By publication date

Exploited and new serious CVEs: September 2026

7,964 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 3 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
29Monitor	CVE-2026-73718No exploit	Unauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composerarubanetworks · fabric composer · CWE-352 Pre-auth CSRF	High7.4	—	0.2%	Sep 1, 2026
28Monitor	CVE-2026-73719No exploit	Authenticated Arbitrary File Write Vulnerability leads to Remote Code Execution in HPE Networking Fabric Composerarubanetworks · fabric composer · CWE-73 RCE Path traversal	High7.2	—	0.6%	Sep 1, 2026
28Monitor	CVE-2026-73720No exploit	Authenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer APIarubanetworks · fabric composer · CWE-78 RCE Command injection	High7.2	—	1.0%	Sep 1, 2026
35Monitor	CVE-2026-79682No exploit	Dell PowerStore contains a Command Injection vulnerability.dell · powerstoreos · CWE-77 RCE Local privilege escalation Command injection	High8.8	—	0.7%	Sep 1, 2026
28Monitor	CVE-2026-73721No exploit	Authenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composerarubanetworks · fabric composer · CWE-89 SQL injection	High7.2	—	0.5%	Sep 1, 2026
28Monitor	CVE-2026-73722No exploit	Authenticated Command Injection Vulnerabilities in HPE Networking Fabric Composer Web-Based Management Interfacearubanetworks · fabric composer · CWE-78 RCE Command injection	High7.2	—	1.4%	Sep 1, 2026
28Monitor	CVE-2026-73723No exploit	Authenticated Privilege Escalation Leading to Unauthorized State Changes in HPE Networking Fabric Composer Web-Based Management Interfacearubanetworks · fabric composer · CWE-863 Broken access control (IDOR)	High7.1	—	0.3%	Sep 1, 2026
28Monitor	CVE-2026-73724No exploit	Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composerarubanetworks · fabric composer · CWE-863 Broken access control (IDOR)	High7.1	—	0.3%	Sep 1, 2026
28Monitor	CVE-2026-73725No exploit	Local Privilege Escalation leads to Arbitrary Code Execution in HPE Networking Fabric Composerarubanetworks · fabric composer · CWE-269 RCE Local privilege escalation	High7.0	—	0.1%	Sep 1, 2026
40Plan	CVE-2026-79687No exploit	Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability.dell · powerstoreos · CWE-306 Pre-auth Auth bypass	Critical10.0	—	0.2%	Sep 1, 2026
40Plan	CVE-2026-76657No exploit	Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Accessarubanetworks · fabric composer · CWE-287 Pre-auth Auth bypass	Critical10.0	—	0.7%	Sep 1, 2026
40Plan	CVE-2026-76658No exploit	Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemonarubanetworks · fabric composer · CWE-287 pre-auth RCE Auth bypass	Critical10.0	—	0.7%	Sep 1, 2026
29Monitor	CVE-2026-78592No exploit	Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resourceselastic · kibana · CWE-22 Path traversal	High7.3	—	0.4%	Sep 1, 2026
28Monitor	CVE-2026-78607No exploit	Missing Authorization in Elasticsearch Leading to Information Disclosureelastic · elasticsearch · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Sep 1, 2026
35Monitor	CVE-2026-84268No exploit	Gvfs: sftp: heap-based buffer overflow in read_reply()gnome · gvfs · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.6%	Sep 1, 2026
35Monitor	GHSA-gqvg-gmmx-x4hmNo exploit	MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifactPyPI · mlflow · CWE-502 pre-auth RCE Deserialization	High8.8	—	—	Sep 1, 2026
34Monitor	CVE-2026-71981Proof of concept	Cypht < 2.12.2 PHP Object Injection RCE via back_query Parametercypht-org · cypht · CWE-502 RCE Deserialization	High8.7	—	0.9%	Sep 1, 2026
39Monitor	CVE-2026-73749No exploit	Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CXhpe · arubaos-cx · CWE-284 pre-auth RCE Broken access control (IDOR)	Critical9.8	—	0.8%	Sep 1, 2026
35Monitor	CVE-2026-73750No exploit	Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Executionhpe · arubaos-cx · CWE-284 RCE Broken access control (IDOR)	High8.8	—	0.7%	Sep 1, 2026
35Monitor	CVE-2026-73751No exploit	Authenticated Remote Command Injection in AOS-CX Web-based Management Interfacehpe · arubaos-cx · CWE-77 RCE Command injection	High8.8	—	0.6%	Sep 1, 2026
