By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 34 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
31Monitor	CVE-2026-64712No exploit	This issue was addressed with improved checks.apple · macos · CWE-284 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Sep 14, 2026
28Monitor	CVE-2026-64736No exploit	An out-of-bounds access issue was addressed with improved bounds checking.apple · ipados · CWE-125 Memory safety	High7.1	—	0.1%	Sep 14, 2026
29Monitor	CVE-2026-64752No exploit	A memory corruption issue was addressed by removing the vulnerable code.apple · ipados · CWE-787 RCE Memory safety	High7.3	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-64761No exploit	A privacy issue was addressed with improved handling of user preferences.apple · ipados · CWE-200 Pre-auth Info leak	High7.5	—	0.3%	Sep 14, 2026
31Monitor	CVE-2026-64790No exploit	A path handling issue was addressed with improved validation.apple · macos · CWE-22 Path traversal Local privilege escalation	High7.8	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-65342No exploit	A permissions issue was addressed with improved validation.apple · macos · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Sep 14, 2026
31Monitor	CVE-2026-65344No exploit	An out-of-bounds write issue was addressed with improved bounds checking.apple · ipados · CWE-787 Memory safety	High7.8	—	0.1%	Sep 14, 2026
32Monitor	CVE-2026-65354No exploit	A permissions issue was addressed with additional restrictions.apple · ipados · CWE-269 Local privilege escalation	High8.2	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-65357No exploit	The issue was addressed with improved memory handling.apple · ipados · CWE-120 Memory safety	High7.8	—	0.1%	Sep 14, 2026
28Monitor	CVE-2026-65359No exploit	An out-of-bounds read was addressed with improved bounds checking.apple · ipados · CWE-125 Memory safety	High7.1	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-65362No exploit	This issue was addressed with improved checks.apple · macos · CWE-284 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-65364No exploit	An out-of-bounds read was addressed with improved bounds checking.apple · macos · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.7%	Sep 14, 2026
35Monitor	CVE-2026-65374Proof of concept	A memory corruption issue was addressed with improved validation.apple · macos · CWE-787 Pre-auth Memory safety	High8.8	—	0.5%	Sep 14, 2026
30Monitor	CVE-2026-65375No exploit	The issue was addressed with improved authentication.apple · macos · CWE-287 Pre-auth Auth bypass Denial of service	High7.5	—	0.6%	Sep 14, 2026
30Monitor	CVE-2026-65378No exploit	An authorization issue was addressed with improved state management.apple · macos · CWE-863 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Sep 14, 2026
40Plan	CVE-2026-65381No exploit	A validation issue existed in the entitlement verification.apple · macos · CWE-862 Pre-auth Broken access control (IDOR)	Critical10.0	—	0.3%	Sep 14, 2026
35Monitor	CVE-2026-65390No exploit	An integer overflow was addressed with improved input validation.apple · safari · CWE-190 Pre-auth Memory safety	High8.8	—	0.4%	Sep 14, 2026
35Monitor	CVE-2026-65391No exploit	An out-of-bounds write issue was addressed with improved bounds checking.apple · safari · CWE-190 Pre-auth Memory safety	High8.8	—	0.4%	Sep 14, 2026
31Monitor	CVE-2026-65398No exploit	An out-of-bounds access issue was addressed with improved bounds checking.apple · ipados · CWE-120 Memory safety	High7.8	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-65410No exploit	The issue was addressed with improved checks.apple · ipados · CWE-248 Pre-auth	High7.5	—	0.4%	Sep 14, 2026
39Monitor	CVE-2026-65414No exploit	An out-of-bounds write issue was addressed with improved bounds checking.apple · ipados · CWE-787 pre-auth RCE Memory safety	Critical9.8	—	1.2%	Sep 14, 2026
