By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 33 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-15600No exploit	SQL Injection in Alior Bank raty PrestaShop modulealior bank · raty · CWE-89 SQL injection	High8.6	—	0.3%	Sep 14, 2026
32Monitor	CVE-2026-25687No exploit	ZCC race condition in ZPA tunnel handlerzscaler · client connector · CWE-366 pre-auth RCE Race condition	High8.1	—	0.3%	Sep 14, 2026
26Monitor	CVE-2026-57115No exploit	PraisonAI: SpiderTools redirect-target SSRF protection bypassmervinpraison · praisonai · CWE-918 Pre-auth SSRF	Medium6.5	—	0.4%	Sep 14, 2026
39Monitor	CVE-2026-57123No exploit	PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired inmervinpraison · praisonaiagents · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.9%	Sep 14, 2026
39Monitor	CVE-2026-57125No exploit	PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypassmervinpraison · praisonai · CWE-306 pre-auth RCE Auth bypass	Critical9.8	—	0.6%	Sep 14, 2026
34Monitor	CVE-2026-57126No exploit	praisonaiagents: SSRF guard validates literal IPs only and never resolves DNSmervinpraison · praisonai · CWE-918 SSRF	High8.5	—	0.3%	Sep 14, 2026
28Monitor	CVE-2026-8821No exploit	Playbooks run owner channel membership permission bypassmattermost · mattermost server · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Sep 14, 2026
32Monitor	CVE-2026-57130No exploit	PraisonAI: IMAP Command Injection via Unsanitized Email Search Parametersmervinpraison · praisonaiagents · CWE-20 RCE Command injection	High8.1	—	0.4%	Sep 14, 2026
32Monitor	CVE-2026-59569No exploit	Android ZCC VPN API method privilege escalationzscaler · client connector · CWE-20 Local privilege escalation	High8.1	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-59570No exploit	Android ZCC denial of servicezscaler · client connector · CWE-20	High7.5	—	0.1%	Sep 14, 2026
34Monitor	CVE-2026-7848No exploit	SQL Injection in Alior Bank raty PrestaShop modulealior bank · raty · CWE-89 SQL injection	High8.6	—	0.3%	Sep 14, 2026
31Monitor	CVE-2026-82427No exploit	Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Nameapache software foundation · apache storm nimbus · CWE-22 Path traversal	High7.8	—	0.1%	Sep 14, 2026
35Monitor	CVE-2026-82428No exploit	Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keysapache software foundation · apache storm client · CWE-22 Path traversal	High8.8	—	0.6%	Sep 14, 2026
31Monitor	CVE-2026-82429No exploit	Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcherapache software foundation · apache storm worker launcher · CWE-367 Local privilege escalation Race condition	High7.8	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-82430No exploit	Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenantapache software foundation · apache storm worker launcher · CWE-367 Local privilege escalation Race condition	High7.8	—	0.1%	Sep 14, 2026
39Monitor	CVE-2026-82431No exploit	Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.usersapache software foundation · apache storm client · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.3%	Sep 14, 2026
32Monitor	CVE-2026-82432No exploit	Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overridesapache software foundation · apache storm nimbus · CWE-863 Broken access control (IDOR)	High8.1	—	0.3%	Sep 14, 2026
40Plan	CVE-2026-82434No exploit	Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logsapache software foundation · apache storm nimbus · CWE-522 Pre-auth Info leak	Critical10.0	—	0.5%	Sep 14, 2026
39Monitor	CVE-2026-82435No exploit	Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoderapache software foundation · apache storm worker · CWE-789 Pre-auth	Critical9.8	—	0.6%	Sep 14, 2026
32Monitor	CVE-2026-82438No exploit	Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Originsapache software foundation · apache storm webapp · CWE-346	High8.1	—	0.2%	Sep 14, 2026
30Monitor	GHSA-3g6h-r5qx-f6hqNo exploit	Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled Pre-auth Denial of service	High7.5	—	—	Sep 14, 2026
30Monitor	GHSA-ppcp-v39w-8jq2No exploit	Outgoing datagram buffer accounting can panic the sender in quinn-proto Pre-auth Denial of service	High7.5	—	—	Sep 14, 2026