35Monitor	CVE-2026-73752No exploit	Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CXhpe · arubaos-cx · CWE-22 pre-auth RCE Path traversal	High8.8	—	0.4%	Sep 1, 2026
35Monitor	CVE-2026-73753No exploit	Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interfacehpe · arubaos-cx · CWE-78 RCE Command injection	High8.8	—	0.6%	Sep 1, 2026
35Monitor	CVE-2026-73763No exploit	Unauthenticated Remote Command Execution in Management Componenthpe · arubaos-cx · CWE-77 pre-auth RCE Command injection	High8.8	—	0.4%	Sep 1, 2026
28Monitor	CVE-2026-73764No exploit	Authentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CXhpe · arubaos-cx · CWE-287 Pre-auth Auth bypass	High7.1	—	0.3%	Sep 1, 2026
28Monitor	CVE-2026-73765No exploit	Authenticated Path Traversal Vulnerabilities Lead to Remote Code Execution in AOS-CXhpe · arubaos-cx · CWE-22 RCE Path traversal	High7.2	—	0.8%	Sep 1, 2026
28Monitor	CVE-2026-73766No exploit	Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CXhpe · arubaos-cx · CWE-77 RCE Command injection	High7.2	—	1.4%	Sep 1, 2026
28Monitor	CVE-2026-73767No exploit	Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interfacehpe · arubaos-cx · CWE-78 RCE Command injection	High7.2	—	1.6%	Sep 1, 2026
29Monitor	CVE-2026-73768No exploit	Local Privilege Escalation in AOS-CX Command Line Interfacehpe · arubaos-cx · CWE-20 Local privilege escalation	High7.3	—	0.1%	Sep 1, 2026
29Monitor	CVE-2026-73770No exploit	Authenticated Arbitrary File Write Vulnerability Leading to Remote Code Execution in AOS-CXhpe · arubaos-cx · CWE-73 RCE Path traversal	High7.3	—	0.2%	Sep 1, 2026
30Monitor	CVE-2026-73771No exploit	Improper Authentication Handling in AOS-CX Management Interface and APIhpe · arubaos-cx · CWE-287 Pre-auth Auth bypass	High7.5	—	0.4%	Sep 1, 2026
30Monitor	CVE-2026-73773No exploit	Unauthenticated Denial-of-Service (DoS) Vulnerability in AOS-CXhpe · arubaos-cx · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Sep 1, 2026
30Monitor	CVE-2026-73774No exploit	Unauthenticated Buffer Overflow Vulnerability leads to Sensitive Information Disclosure in AOS-CXhpe · arubaos-cx · CWE-120 Pre-auth Memory safety	High7.6	—	0.2%	Sep 1, 2026
30Monitor	CVE-2026-73775No exploit	Authenticated Sensitive Information Disclosure Vulnerabilities in AOS-CXhpe · arubaos-cx · CWE-200 Info leak	High7.7	—	0.4%	Sep 1, 2026
31Monitor	CVE-2026-73776No exploit	Authenticated Signature Verification Bypass Leading to Arbitrary Code Execution in AOS-CXhpe · arubaos-cx · CWE-347 RCE Local privilege escalation Weak crypto	High7.9	—	0.1%	Sep 1, 2026
32Monitor	CVE-2026-73777No exploit	Authorization Bypass Vulnerabilities Leading to Privilege Escalation in AOS-CX API Endpointhpe · arubaos-cx · CWE-287 Pre-auth Auth bypass	High8.1	—	0.4%	Sep 1, 2026
39Monitor	CVE-2026-73778No exploit	Credential Manager Vulnerability Allows Unauthorized Administrative Accesshpe · arubaos-cx · CWE-521 Pre-auth Hard-coded credentials	Critical9.8	—	0.5%	Sep 1, 2026
32Monitor	CVE-2026-73779No exploit	Authentication Bypass Vulnerabilities Leading to Information Disclosure, Unauthorized Modification, and Service Disruption in AOS-CXhpe · arubaos-cx · CWE-269 Pre-auth Auth bypass	High8.2	—	0.2%	Sep 1, 2026
33Monitor	CVE-2026-73780No exploit	Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CXhpe · arubaos-cx · CWE-352 pre-auth RCE CSRF	High8.3	—	0.1%	Sep 1, 2026
33Monitor	CVE-2026-73781No exploit	Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management Interfacehpe · arubaos-cx · CWE-79 RCE XSS	High8.4	—	0.5%	Sep 1, 2026
35Monitor	CVE-2026-73782No exploit	Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CXhpe · arubaos-cx · CWE-134 pre-auth RCE	High8.8	—	0.4%	Sep 1, 2026
30Monitor	CVE-2026-84361Proof of concept	Composer: Perforce source URL permits P4PORT `rsh:` command executioncomposer · composer · CWE-78 pre-auth RCE Command injection	High7.7	—	0.5%	Sep 1, 2026
29Monitor	CVE-2026-84366No exploit	Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by defaultscrapy · scrapy · CWE-319 Pre-auth Weak crypto	High7.4	—	0.2%	Sep 1, 2026