32Monitor	CVE-2026-65415No exploit	A race condition was addressed with additional validation.apple · ipados · CWE-362 Pre-auth Race condition	High8.1	—	0.3%	Sep 14, 2026
37Monitor	CVE-2026-67399No exploit	Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.webpros · whmcs · CWE-502 pre-auth RCE Deserialization	Critical9.3	—	0.7%	Sep 14, 2026
34Monitor	CVE-2026-68489No exploit	Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to executwebpros · plesk extension "ruby" · CWE-96 RCE	High8.7	—	0.6%	Sep 14, 2026
28Monitor	CVE-2026-81901No exploit	Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpointconcretecms · concrete cms · CWE-862 Broken access control (IDOR) XSS	High7.2	—	0.3%	Sep 14, 2026
28Monitor	CVE-2026-81902No exploit	Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanupconcretecms · concrete cms · CWE-352 Pre-auth CSRF	High7.1	—	0.2%	Sep 14, 2026
28Monitor	CVE-2026-81903No exploit	Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container iconconcretecms · concrete cms · CWE-79 XSS	High7.0	—	0.3%	Sep 14, 2026
31Monitor	CVE-2026-84497No exploit	A buffer overflow was addressed with improved size validation.apple · ipados · CWE-120 Memory safety	High7.8	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-84505No exploit	An out-of-bounds write issue was addressed with improved bounds checking.apple · macos · CWE-787 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-84507No exploit	A race condition was addressed with improved state handling.apple · ipados · CWE-362 Race condition	High7.8	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-84511No exploit	An out-of-bounds write issue was addressed with improved bounds checking.apple · ipados · CWE-787 Memory safety	High7.8	—	0.1%	Sep 14, 2026
35Monitor	CVE-2026-84512No exploit	A buffer overflow was addressed with improved bounds checking.apple · macos · CWE-120 Pre-auth Memory safety	High8.8	—	0.4%	Sep 14, 2026
31Monitor	CVE-2026-84515No exploit	An out-of-bounds write issue was addressed with improved bounds checking.apple · macos · CWE-787 Memory safety	High7.8	—	0.1%	Sep 14, 2026
32Monitor	CVE-2026-84516No exploit	An out-of-bounds read was addressed with improved bounds checking.apple · macos · CWE-125 Pre-auth Memory safety	High8.1	—	0.4%	Sep 14, 2026
39Monitor	CVE-2026-84520Proof of concept	A buffer overflow was addressed with improved size validation.apple · macos · CWE-120 Pre-auth Memory safety	Critical9.8	—	0.4%	Sep 14, 2026
32Monitor	CVE-2026-84535No exploit	An authorization issue was addressed with improved state management.apple · macos · CWE-284 Broken access control (IDOR)	High8.2	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-84543Proof of concept	An out-of-bounds access issue was addressed with improved bounds checking.apple · macos · CWE-125 Pre-auth Memory safety	High7.5	—	0.4%	Sep 14, 2026
30Monitor	CVE-2026-84544No exploit	An integer overflow was addressed with improved input validation.apple · macos · CWE-190 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Sep 14, 2026
33Monitor	CVE-2026-84546No exploit	An out-of-bounds write issue was addressed with improved bounds checking.apple · ipados · CWE-787 Memory safety	High8.4	—	0.1%	Sep 14, 2026
28Monitor	CVE-2026-84548No exploit	An integer overflow was addressed with improved input validation.apple · macos · CWE-190 Memory safety	High7.1	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-84549No exploit	An out-of-bounds read was addressed with improved bounds checking.apple · macos · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Sep 14, 2026
30Monitor	CVE-2026-84553No exploit	A resource exhaustion issue was addressed with improved input validation.apple · macos · CWE-400 Pre-auth Denial of service	High7.5	—	0.6%	Sep 14, 2026