30Monitor	CVE-2026-47701No exploit	OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer authopen-telemetry · opentelemetry-operator · CWE-200 Info leak	High7.7	—	0.4%	Sep 14, 2026
29Monitor	CVE-2026-56839No exploit	PraisonAI Code agent tools fail open without a workspace boundarymervinpraison · praisonai · CWE-22 Path traversal	High7.3	—	0.3%	Sep 14, 2026
30Monitor	CVE-2026-57119No exploit	PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs APImervinpraison · praisonai · CWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Sep 14, 2026
34Monitor	CVE-2026-57122No exploit	PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)mervinpraison · praisonai · CWE-345 Pre-auth	High8.6	—	0.1%	Sep 14, 2026
39Monitor	CVE-2026-57124No exploit	PraisonAI UI MCP connect endpoint allows unauthenticated local command executionmervinpraison · praisonai · CWE-78 pre-auth RCE Command injection	Critical9.8	—	1.0%	Sep 14, 2026
39Monitor	CVE-2026-57127No exploit	praisonai: recipe serve auth middleware silently disables itself when no secret is setmervinpraison · praisonai · CWE-306 Pre-auth Auth bypass	Critical9.8	—	0.9%	Sep 14, 2026
39Monitor	CVE-2026-57131No exploit	praisonai: Jobs API exposes agent-execution endpoints with no authenticationmervinpraison · praisonai · CWE-94 pre-auth RCE Auth bypass	Critical9.8	—	0.9%	Sep 14, 2026
32Monitor	CVE-2026-57132No exploit	PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authenticationmervinpraison · praisonai · CWE-287 Pre-auth Auth bypass	High8.2	—	0.5%	Sep 14, 2026
36Monitor	CVE-2026-57145No exploit	PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validationmervinpraison · praisonai · CWE-22 Pre-auth Path traversal	Critical9.1	—	0.5%	Sep 14, 2026
34Monitor	CVE-2026-81301No exploit	Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file accessekia · file manager · CWE-926	High8.5	—	0.1%	Sep 14, 2026
37Monitor	CVE-2026-90943No exploit	parallax filament-comments through 3.0.0 Stored XSS via Comment Bodyparallax · filament-comments · CWE-79 XSS	Critical9.3	—	0.4%	Sep 14, 2026
33Monitor	CVE-2024-58383No exploit	Froxlor before 2.2.0 Insecure File Permissions mysql.conffroxlor · froxlor · CWE-732 Local privilege escalation	High8.4	—	0.1%	Sep 14, 2026
39Monitor	CVE-2026-20353No exploit	Cisco Secure Email Gateway Security Hardening Releasecisco · cisco secure email · CWE-664 Pre-auth	Critical9.8	—	0.5%	Sep 14, 2026
34Monitor	CVE-2026-55072No exploit	Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table namepimcore · pimcore · CWE-20 SQL injection	High8.5	—	0.4%	Sep 14, 2026
35Monitor	CVE-2026-55416No exploit	Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterizationpimcore · pimcore · CWE-89 SQL injection	High8.8	—	0.6%	Sep 14, 2026
39Monitor	CVE-2026-76440No exploit	Cisco Secure Email Gateway Security Hardening Releasecisco · cisco secure email · CWE-23 Pre-auth Path traversal	Critical9.8	—	0.6%	Sep 14, 2026
39Monitor	CVE-2026-76441No exploit	Cisco Secure Email Gateway Security Hardening Releasecisco · cisco secure email and web manager · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	Sep 14, 2026
30Monitor	CVE-2026-76442No exploit	Cisco Secure Email Gateway Security Hardening Releasecisco · cisco secure email · CWE-1284 Pre-auth Denial of service	High7.5	—	0.4%	Sep 14, 2026
60This week	CVE-2026-76443Weaponized	Cisco Secure Email Gateway Security Hardening Releasecisco · cisco secure email · CWE-707 Pre-auth	Critical9.8	—	2.3%	Sep 14, 2026
81Now	CVE-2026-76461Weaponized	Cisco Secure Email Gateway SQL Injection Vulnerabilitycisco · asyncos · CWE-89 pre-auth RCE SQL injection	Critical9.8	KEV	40.1%	Sep 14, 2026
34Monitor	CVE-2026-84445No exploit	gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS serversgrpc · grpc-go · CWE-129 Pre-auth	High8.7	—	0.6%	Sep 14, 2026
20Monitor	CVE-2026-90931Proof of concept	LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Uploadlaradashboard · laradashboard · CWE-79 XSS	Medium5.1	—	0.2%	Sep 14, 2026
34Monitor	CVE-2026-90932Proof of concept	LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCElaradashboard · laradashboard · CWE-73 RCE Path traversal	High8.6	—	0.8%	Sep 14, 2026
31Monitor	CVE-2026-90948No exploit	Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensionsred hat · red hat enterprise linux 6 · CWE-787 RCE Memory safety	High7.8	—	0.2%	Sep 14, 2026