32Monitor	CVE-2026-84370No exploit	SVGO: removeScripts allows executable links through namespace and control-character bypassessvg · svgo · CWE-79 Pre-auth XSS	High8.2	—	0.5%	Sep 1, 2026
38Monitor	CVE-2023-54391Proof of concept	Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameterproxmox server solutions gmbh · proxmox virtual environment (ve) · CWE-304 Pre-auth Auth bypass	Critical9.3	—	3.0%	Sep 1, 2026
32Monitor	CVE-2026-18730No exploit	Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer tokengithub · enterprise server · CWE-918 Pre-auth SSRF	High8.2	—	0.4%	Sep 1, 2026
30Monitor	CVE-2026-19118No exploit	Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code executiongithub · enterprise server · CWE-367 RCE Race condition	High7.7	—	0.9%	Sep 1, 2026
60This week	CVE-2026-75604Weaponized	Next.js: Unauthenticated Remote Code Execution on windows-hosted serversvercel · next.js · CWE-22 pre-auth RCE Path traversal	Critical9.0	—	2.1%	Sep 1, 2026
30Monitor	CVE-2026-76851No exploit	Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal servicgithub · enterprise server · CWE-918 RCE SSRF	High7.7	—	0.8%	Sep 1, 2026
72This week	CVE-2026-83548Weaponized	A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.sonicwall · sma8200v · CWE-441 Pre-auth SSRF	Critical10.0	KEV	8.0%	Sep 1, 2026
64This week	CVE-2026-83549Weaponized	Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identisonicwall · sma8200v · CWE-78 RCE Command injection	High7.8	KEV	9.8%	Sep 1, 2026
39Monitor	CVE-2026-84372No exploit	Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connectionspredis · predis · CWE-93 pre-auth RCE Deserialization Command injection	Critical9.8	—	0.7%	Sep 1, 2026
30Monitor	CVE-2026-84374No exploit	Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled pathspartnernl · laravel-excel · CWE-22 Path traversal	High7.5	—	0.8%	Sep 1, 2026
39Monitor	CVE-2026-84637No exploit	Calendar invitation attachments could launch local executablesmozilla · thunderbird · CWE-434 Pre-auth File upload	Critical9.8	—	0.6%	Sep 1, 2026
36Monitor	CVE-2026-84639No exploit	Uninitialized memory in MIME parsingmozilla · thunderbird · CWE-457 Pre-auth	Critical9.1	—	0.3%	Sep 1, 2026
30Monitor	CVE-2026-84640No exploit	One byte overflow read in mail parsermozilla · thunderbird · CWE-126 Pre-auth	High7.5	—	0.2%	Sep 1, 2026
30Monitor	CVE-2026-84641No exploit	Information disclosure due to malicious IMAP server responsemozilla · thunderbird · CWE-416 Pre-auth Memory safety	High7.5	—	0.2%	Sep 1, 2026
30Monitor	CVE-2026-84642No exploit	Allowed UNC hostnames for attachments interpreted as a regular expressionmozilla · thunderbird · CWE-1333 Pre-auth Denial of service	High7.5	—	0.4%	Sep 1, 2026
34Monitor	CVE-2024-7952No exploit	DataEdgePlatform DataMosaix™ Private Cloudrockwell automation · dataedgeplatform datamosaix™ private cloud · CWE-798 Pre-auth Auth bypass Hard-coded credentials	High8.7	—	0.5%	Sep 1, 2026
34Monitor	CVE-2024-7953No exploit	DataEdgePlatform DataMosaix™ Private Cloudrockwell automation · dataedgeplatform datamosaix™ private cloud · CWE-284 Broken access control (IDOR)	High8.7	—	0.3%	Sep 1, 2026
39Monitor	CVE-2026-19593No exploit	OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace.openai · codex desktop · CWE-15 Pre-auth	Critical9.8	—	0.5%	Sep 1, 2026
30Monitor	CVE-2026-52023No exploit	An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specificalkamailio · kamailio · CWE-415 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Sep 1, 2026
28Monitor	GHSA-2rx9-3g3h-c2jvNo exploit	pnpm: pacquet trust-lockfile install can create dependency symlinks outside the projectnpm · pnpm · CWE-22 Pre-auth Path traversal	High7.1	—	—	Sep 1, 2026
34Monitor	CVE-2026-84208No exploit	AVideo User_Location Plugin Unauthenticated SQL Injectionwwbn · avideo · CWE-89 Pre-auth SQL injection	High8.7	—	0.4%	Sep 1, 2026
34Monitor	CVE-2026-84476No exploit	WWBN AVideo Authentication Bypass via X-Real-IP Headerwwbn · avideo · CWE-290 Pre-auth Auth bypass	High8.7	—	0.4%	Sep 1, 2026