39Monitor	CVE-2026-84561No exploit	A double free issue was addressed with improved memory management.apple · ipados · CWE-415 Pre-auth Memory safety	Critical9.8	—	0.6%	Sep 14, 2026
30Monitor	CVE-2026-84563No exploit	A logic issue was addressed with improved checks.apple · macos · CWE-843 Pre-auth	High7.5	—	0.4%	Sep 14, 2026
28Monitor	CVE-2026-84565No exploit	An out-of-bounds read was addressed with improved bounds checking.apple · macos · CWE-125 Memory safety	High7.1	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-84566No exploit	The issue was addressed with improved memory handling.apple · ipados · CWE-119 Memory safety	High7.8	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-84568Proof of concept	A path traversal issue was addressed with improved path validation.apple · macos · CWE-22 RCE Path traversal Local privilege escalation	High7.8	—	0.1%	Sep 14, 2026
28Monitor	CVE-2026-84572No exploit	An out-of-bounds read was addressed with improved bounds checking.apple · macos · CWE-125 Memory safety	High7.1	—	0.1%	Sep 14, 2026
31Monitor	CVE-2026-84575No exploit	An out-of-bounds write issue was addressed with improved bounds checking.apple · ipados · CWE-787 Memory safety	High7.8	—	0.1%	Sep 14, 2026
32Monitor	CVE-2026-84577No exploit	An access issue was addressed with additional sandbox restrictions.apple · macos · CWE-120 Memory safety	High8.2	—	0.1%	Sep 14, 2026
35Monitor	CVE-2026-84578No exploit	A logic issue was addressed with improved checks.apple · macos · CWE-693	High8.8	—	0.1%	Sep 14, 2026
33Monitor	CVE-2026-84580No exploit	The issue was addressed with improved checks.apple · macos · CWE-862 Broken access control (IDOR)	High8.4	—	0.1%	Sep 14, 2026
33Monitor	CVE-2026-84581No exploit	A buffer overflow was addressed with improved bounds checking.apple · macos · CWE-120 Memory safety	High8.4	—	0.1%	Sep 14, 2026
33Monitor	CVE-2026-84584No exploit	This issue was addressed with improved handling of symlinks.apple · macos · CWE-59	High8.4	—	0.1%	Sep 14, 2026
22Monitor	CVE-2026-84589Proof of concept	A permissions issue was addressed with additional restrictions.apple · macos · CWE-863 Broken access control (IDOR)	Medium5.5	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-84598No exploit	A path traversal issue was addressed with improved path validation.apple · ipados · CWE-22 Pre-auth Path traversal	High7.5	—	0.4%	Sep 14, 2026
21Monitor	CVE-2026-84600Proof of concept	An authorization issue was addressed with improved state management.apple · ipados · CWE-285 Pre-auth Broken access control (IDOR)	Medium5.4	—	0.2%	Sep 14, 2026
30Monitor	CVE-2026-84606No exploit	A privacy issue was addressed with improved handling of identifiers.apple · ipados · CWE-287 Pre-auth Auth bypass	High7.5	—	0.4%	Sep 14, 2026
31Monitor	CVE-2026-84607No exploit	A race condition was addressed with improved state management.apple · ipados · CWE-362 RCE Local privilege escalation Race condition	High7.8	—	0.1%	Sep 14, 2026
39Monitor	CVE-2026-84609No exploit	A permissions issue was addressed with improved path validation.apple · ipados · CWE-120 Pre-auth Memory safety	Critical9.8	—	0.6%	Sep 14, 2026
29Monitor	CVE-2026-84611No exploit	An out-of-bounds write issue was addressed with improved bounds checking.apple · ipados · CWE-787 Memory safety	High7.3	—	0.1%	Sep 14, 2026
22Monitor	CVE-2026-84616Proof of concept	A type confusion issue was addressed with improved memory handling.apple · ipados · CWE-441 Denial of service	Medium5.5	—	0.1%	Sep 14, 2026
29Monitor	CVE-2026-84620No exploit	An integer overflow was addressed with improved input validation.apple · ipados · CWE-190 Memory safety	High7.3	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-84623No exploit	An authorization issue was addressed with improved state management.apple · ipados · CWE-287 Pre-auth Auth bypass	High7.5	—	0.3%	Sep 14, 2026