31Monitor	CVE-2026-90949No exploit	Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatchred hat · red hat enterprise linux 6 · CWE-787 RCE Memory safety	High7.8	—	0.3%	Sep 14, 2026
30Monitor	CVE-2026-19499No exploit	Buffer overflow in strfmon and strfmon_l right-justification paddingthe gnu c library · glibc · CWE-122 Pre-auth Memory safety	High7.7	—	0.2%	Sep 14, 2026
30Monitor	CVE-2026-50276No exploit	dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSdatadog · dd-trace-rb · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Sep 14, 2026
31Monitor	CVE-2026-85892No exploit	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerabilitymicrosoft · edge chromium · CWE-362 Local privilege escalation Race condition	High7.8	—	0.2%	Sep 14, 2026
33Monitor	CVE-2026-86836No exploit	In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictaeclipse foundation · eclipse ankaios · CWE-276 Local privilege escalation	High8.4	—	0.1%	Sep 14, 2026
37Monitor	CVE-2026-90942No exploit	Casdoor through 4.4.0 Private Key Exposure via Certificate Endpointscasdoor · casdoor · CWE-863 Broken access control (IDOR)	Critical9.3	—	0.2%	Sep 14, 2026
35Monitor	CVE-2026-90944No exploit	Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parsekrayin · laravel-crm · CWE-306 Pre-auth Auth bypass	High8.8	—	0.6%	Sep 14, 2026
37Monitor	CVE-2026-90945No exploit	Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secretcrawlab-team · crawlab · CWE-321 Pre-auth Auth bypass Hard-coded credentials	Critical9.3	—	0.7%	Sep 14, 2026
34Monitor	CVE-2026-90946No exploit	DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocketasyncfuncai · deepwiki-open · CWE-73 Pre-auth Path traversal Hard-coded credentials	High8.7	—	0.5%	Sep 14, 2026
34Monitor	CVE-2026-91080No exploit	webhook through 2.8.3 Memory Exhaustion via Oversized Request Bodyadnanh · webhook · CWE-770 Pre-auth Denial of service	High8.7	—	0.6%	Sep 14, 2026
37Monitor	CVE-2026-12985No exploit	Mattermost DCR redirect URI allowlist bypass via improper URL component validationmattermost · mattermost server · CWE-601 Pre-auth Open redirect	Critical9.3	—	0.2%	Sep 14, 2026
30Monitor	CVE-2026-57129No exploit	PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversalmervinpraison · praisonaiagents · CWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Sep 14, 2026
28Monitor	CVE-2026-82035No exploit	PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branchpymupdf · pymupdf · CWE-22 Pre-auth Path traversal	High7.1	—	0.3%	Sep 14, 2026
35Monitor	CVE-2026-89023No exploit	ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST APIthemeatelier · domain for sale · CWE-862 Pre-auth Broken access control (IDOR)	High8.8	—	0.3%	Sep 14, 2026
30Monitor	CVE-2026-15955No exploit	IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file pathsibm · db2 · CWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Sep 14, 2026
31Monitor	CVE-2026-17133No exploit	IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEsibm · app connect enterprise · CWE-78 RCE Command injection	High7.8	—	0.2%	Sep 14, 2026
31Monitor	CVE-2026-17156No exploit	IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEsibm · app connect enterprise · CWE-502 RCE Deserialization	High7.8	—	0.3%	Sep 14, 2026
31Monitor	CVE-2026-17416No exploit	IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEsibm · app connect enterprise · CWE-502 RCE Deserialization	High7.8	—	0.3%	Sep 14, 2026
32Monitor	CVE-2026-17467No exploit	Vulnerabilities exists in IBM Cloud Pak for Data Systemibm · cloud pak for data system (yosemite 1.0) · CWE-327 Pre-auth Weak crypto	High8.2	—	0.2%	Sep 14, 2026
28Monitor	CVE-2026-18119No exploit	Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style valuesconcretecms · concrete cms · CWE-79 XSS	High7.0	—	0.4%	Sep 14, 2026
31Monitor	CVE-2026-19624No exploit	NetworkManager-l2tp: local privilege escalation via ipsec.conf injectionfedora · fedora · CWE-88 Local privilege escalation	High7.8	—	0.1%	Sep 14, 2026
28Monitor	CVE-2026-19816No exploit	PackageKit: dnf5 backend ignores SIMULATE on RepoRemovefedora · fedora · CWE-863 Local privilege escalation Broken access control (IDOR)	High7.1	—	0.1%	Sep 14, 2026