37Monitor	CVE-2026-84479No exploit	WWBN AVideo Authentication Bypass via User-Agent Headerwwbn · avideo · CWE-290 Pre-auth Auth bypass	Critical9.3	—	0.5%	Sep 1, 2026
37Monitor	CVE-2026-84480No exploit	WWBN AVideo Password Recovery Token Expiration Bypasswwbn · avideo · CWE-613 Pre-auth	Critical9.3	—	0.5%	Sep 1, 2026
34Monitor	CVE-2026-84482No exploit	WWBN AVideo Cross-Site Request Forgery via get_domain() validationwwbn · avideo · CWE-346 Pre-auth CSRF	High8.7	—	0.2%	Sep 1, 2026
30Monitor	CVE-2026-81928No exploit	Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG recordCWE-674 Pre-auth Denial of service	High7.5	—	0.6%	Sep 1, 2026
36Monitor	CVE-2026-84324No exploit	Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.0	—	0.4%	Sep 1, 2026
39Monitor	CVE-2026-84325No exploit	Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering togoogle · chrome · CWE-20 Pre-auth	Critical9.8	—	0.4%	Sep 1, 2026
35Monitor	CVE-2026-84326No exploit	Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox google · chrome · CWE-908 pre-auth RCE Memory safety	High8.8	—	0.4%	Sep 1, 2026
38Monitor	CVE-2026-84333No exploit	Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside thegoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 1, 2026
32Monitor	CVE-2026-84334No exploit	Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary cogoogle · chrome · CWE-863 RCE Broken access control (IDOR)	High8.1	—	0.1%	Sep 1, 2026
33Monitor	CVE-2026-84335No exploit	Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer procegoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.3	—	0.3%	Sep 1, 2026
35Monitor	CVE-2026-84347No exploit	Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.5%	Sep 1, 2026
33Monitor	CVE-2026-84349No exploit	Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.4%	Sep 1, 2026
35Monitor	CVE-2026-84350No exploit	Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 1, 2026
33Monitor	CVE-2026-84351No exploit	Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-121 pre-auth RCE Memory safety	High8.3	—	0.4%	Sep 1, 2026
38Monitor	CVE-2026-84352No exploit	Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside thgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 1, 2026
38Monitor	CVE-2026-84353No exploit	Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social enginegoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 1, 2026
38Monitor	CVE-2026-84354No exploit	Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to exegoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	Critical9.6	—	0.4%	Sep 1, 2026
34Monitor	CVE-2026-84694No exploit	Coolify before 4.2.0 Remote Code Execution via Environment Variable Keycoollabsio · coolify · CWE-78 RCE Command injection	High8.7	—	0.8%	Sep 1, 2026
37Monitor	CVE-2026-84695No exploit	BookStack before 26.05.4 Stored XSS via Drawing Uploadbookstackapp · bookstack · CWE-79 XSS	Critical9.3	—	0.4%	Sep 1, 2026
37Monitor	CVE-2026-84696No exploit	Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commandsphison electronics corporation · ps3111-s11 controller firmware · CWE-306 Auth bypass Local privilege escalation	Critical9.3	—	0.2%	Sep 1, 2026
28Monitor	CVE-2026-84698No exploit	PX4 Autopilot sd_bench Heap Buffer Overflow via Block Sizepx4 · px4-autopilot · CWE-787 Pre-auth Memory safety	High7.1	—	0.4%	Sep 1, 2026
37Monitor	CVE-2026-84699No exploit	Team Password Manager before 14.184.308 Authentication Bypass in Password Resetteam password manager · team password manager · CWE-640 Pre-auth Auth bypass	Critical9.3	—	0.6%	Sep 1, 2026
35Monitor	CVE-2026-84700No exploit	Pika Unauthenticated Replication Access via Internal Protobuf Portopenatomfoundation · pikiwidb · CWE-306 Pre-auth Auth bypass	High8.8	—	0.5%	Sep 1, 2026
34Monitor	CVE-2026-84702No exploit	facefusion before 3.7.0 Path Traversal via Job Identifierfacefusion · facefusion · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Sep 1, 2026
30Monitor	CVE-2026-84375No exploit	js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sourcesnodeca · js-yaml · CWE-400 Pre-auth Denial of service	High7.5	—	0.5%	Sep 1, 2026