36Monitor	CVE-2026-84625No exploit	A permissions issue was addressed with additional sandbox restrictions.apple · ipados · CWE-200 Pre-auth Info leak	Critical9.1	—	0.4%	Sep 14, 2026
30Monitor	CVE-2026-84629No exploit	This issue was addressed with additional entitlement checks.apple · ipados · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Sep 14, 2026
31Monitor	CVE-2026-84631No exploit	This issue was addressed with additional entitlement checks.apple · macos · CWE-280 Local privilege escalation	High7.8	—	0.1%	Sep 14, 2026
29Monitor	CVE-2026-84632No exploit	The issue was addressed with improved memory handling.apple · ipados · CWE-120 Memory safety	High7.3	—	0.1%	Sep 14, 2026
22Monitor	CVE-2026-84636Proof of concept	An authorization issue was addressed with improved state management.apple · ipados · CWE-285 Broken access control (IDOR)	Medium5.5	—	0.2%	Sep 14, 2026
36Monitor	CVE-2026-86881Proof of concept	A certificate validation issue was addressed with improved certificate validation.apple · ipados · CWE-295 Pre-auth Weak crypto	Critical9.1	—	0.3%	Sep 14, 2026
30Monitor	CVE-2026-86894No exploit	A logic issue was addressed with improved checks.apple · macos · CWE-693 Pre-auth	High7.5	—	0.3%	Sep 14, 2026
30Monitor	CVE-2026-86895No exploit	An information disclosure issue was addressed with improved state management.apple · ipados · CWE-200 Pre-auth Info leak	High7.5	—	0.4%	Sep 14, 2026
28Monitor	CVE-2026-86901No exploit	An out-of-bounds write issue was addressed with improved bounds checking.apple · macos · CWE-787 Memory safety	High7.1	—	0.1%	Sep 14, 2026
30Monitor	CVE-2026-86904No exploit	A privacy issue was addressed with improved state management.apple · ipados · CWE-359 Pre-auth Info leak	High7.5	—	0.4%	Sep 14, 2026
31Monitor	CVE-2026-86917No exploit	A permissions issue was addressed with additional restrictions.apple · macos · CWE-280 Local privilege escalation	High7.8	—	0.1%	Sep 14, 2026
32Monitor	CVE-2026-90896No exploit	Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PIImarcoscamara01 · ecommerce template · CWE-306 Pre-auth Auth bypass	High8.2	—	0.7%	Sep 14, 2026
30Monitor	CVE-2026-54155No exploit	node-opcua: Missing nonce verification in UserNameIdentityToken authenticationnode-opcua · node-opcua · CWE-347 Pre-auth Weak crypto	High7.7	—	0.4%	Sep 14, 2026
30Monitor	CVE-2026-54156No exploit	node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoSnode-opcua · node-opcua · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Sep 14, 2026
33Monitor	CVE-2026-55451No exploit	gettext-converter: Prototype pollution in js2i18next() via crafted translation keyslocize · gettext-converter · CWE-1321 Pre-auth Prototype pollution	High8.3	—	0.5%	Sep 14, 2026
30Monitor	CVE-2026-57579No exploit	Alchemy: Unauthenticated nested page API leaks restricted & unpublished contentalchemycms · alchemy_cms · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.6%	Sep 14, 2026
30Monitor	CVE-2026-59960No exploit	Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/coreargos-ci · argos-javascript · CWE-78 RCE Command injection	High7.5	—	0.6%	Sep 14, 2026
35Monitor	CVE-2026-61701No exploit	Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Executioncesargb · laravel-magiclink · CWE-502 RCE SQL injection Deserialization	High8.8	—	0.7%	Sep 14, 2026
28Monitor	CVE-2026-12756No exploit	Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026ibm · business automation workflow containers and traditional · CWE-611 XXE	High7.1	—	0.4%	Sep 14, 2026
34Monitor	CVE-2026-91144No exploit	ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpointzfile-dev · zfile · CWE-639 Pre-auth Broken access control (IDOR)	High8.7	—	0.5%	Sep 14, 2026