32Monitor	CVE-2026-65838No exploit	Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload zalando · skipper · CWE-754 Pre-auth	High8.2	—	0.4%	Sep 14, 2026
34Monitor	CVE-2026-82028No exploit	Magistrala < 1.0.0 SQL Injection via format Parameter in Reader APIabsmach · magistrala · CWE-89 RCE SQL injection	High8.7	—	0.5%	Sep 14, 2026
36Monitor	CVE-2026-61534No exploit	Yayson: Prototype pollution in the Store/LegacyStore deserializationconfetti · yayson · CWE-1321 Pre-auth Deserialization Prototype pollution	Critical9.1	—	0.8%	Sep 14, 2026
31Monitor	CVE-2026-90947No exploit	Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset filered hat · red hat enterprise linux 6 · CWE-787 RCE Memory safety	High7.8	—	0.1%	Sep 14, 2026
28Monitor	CVE-2026-13107No exploit	Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026ibm · business automation workflow containers and traditional · CWE-611 XXE	High7.1	—	0.3%	Sep 14, 2026
30Monitor	CVE-2026-13260No exploit	Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Accessibm · verify identity access · CWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Sep 14, 2026
28Monitor	CVE-2026-13275No exploit	IBM MQ Managed File Transfer is vulnerable to XML external entity injectionibm · mq · CWE-611 SSRF XXE	High7.1	—	0.3%	Sep 14, 2026
28Monitor	CVE-2026-13285No exploit	IBM MQ Managed File Transfer is vulnerable to XML external entity injectionibm · mq · CWE-611 XXE	High7.1	—	0.4%	Sep 14, 2026
28Monitor	CVE-2026-13287No exploit	IBM MQ Managed File Transfer is vulnerable to XML external entity injectionibm · mq · CWE-611 XXE	High7.1	—	0.4%	Sep 14, 2026
35Monitor	CVE-2026-13293No exploit	IBM MQ Java messaging is vulnerable to remote code executionibm · mq · CWE-502 RCE Deserialization	High8.8	—	0.8%	Sep 14, 2026
30Monitor	CVE-2026-19290No exploit	IBM Sterling File Gateway is Vulnerable to Improper Access Controlibm · sterling file gateway · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Sep 14, 2026
28Monitor	CVE-2026-20683No exploit	An authentication issue was addressed with improved state management.apple · ipados · CWE-287 Auth bypass	High7.1	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-28935No exploit	The issue was addressed with improved memory handling.apple · ipados · CWE-119 Pre-auth Memory safety	High7.5	—	0.4%	Sep 14, 2026
30Monitor	CVE-2026-28938No exploit	A privacy issue was addressed by moving sensitive data.apple · ipados · CWE-359 Pre-auth Info leak	High7.5	—	0.3%	Sep 14, 2026
30Monitor	CVE-2026-28960No exploit	A denial-of-service issue was addressed with improved validation.apple · ipados · CWE-20 Pre-auth Denial of service	High7.5	—	0.5%	Sep 14, 2026
22Monitor	CVE-2026-43664Proof of concept	This issue was addressed with improved data protection.apple · ipados · CWE-200 Info leak	Medium5.5	—	0.1%	Sep 14, 2026
28Monitor	CVE-2026-43683No exploit	An out-of-bounds read was addressed with improved bounds checking.apple · macos · CWE-125 Memory safety	High7.1	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-43684No exploit	A use-after-free issue was addressed with improved memory management.apple · ipados · CWE-416 Memory safety	High7.8	—	0.1%	Sep 14, 2026
35Monitor	CVE-2026-43686No exploit	A use-after-free issue was addressed with improved memory management.apple · ipados · CWE-416 Pre-auth Memory safety	High8.8	—	0.4%	Sep 14, 2026
26Monitor	CVE-2026-43687Proof of concept	The issue was addressed with improved memory handling.apple · ipados · CWE-200 Pre-auth Info leak	Medium6.5	—	0.4%	Sep 14, 2026
31Monitor	CVE-2026-43688No exploit	A memory corruption issue was addressed with improved input validation.apple · ipados · CWE-1021	High7.8	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-43689No exploit	A permissions issue was addressed with additional restrictions.apple · ipados · CWE-862 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.2%	Sep 14, 2026
31Monitor	CVE-2026-43691No exploit	A path handling issue was addressed with improved validation.apple · macos · CWE-22 Path traversal Local privilege escalation	High7.8	—	0.1%	Sep 14, 2026
35Monitor	CVE-2026-43692No exploit	A validation issue was addressed with improved input sanitization.apple · macos · CWE-20 pre-auth RCE	High8.8	—	0.8%	Sep 14, 2026