34Monitor	CVE-2026-84484No exploit	ION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnvnasa-jpl · ion-dtn · CWE-125 Pre-auth Memory safety	High8.7	—	0.8%	Sep 1, 2026
34Monitor	CVE-2026-84485No exploit	APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpointapitable · apitable · CWE-306 Pre-auth Auth bypass	High8.7	—	0.6%	Sep 1, 2026
34Monitor	CVE-2026-84715No exploit	FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Updatemythicalltd · featherpanel · CWE-862 Broken access control (IDOR)	High8.7	—	0.5%	Sep 1, 2026
30Monitor	CVE-2026-14957No exploit	FIPS mode assertion failure via malicious CERT payloadthe libreswan project · libreswan · CWE-252 pre-auth RCE Denial of service	High7.5	—	0.4%	Sep 1, 2026
32Monitor	CVE-2026-14982No exploit	WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameterjoomunited · wp file download · CWE-22 RCE Path traversal	High8.1	—	0.8%	Sep 1, 2026
39Monitor	CVE-2026-9055Proof of concept	Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'melograno · booking for appointments and events calendar – amelia · CWE-269 Pre-auth	Critical9.8	—	0.5%	Sep 2, 2026
32Monitor	CVE-2026-12526No exploit	Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Actionunknown · advanced custom fields: extended · CWE-287 Pre-auth Auth bypass	High8.1	—	0.3%	Sep 2, 2026
28Monitor	CVE-2026-12865No exploit	Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parametersunknown · photo gallery by 10web · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Sep 2, 2026
35Monitor	CVE-2026-14357No exploit	DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameterdplugins · devkit pro · CWE-862 RCE Broken access control (IDOR)	High8.8	—	0.7%	Sep 2, 2026
35Monitor	CVE-2026-19116No exploit	WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Formunknown · user frontend · CWE-502 RCE Deserialization	High8.8	—	0.7%	Sep 2, 2026
28Monitor	CVE-2026-19453No exploit	JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selectionunknown · jetbackup · CWE-269	High7.1	—	0.2%	Sep 2, 2026

CVE-2026-73718
29Monitor
Unauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composer
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- CSRF
arubanetworks · fabric composerSep 1, 2026
CVE-2026-73719
28Monitor
Authenticated Arbitrary File Write Vulnerability leads to Remote Code Execution in HPE Networking Fabric Composer
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Path traversal
arubanetworks · fabric composerSep 1, 2026
CVE-2026-73720
28Monitor
Authenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer API
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Command injection
arubanetworks · fabric composerSep 1, 2026
CVE-2026-79682
35Monitor
Dell PowerStore contains a Command Injection vulnerability.
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
dell · powerstoreosSep 1, 2026
CVE-2026-73721
28Monitor
Authenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composer
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
arubanetworks · fabric composerSep 1, 2026
CVE-2026-73722
28Monitor
Authenticated Command Injection Vulnerabilities in HPE Networking Fabric Composer Web-Based Management Interface
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Command injection
arubanetworks · fabric composerSep 1, 2026
CVE-2026-73723
28Monitor
Authenticated Privilege Escalation Leading to Unauthorized State Changes in HPE Networking Fabric Composer Web-Based Management Interface
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
arubanetworks · fabric composerSep 1, 2026
CVE-2026-73724
28Monitor
Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
arubanetworks · fabric composerSep 1, 2026
CVE-2026-73725
28Monitor
Local Privilege Escalation leads to Arbitrary Code Execution in HPE Networking Fabric Composer
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Local privilege escalation
arubanetworks · fabric composerSep 1, 2026
CVE-2026-79687
40Plan
Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability.
