29Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific

    HighCVSS 7.4No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-79637
    30Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific

    HighCVSS 7.7No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-79692
    29Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control

    HighCVSS 7.3No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-79695
    29Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Handling

    HighCVSS 7.3No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-79963
    29Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code W

    HighCVSS 7.4No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-79972
    28Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali

    HighCVSS 7.2No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-80172
    39Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Veri

    CriticalCVSS 9.8No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-87806
    36Monitor

    Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password

    CriticalCVSS 9.1No exploitEPSS 0%

    parse-community · parse-serverSep 9, 2026

  • CVE-2026-87808
    34Monitor

    SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock

    HighCVSS 8.7No exploitEPSS 0%

    siyuan-note · siyuanSep 9, 2026

  • CVE-2026-87809
    28Monitor

    Siyuan before v3.8.2 Information Disclosure via Export Preview

    HighCVSS 7.1No exploitEPSS 0%

    siyuan-note · siyuanSep 9, 2026

  • CVE-2026-87811
    33Monitor

    SiYuan before v3.8.2 Stored XSS via notebook template paths

    HighCVSS 8.4No exploitEPSS 0%

    siyuan-note · siyuanSep 9, 2026

  • CVE-2026-87812
    29Monitor

    SiYuan before v3.8.2 Stored XSS via Bazaar iconURL

    HighCVSS 7.4No exploitEPSS 0%

    siyuan-note · siyuanSep 9, 2026

  • CVE-2026-87813
    33Monitor

    SiYuan before v3.8.2 Stored XSS via unescaped asset filenames

    HighCVSS 8.4No exploitEPSS 0%

    siyuan-note · siyuanSep 9, 2026

  • CVE-2026-87814
    33Monitor

    SiYuan before v3.8.2 Stored XSS via Asset Preview

    HighCVSS 8.4No exploitEPSS 0%

    siyuan-note · siyuanSep 9, 2026

  • CVE-2026-87815
    33Monitor

    SiYuan before v3.8.2 Path Traversal via removeRiffDeck

    HighCVSS 8.4No exploitEPSS 0%

    siyuan-note · siyuanSep 9, 2026

  • CVE-2026-87816
    34Monitor

    PasswordPusher before 2.11.1 Race Condition View Limit Bypass

    HighCVSS 8.7No exploitEPSS 0%

    pglombardo · passwordpusherSep 9, 2026

  • CVE-2026-87817
    34Monitor

    GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation

    HighCVSS 8.7No exploitEPSS 0%

    gitpython project · gitpythonSep 9, 2026

  • CVE-2026-87818
    28Monitor

    GitPython 3.1.59 Local File Content Oracle via --no-index

    HighCVSS 7.1No exploitEPSS 0%

    gitpython project · gitpythonSep 9, 2026

  • CVE-2026-87819
    34Monitor

    GitPython before 3.1.60 Denial of Service via ReDoS

    HighCVSS 8.7No exploitEPSS 0%

    gitpython project · gitpythonSep 9, 2026

  • CVE-2026-87820
    27Monitor

    CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner

    MediumCVSS 6.9Proof of conceptEPSS 0%

    usmannasir · cyberpanelSep 9, 2026

  • CVE-2026-87821
    28Monitor

    Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch

    HighCVSS 7.1No exploitEPSS 0%

    laradashboard · laradashboardSep 9, 2026

  • CVE-2026-16272
    36Monitor

    Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module

    CriticalCVSS 9.1No exploitEPSS 0%

    paytr payment and electronic money institution inc. · paytr virtual pos iframe api (v9x) whmcs moduleSep 9, 2026

  • CVE-2026-87766
    35Monitor

    Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup

    HighCVSS 8.8No exploitEPSS 0%

    red hat · red hat enterprise linux 10Sep 9, 2026

  • CVE-2026-15140
    30Monitor

    A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP).

    HighCVSS 7.7No exploitEPSS 0%

    everpure · portworx operatorSep 9, 2026

  • CVE-2026-85102
    85Now

    Improper Certificate Validation in Quantum Security Gateway

    CriticalCVSS 9.8KEVWeaponizedEPSS 54%

    checkpoint · gaia embeddedSep 9, 2026

  • CVE-2026-85103
    40Plan

    Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding

    CriticalCVSS 9.8No exploitEPSS 4%

    checkpoint · quantum security gatewaySep 9, 2026

  • CVE-2026-56711
    29Monitor

    VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability

    HighCVSS 7.3No exploitEPSS 0%

    videolan · vlc media playerSep 9, 2026

  • CVE-2026-79738
    30Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded

    HighCVSS 7.5No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-79740
    30Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded

    HighCVSS 7.5No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-79950
    30Monitor

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded

    HighCVSS 7.5No exploitEPSS 0%

    dell · secure connect gatewaySep 9, 2026

  • CVE-2026-86099
    35Monitor

    Chainlit through 2.12.0 Path Traversal via socket.io sessionId

    HighCVSS 8.8No exploitEPSS 0%

    chainlit · chainlitSep 9, 2026

  • CVE-2026-86199
    34Monitor

    PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login

    HighCVSS 8.7No exploitEPSS 0%

    pmmp · pocketmine-mpSep 9, 2026

  • CVE-2026-86741
    33Monitor

    Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA

    HighCVSS 8.4No exploitEPSS 0%

    snipeitapp · snipe-itSep 9, 2026

  • CVE-2026-86746
    29Monitor

    Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay

    HighCVSS 7.4No exploitEPSS 0%

    snipeitapp · snipe-itSep 9, 2026

  • CVE-2026-86749
    28Monitor

    snipe-it before 8.7.0 Data Loss via Failed Image Write

    HighCVSS 7.0No exploitEPSS 0%

    snipeitapp · snipe-itSep 9, 2026