28Monitor	CVE-2026-43697No exploit	An out-of-bounds read was addressed with improved bounds checking.apple · macos · CWE-125 Memory safety	High7.1	—	0.3%	Sep 14, 2026
31Monitor	CVE-2026-43702No exploit	The issue was addressed with improved memory handling.apple · ipados · CWE-119 Memory safety	High7.8	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-43783Proof of concept	A race condition was addressed with improved locking.apple · macos · CWE-362 Local privilege escalation Race condition	High7.8	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-43786Proof of concept	This issue was addressed with additional entitlement checks.apple · macos · CWE-280 Local privilege escalation	High7.8	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-43789No exploit	An access issue was addressed with additional sandbox restrictions.apple · macos · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Sep 14, 2026
36Monitor	CVE-2026-43790No exploit	The issue was addressed with improved memory handling.apple · macos · CWE-787 Pre-auth Memory safety	Critical9.1	—	0.7%	Sep 14, 2026
35Monitor	CVE-2026-43815No exploit	A buffer overflow was addressed with improved bounds checking.apple · macos · CWE-787 Pre-auth Memory safety	High8.8	—	0.4%	Sep 14, 2026
31Monitor	CVE-2026-64701No exploit	A permissions issue was addressed with additional restrictions.apple · macos · CWE-280 Local privilege escalation	High7.8	—	0.1%	Sep 14, 2026

CVE-2026-15600
34Monitor
SQL Injection in Alior Bank raty PrestaShop module
HighCVSS 8.6No exploitEPSS 0%
- SQL injection
alior bank · ratySep 14, 2026
CVE-2026-25687
32Monitor
ZCC race condition in ZPA tunnel handler
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Race condition
zscaler · client connectorSep 14, 2026
CVE-2026-57115
26Monitor
PraisonAI: SpiderTools redirect-target SSRF protection bypass
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
- SSRF
mervinpraison · praisonaiSep 14, 2026
CVE-2026-57123
39Monitor
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
mervinpraison · praisonaiagentsSep 14, 2026
CVE-2026-57125
39Monitor
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
mervinpraison · praisonaiSep 14, 2026
CVE-2026-57126
34Monitor
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
HighCVSS 8.5No exploitEPSS 0%
- SSRF
mervinpraison · praisonaiSep 14, 2026
CVE-2026-8821
28Monitor
Playbooks run owner channel membership permission bypass
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
mattermost · mattermost serverSep 14, 2026
CVE-2026-57130
32Monitor
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
HighCVSS 8.1No exploitEPSS 0%
- RCE
- Command injection
mervinpraison · praisonaiagentsSep 14, 2026
CVE-2026-59569
32Monitor
Android ZCC VPN API method privilege escalation
HighCVSS 8.1No exploitEPSS 0%
- Local privilege escalation
zscaler · client connectorSep 14, 2026
CVE-2026-59570
30Monitor
Android ZCC denial of service
HighCVSS 7.5No exploitEPSS 0%
zscaler · client connectorSep 14, 2026
CVE-2026-7848
34Monitor
SQL Injection in Alior Bank raty PrestaShop module
HighCVSS 8.6No exploitEPSS 0%
- SQL injection
alior bank · ratySep 14, 2026
CVE-2026-82427
31Monitor
Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name
HighCVSS 7.8No exploitEPSS 0%
- Path traversal
apache software foundation · apache storm nimbusSep 14, 2026
CVE-2026-82428
35Monitor
Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys
HighCVSS 8.8No exploitEPSS 0%
- Path traversal
apache software foundation · apache storm clientSep 14, 2026
CVE-2026-82429
31Monitor
Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Race condition
apache software foundation · apache storm worker launcherSep 14, 2026
CVE-2026-82430
31Monitor
Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Race condition
apache software foundation · apache storm worker launcherSep 14, 2026
CVE-2026-82431
39Monitor
Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache software foundation · apache storm clientSep 14, 2026
CVE-2026-82432
32Monitor
Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
apache software foundation · apache storm nimbusSep 14, 2026
CVE-2026-82434
40Plan
Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Info leak