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
dell · powerstoreosSep 1, 2026
CVE-2026-76657
40Plan
Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Auth bypass
arubanetworks · fabric composerSep 1, 2026
CVE-2026-76658
40Plan
Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
arubanetworks · fabric composerSep 1, 2026
CVE-2026-78592
29Monitor
Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources
HighCVSS 7.3No exploitEPSS 0%
- Path traversal
elastic · kibanaSep 1, 2026
CVE-2026-78607
28Monitor
Missing Authorization in Elasticsearch Leading to Information Disclosure
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
elastic · elasticsearchSep 1, 2026
CVE-2026-84268
35Monitor
Gvfs: sftp: heap-based buffer overflow in read_reply()
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
gnome · gvfsSep 1, 2026
GHSA-gqvg-gmmx-x4hm
35Monitor
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
HighCVSS 8.8No exploit
- pre-auth RCE
- Deserialization
PyPI · mlflowSep 1, 2026
CVE-2026-71981
34Monitor
Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
HighCVSS 8.7Proof of conceptEPSS 0%
- RCE
- Deserialization
cypht-org · cyphtSep 1, 2026
CVE-2026-73749
39Monitor
Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
hpe · arubaos-cxSep 1, 2026
CVE-2026-73750
35Monitor
Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
hpe · arubaos-cxSep 1, 2026
CVE-2026-73751
35Monitor
Authenticated Remote Command Injection in AOS-CX Web-based Management Interface
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
hpe · arubaos-cxSep 1, 2026
CVE-2026-73752
35Monitor
Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Path traversal
hpe · arubaos-cxSep 1, 2026
CVE-2026-73753
35Monitor
Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
hpe · arubaos-cxSep 1, 2026
CVE-2026-73763
35Monitor
Unauthenticated Remote Command Execution in Management Component
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
hpe · arubaos-cxSep 1, 2026
CVE-2026-73764
28Monitor
Authentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CX
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
hpe · arubaos-cxSep 1, 2026
CVE-2026-73765
28Monitor
Authenticated Path Traversal Vulnerabilities Lead to Remote Code Execution in AOS-CX
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Path traversal
hpe · arubaos-cxSep 1, 2026
CVE-2026-73766
28Monitor
Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Command injection
hpe · arubaos-cxSep 1, 2026
CVE-2026-73767
28Monitor
Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Command injection
hpe · arubaos-cxSep 1, 2026
CVE-2026-73768
29Monitor
Local Privilege Escalation in AOS-CX Command Line Interface
HighCVSS 7.3No exploitEPSS 0%
- Local privilege escalation
hpe · arubaos-cxSep 1, 2026
CVE-2026-73770
29Monitor
Authenticated Arbitrary File Write Vulnerability Leading to Remote Code Execution in AOS-CX
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Path traversal
hpe · arubaos-cxSep 1, 2026
CVE-2026-73771
30Monitor
Improper Authentication Handling in AOS-CX Management Interface and API
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
hpe · arubaos-cxSep 1, 2026
CVE-2026-73773
30Monitor
Unauthenticated Denial-of-Service (DoS) Vulnerability in AOS-CX
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
hpe · arubaos-cxSep 1, 2026
CVE-2026-73774
30Monitor
Unauthenticated Buffer Overflow Vulnerability leads to Sensitive Information Disclosure in AOS-CX
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Memory safety
hpe · arubaos-cxSep 1, 2026
CVE-2026-73775
30Monitor
Authenticated Sensitive Information Disclosure Vulnerabilities in AOS-CX
HighCVSS 7.7No exploitEPSS 0%
- Info leak
hpe · arubaos-cxSep 1, 2026
CVE-2026-73776
31Monitor
Authenticated Signature Verification Bypass Leading to Arbitrary Code Execution in AOS-CX
HighCVSS 7.9No exploitEPSS 0%
- RCE
- Local privilege escalation
- Weak crypto
hpe · arubaos-cxSep 1, 2026
CVE-2026-73777
32Monitor
Authorization Bypass Vulnerabilities Leading to Privilege Escalation in AOS-CX API Endpoint
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
hpe · arubaos-cxSep 1, 2026
CVE-2026-73778
39Monitor
Credential Manager Vulnerability Allows Unauthorized Administrative Access
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
hpe · arubaos-cxSep 1, 2026
CVE-2026-73779
32Monitor
Authentication Bypass Vulnerabilities Leading to Information Disclosure, Unauthorized Modification, and Service Disruption in AOS-CX
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
hpe · arubaos-cxSep 1, 2026
CVE-2026-73780
33Monitor
Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- CSRF
hpe · arubaos-cxSep 1, 2026
CVE-2026-73781
33Monitor
Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management Interface
HighCVSS 8.4No exploitEPSS 0%
- RCE
- XSS
hpe · arubaos-cxSep 1, 2026
CVE-2026-73782
35Monitor
Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
hpe · arubaos-cxSep 1, 2026
CVE-2026-84361
30Monitor
Composer: Perforce source URL permits P4PORT `rsh:` command execution
HighCVSS 7.7Proof of conceptEPSS 0%
- pre-auth RCE
- Command injection
composer · composerSep 1, 2026
CVE-2026-84366
29Monitor
Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
scrapy · scrapySep 1, 2026
CVE-2026-84370
32Monitor
SVGO: removeScripts allows executable links through namespace and control-character bypasses
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- XSS
svg · svgoSep 1, 2026
CVE-2023-54391
38Monitor
Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter
CriticalCVSS 9.3Proof of conceptEPSS 3%
- Pre-auth
- Auth bypass
proxmox server solutions gmbh · proxmox virtual environment (ve)Sep 1, 2026
CVE-2026-18730
32Monitor
Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SSRF
github · enterprise serverSep 1, 2026
CVE-2026-19118
30Monitor
Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution
HighCVSS 7.7No exploitEPSS 0%
- RCE
- Race condition
github · enterprise serverSep 1, 2026
CVE-2026-75604
60This week
Next.js: Unauthenticated Remote Code Execution on windows-hosted servers
CriticalCVSS 9.0WeaponizedEPSS 2%
- pre-auth RCE
- Path traversal
vercel · next.jsSep 1, 2026
CVE-2026-76851
30Monitor
Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal servic
HighCVSS 7.7No exploitEPSS 0%
- RCE
- SSRF
github · enterprise serverSep 1, 2026
CVE-2026-83548
72This week
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.
CriticalCVSS 10.0KEVWeaponizedEPSS 8%
- Pre-auth
- SSRF
sonicwall · sma8200vSep 1, 2026
CVE-2026-83549
64This week
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identi
HighCVSS 7.8KEVWeaponizedEPSS 9%
- RCE
- Command injection
sonicwall · sma8200vSep 1, 2026
CVE-2026-84372
39Monitor
Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
- Command injection
predis · predisSep 1, 2026
CVE-2026-84374
30Monitor
Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path
HighCVSS 7.5No exploitEPSS 0%
- Path traversal
spartnernl · laravel-excelSep 1, 2026
CVE-2026-84637
39Monitor
Calendar invitation attachments could launch local executables
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- File upload
mozilla · thunderbirdSep 1, 2026
CVE-2026-84639
36Monitor
Uninitialized memory in MIME parsing
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
mozilla · thunderbirdSep 1, 2026
CVE-2026-84640
30Monitor
One byte overflow read in mail parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
mozilla · thunderbirdSep 1, 2026
CVE-2026-84641
30Monitor
Information disclosure due to malicious IMAP server response
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · thunderbirdSep 1, 2026
CVE-2026-84642
30Monitor
Allowed UNC hostnames for attachments interpreted as a regular expression
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
mozilla · thunderbirdSep 1, 2026
CVE-2024-7952
34Monitor
DataEdgePlatform DataMosaix™ Private Cloud
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
rockwell automation · dataedgeplatform datamosaix™ private cloudSep 1, 2026
CVE-2024-7953
34Monitor
DataEdgePlatform DataMosaix™ Private Cloud
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
rockwell automation · dataedgeplatform datamosaix™ private cloudSep 1, 2026
CVE-2026-19593
39Monitor
OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
openai · codex desktopSep 1, 2026
CVE-2026-52023
30Monitor
An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifical
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
kamailio · kamailioSep 1, 2026
GHSA-2rx9-3g3h-c2jv
28Monitor
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
HighCVSS 7.1No exploit
- Pre-auth
- Path traversal
npm · pnpmSep 1, 2026
CVE-2026-84208
34Monitor
AVideo User_Location Plugin Unauthenticated SQL Injection
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SQL injection
wwbn · avideoSep 1, 2026
CVE-2026-84476
34Monitor
WWBN AVideo Authentication Bypass via X-Real-IP Header
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
wwbn · avideoSep 1, 2026
CVE-2026-84479
37Monitor
WWBN AVideo Authentication Bypass via User-Agent Header
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
wwbn · avideoSep 1, 2026
CVE-2026-84480
37Monitor
WWBN AVideo Password Recovery Token Expiration Bypass
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
wwbn · avideoSep 1, 2026
CVE-2026-84482
34Monitor
WWBN AVideo Cross-Site Request Forgery via get_domain() validation
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- CSRF