apache software foundation · apache storm nimbusSep 14, 2026
CVE-2026-82435
39Monitor
Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
apache software foundation · apache storm workerSep 14, 2026
CVE-2026-82438
32Monitor
Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins
HighCVSS 8.1No exploitEPSS 0%
apache software foundation · apache storm webappSep 14, 2026
GHSA-3g6h-r5qx-f6hq
30Monitor
Peer minimum ACK delay can panic quinn-proto when ACK_FREQUENCY transmission is enabled
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Sep 14, 2026
GHSA-ppcp-v39w-8jq2
30Monitor
Outgoing datagram buffer accounting can panic the sender in quinn-proto
HighCVSS 7.5No exploit
- Pre-auth
- Denial of service
Sep 14, 2026
CVE-2026-47701
30Monitor
OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
HighCVSS 7.7No exploitEPSS 0%
- Info leak
open-telemetry · opentelemetry-operatorSep 14, 2026
CVE-2026-56839
29Monitor
PraisonAI Code agent tools fail open without a workspace boundary
HighCVSS 7.3No exploitEPSS 0%
- Path traversal
mervinpraison · praisonaiSep 14, 2026
CVE-2026-57119
30Monitor
PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
mervinpraison · praisonaiSep 14, 2026
CVE-2026-57122
34Monitor
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
mervinpraison · praisonaiSep 14, 2026
CVE-2026-57124
39Monitor
PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Command injection
mervinpraison · praisonaiSep 14, 2026
CVE-2026-57127
39Monitor
praisonai: recipe serve auth middleware silently disables itself when no secret is set
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
mervinpraison · praisonaiSep 14, 2026
CVE-2026-57131
39Monitor
praisonai: Jobs API exposes agent-execution endpoints with no authentication
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
mervinpraison · praisonaiSep 14, 2026
CVE-2026-57132
32Monitor
PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
mervinpraison · praisonaiSep 14, 2026
CVE-2026-57145
36Monitor
PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
mervinpraison · praisonaiSep 14, 2026
CVE-2026-81301
34Monitor
Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access
HighCVSS 8.5No exploitEPSS 0%
ekia · file managerSep 14, 2026
CVE-2026-90943
37Monitor
parallax filament-comments through 3.0.0 Stored XSS via Comment Body
CriticalCVSS 9.3No exploitEPSS 0%
- XSS
parallax · filament-commentsSep 14, 2026
CVE-2024-58383
33Monitor
Froxlor before 2.2.0 Insecure File Permissions mysql.conf
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
froxlor · froxlorSep 14, 2026
CVE-2026-20353
39Monitor
Cisco Secure Email Gateway Security Hardening Release
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
cisco · cisco secure emailSep 14, 2026
CVE-2026-55072
34Monitor
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
pimcore · pimcoreSep 14, 2026
CVE-2026-55416
35Monitor
Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
pimcore · pimcoreSep 14, 2026
CVE-2026-76440
39Monitor
Cisco Secure Email Gateway Security Hardening Release
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Path traversal
cisco · cisco secure emailSep 14, 2026
CVE-2026-76441
39Monitor
Cisco Secure Email Gateway Security Hardening Release
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
cisco · cisco secure email and web managerSep 14, 2026
CVE-2026-76442
30Monitor
Cisco Secure Email Gateway Security Hardening Release
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
cisco · cisco secure emailSep 14, 2026
CVE-2026-76443
60This week
Cisco Secure Email Gateway Security Hardening Release
CriticalCVSS 9.8WeaponizedEPSS 2%
- Pre-auth
cisco · cisco secure emailSep 14, 2026
CVE-2026-76461
81Now
Cisco Secure Email Gateway SQL Injection Vulnerability
CriticalCVSS 9.8KEVWeaponizedEPSS 40%
- pre-auth RCE
- SQL injection
cisco · asyncosSep 14, 2026
CVE-2026-84445
34Monitor
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
grpc · grpc-goSep 14, 2026
CVE-2026-90931
20Monitor
LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload
MediumCVSS 5.1Proof of conceptEPSS 0%
- XSS
laradashboard · laradashboardSep 14, 2026
CVE-2026-90932
34Monitor
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE
HighCVSS 8.6Proof of conceptEPSS 0%
- RCE
- Path traversal
laradashboard · laradashboardSep 14, 2026
CVE-2026-90948
31Monitor
Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
red hat · red hat enterprise linux 6Sep 14, 2026
CVE-2026-90949
31Monitor
Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
red hat · red hat enterprise linux 6Sep 14, 2026
CVE-2026-19499
30Monitor
Buffer overflow in strfmon and strfmon_l right-justification padding
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Memory safety
the gnu c library · glibcSep 14, 2026
CVE-2026-50276
30Monitor
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
datadog · dd-trace-rbSep 14, 2026
CVE-2026-85892
31Monitor
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Race condition
microsoft · edge chromiumSep 14, 2026
CVE-2026-86836
33Monitor
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predicta
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
eclipse foundation · eclipse ankaiosSep 14, 2026
CVE-2026-90942
37Monitor
Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints
CriticalCVSS 9.3No exploitEPSS 0%
- Broken access control (IDOR)
casdoor · casdoorSep 14, 2026
CVE-2026-90944
35Monitor
Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
krayin · laravel-crmSep 14, 2026
CVE-2026-90945
37Monitor
Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
crawlab-team · crawlabSep 14, 2026
CVE-2026-90946
34Monitor
DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
- Hard-coded credentials
asyncfuncai · deepwiki-openSep 14, 2026
CVE-2026-91080
34Monitor
webhook through 2.8.3 Memory Exhaustion via Oversized Request Body
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
adnanh · webhookSep 14, 2026
CVE-2026-12985
37Monitor
Mattermost DCR redirect URI allowlist bypass via improper URL component validation
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Open redirect
mattermost · mattermost serverSep 14, 2026
CVE-2026-57129
30Monitor
PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
mervinpraison · praisonaiagentsSep 14, 2026
CVE-2026-82035
28Monitor
PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
pymupdf · pymupdfSep 14, 2026
CVE-2026-89023
35Monitor
ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
themeatelier · domain for saleSep 14, 2026
CVE-2026-15955
30Monitor
IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
ibm · db2Sep 14, 2026
CVE-2026-17133
31Monitor
IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
ibm · app connect enterpriseSep 14, 2026
CVE-2026-17156
31Monitor
IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Deserialization
ibm · app connect enterpriseSep 14, 2026
CVE-2026-17416
31Monitor
IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Deserialization
ibm · app connect enterpriseSep 14, 2026
CVE-2026-17467
32Monitor
Vulnerabilities exists in IBM Cloud Pak for Data System
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
ibm · cloud pak for data system (yosemite 1.0)Sep 14, 2026
CVE-2026-18119
28Monitor
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values
HighCVSS 7.0No exploitEPSS 0%
- XSS
concretecms · concrete cmsSep 14, 2026
CVE-2026-19624
31Monitor
NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
fedora · fedoraSep 14, 2026
CVE-2026-19816
28Monitor
PackageKit: dnf5 backend ignores SIMULATE on RepoRemove
HighCVSS 7.1No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
fedora · fedoraSep 14, 2026
CVE-2026-65838
32Monitor
Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
zalando · skipperSep 14, 2026
CVE-2026-82028
34Monitor
Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API
HighCVSS 8.7No exploitEPSS 0%
- RCE
- SQL injection
absmach · magistralaSep 14, 2026
CVE-2026-61534
36Monitor
Yayson: Prototype pollution in the Store/LegacyStore deserialization
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Deserialization
- Prototype pollution
confetti · yaysonSep 14, 2026
CVE-2026-90947
31Monitor
Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
red hat · red hat enterprise linux 6Sep 14, 2026
CVE-2026-13107
28Monitor
Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
HighCVSS 7.1No exploitEPSS 0%
- XXE
ibm · business automation workflow containers and traditionalSep 14, 2026
CVE-2026-13260
30Monitor