wwbn · avideoSep 1, 2026
CVE-2026-81928
30Monitor
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Sep 1, 2026
CVE-2026-84324
36Monitor
Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via
CriticalCVSS 9.0No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 1, 2026
CVE-2026-84325
39Monitor
Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
google · chromeSep 1, 2026
CVE-2026-84326
35Monitor
Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 1, 2026
CVE-2026-84333
38Monitor
Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 1, 2026
CVE-2026-84334
32Monitor
Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary co
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
google · chromeSep 1, 2026
CVE-2026-84335
33Monitor
Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proce
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeSep 1, 2026
CVE-2026-84347
35Monitor
Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 1, 2026
CVE-2026-84349
33Monitor
Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to exec
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 1, 2026
CVE-2026-84350
35Monitor
Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 1, 2026
CVE-2026-84351
33Monitor
Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proc
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 1, 2026
CVE-2026-84352
38Monitor
Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside th
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 1, 2026
CVE-2026-84353
38Monitor
Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engine
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 1, 2026
CVE-2026-84354
38Monitor
Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to exe
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeSep 1, 2026
CVE-2026-84694
34Monitor
Coolify before 4.2.0 Remote Code Execution via Environment Variable Key
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Command injection
coollabsio · coolifySep 1, 2026
CVE-2026-84695
37Monitor
BookStack before 26.05.4 Stored XSS via Drawing Upload
CriticalCVSS 9.3No exploitEPSS 0%
- XSS
bookstackapp · bookstackSep 1, 2026
CVE-2026-84696
37Monitor
Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands
CriticalCVSS 9.3No exploitEPSS 0%
- Auth bypass
- Local privilege escalation
phison electronics corporation · ps3111-s11 controller firmwareSep 1, 2026
CVE-2026-84698
28Monitor
PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
px4 · px4-autopilotSep 1, 2026
CVE-2026-84699
37Monitor
Team Password Manager before 14.184.308 Authentication Bypass in Password Reset
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
team password manager · team password managerSep 1, 2026
CVE-2026-84700
35Monitor
Pika Unauthenticated Replication Access via Internal Protobuf Port
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
openatomfoundation · pikiwidbSep 1, 2026
CVE-2026-84702
34Monitor
facefusion before 3.7.0 Path Traversal via Job Identifier
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
facefusion · facefusionSep 1, 2026
CVE-2026-84375
30Monitor
js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
nodeca · js-yamlSep 1, 2026
CVE-2026-84484
34Monitor
ION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnv
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Memory safety
nasa-jpl · ion-dtnSep 1, 2026
CVE-2026-84485
34Monitor
APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
apitable · apitableSep 1, 2026
CVE-2026-84715
34Monitor
FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
mythicalltd · featherpanelSep 1, 2026
CVE-2026-14957
30Monitor
FIPS mode assertion failure via malicious CERT payload
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Denial of service
the libreswan project · libreswanSep 1, 2026
CVE-2026-14982
32Monitor
WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Path traversal
joomunited · wp file downloadSep 1, 2026
CVE-2026-9055
39Monitor
Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
melograno · booking for appointments and events calendar – ameliaSep 2, 2026
CVE-2026-12526
32Monitor
Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
unknown · advanced custom fields: extendedSep 2, 2026
CVE-2026-12865
28Monitor
Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unknown · photo gallery by 10webSep 2, 2026
CVE-2026-14357
35Monitor
DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
dplugins · devkit proSep 2, 2026
CVE-2026-19116
35Monitor
WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Deserialization
unknown · user frontendSep 2, 2026
CVE-2026-19453
28Monitor
JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection
HighCVSS 7.1No exploitEPSS 0%
unknown · jetbackupSep 2, 2026