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · verify identity accessSep 14, 2026
CVE-2026-13275
28Monitor
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
HighCVSS 7.1No exploitEPSS 0%
- SSRF
- XXE
ibm · mqSep 14, 2026
CVE-2026-13285
28Monitor
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
HighCVSS 7.1No exploitEPSS 0%
- XXE
ibm · mqSep 14, 2026
CVE-2026-13287
28Monitor
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
HighCVSS 7.1No exploitEPSS 0%
- XXE
ibm · mqSep 14, 2026
CVE-2026-13293
35Monitor
IBM MQ Java messaging is vulnerable to remote code execution
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Deserialization
ibm · mqSep 14, 2026
CVE-2026-19290
30Monitor
IBM Sterling File Gateway is Vulnerable to Improper Access Control
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
ibm · sterling file gatewaySep 14, 2026
CVE-2026-20683
28Monitor
An authentication issue was addressed with improved state management.
HighCVSS 7.1No exploitEPSS 0%
- Auth bypass
apple · ipadosSep 14, 2026
CVE-2026-28935
30Monitor
The issue was addressed with improved memory handling.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-28938
30Monitor
A privacy issue was addressed by moving sensitive data.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
apple · ipadosSep 14, 2026
CVE-2026-28960
30Monitor
A denial-of-service issue was addressed with improved validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apple · ipadosSep 14, 2026
CVE-2026-43664
22Monitor
This issue was addressed with improved data protection.
MediumCVSS 5.5Proof of conceptEPSS 0%
- Info leak
apple · ipadosSep 14, 2026
CVE-2026-43683
28Monitor
An out-of-bounds read was addressed with improved bounds checking.
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
apple · macosSep 14, 2026
CVE-2026-43684
31Monitor
A use-after-free issue was addressed with improved memory management.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-43686
35Monitor
A use-after-free issue was addressed with improved memory management.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-43687
26Monitor
The issue was addressed with improved memory handling.
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Info leak
apple · ipadosSep 14, 2026
CVE-2026-43688
31Monitor
A memory corruption issue was addressed with improved input validation.
HighCVSS 7.8No exploitEPSS 0%
apple · ipadosSep 14, 2026
CVE-2026-43689
31Monitor
A permissions issue was addressed with additional restrictions.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
apple · ipadosSep 14, 2026
CVE-2026-43691
31Monitor
A path handling issue was addressed with improved validation.
HighCVSS 7.8No exploitEPSS 0%
- Path traversal
- Local privilege escalation
apple · macosSep 14, 2026
CVE-2026-43692
35Monitor
A validation issue was addressed with improved input sanitization.
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
apple · macosSep 14, 2026
CVE-2026-43697
28Monitor
An out-of-bounds read was addressed with improved bounds checking.
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
apple · macosSep 14, 2026
CVE-2026-43702
31Monitor
The issue was addressed with improved memory handling.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-43783
31Monitor
A race condition was addressed with improved locking.
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
- Race condition
apple · macosSep 14, 2026
CVE-2026-43786
31Monitor
This issue was addressed with additional entitlement checks.
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
apple · macosSep 14, 2026
CVE-2026-43789
30Monitor
An access issue was addressed with additional sandbox restrictions.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apple · macosSep 14, 2026
CVE-2026-43790
36Monitor
The issue was addressed with improved memory handling.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
apple · macosSep 14, 2026
CVE-2026-43815
35Monitor
A buffer overflow was addressed with improved bounds checking.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
apple · macosSep 14, 2026
CVE-2026-64701
31Monitor
A permissions issue was addressed with additional restrictions.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
apple · macosSep 14, 2026