28Monitor	CVE-2026-91145No exploit	Activiti through 7.1.0.M6 Expression Injection via Mail Taskactiviti · activiti · CWE-917 RCE	High7.1	—	0.4%	Sep 14, 2026
33Monitor	CVE-2026-34151Proof of concept	XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+xwiki · xwiki-platform · CWE-24 Pre-auth Path traversal	High8.2	—	2.4%	Sep 14, 2026
34Monitor	CVE-2026-49250No exploit	Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fieldsedmundhung · conform · CWE-407 Pre-auth	High8.7	—	0.5%	Sep 14, 2026
30Monitor	CVE-2026-50270No exploit	dd-trace-java: Improper parsing of W3C baggage headers may lead to DoSdatadog · dd-trace-java · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Sep 14, 2026
30Monitor	CVE-2026-53659No exploit	http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoShttp4k · http4k · CWE-409 Pre-auth Denial of service	High7.5	—	0.6%	Sep 14, 2026
30Monitor	CVE-2026-53752No exploit	docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Serviceplutext · docx4j · CWE-674 Pre-auth Denial of service	High7.5	—	0.6%	Sep 14, 2026
30Monitor	CVE-2026-54087No exploit	EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageFieldeasycorp · easyadminbundle · CWE-79 XSS CSRF	High7.6	—	0.4%	Sep 14, 2026
30Monitor	CVE-2026-54175No exploit	backpack/crud: Unverified password change in MyAccountController via mass assignmentlaravel-backpack · crud · CWE-620	High7.6	—	0.5%	Sep 14, 2026
32Monitor	CVE-2026-54178No exploit	backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisklaravel-backpack · crud · CWE-22 Path traversal	High8.1	—	0.5%	Sep 14, 2026
30Monitor	CVE-2026-54180No exploit	backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)laravel-backpack · crud · CWE-639 Broken access control (IDOR)	High7.6	—	0.4%	Sep 14, 2026
32Monitor	CVE-2026-54182No exploit	backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)laravel-backpack · crud · CWE-20 pre-auth RCE Command injection	High8.1	—	0.7%	Sep 14, 2026
30Monitor	CVE-2026-54567No exploit	Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)jugmac00 · flask-reuploaded · CWE-178	High7.5	—	0.6%	Sep 14, 2026
30Monitor	CVE-2026-55091No exploit	flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id keyjoaonuno · flat-to-nested-js · CWE-915 Pre-auth Prototype pollution	High7.5	—	0.4%	Sep 14, 2026
30Monitor	CVE-2026-55253No exploit	LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposurelangchain-ai · langchain-mongodb · CWE-943 SQL injection	High7.7	—	0.5%	Sep 14, 2026
32Monitor	CVE-2026-57577No exploit	DotVVM: ReDOS in routingriganti · dotvvm · CWE-1333 Pre-auth Denial of service	High8.2	—	0.5%	Sep 14, 2026
36Monitor	CVE-2026-57578No exploit	DotVVM: Missing authorization in AuthorizeActionFilterriganti · dotvvm · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.2	—	0.6%	Sep 14, 2026

CVE-2026-64712
31Monitor
This issue was addressed with improved checks.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
apple · macosSep 14, 2026
CVE-2026-64736
28Monitor
An out-of-bounds access issue was addressed with improved bounds checking.
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-64752
29Monitor
A memory corruption issue was addressed by removing the vulnerable code.
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-64761
30Monitor
A privacy issue was addressed with improved handling of user preferences.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
apple · ipadosSep 14, 2026
CVE-2026-64790
31Monitor
A path handling issue was addressed with improved validation.
HighCVSS 7.8No exploitEPSS 0%
- Path traversal
- Local privilege escalation
apple · macosSep 14, 2026
CVE-2026-65342
30Monitor
A permissions issue was addressed with improved validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apple · macosSep 14, 2026
CVE-2026-65344
31Monitor
An out-of-bounds write issue was addressed with improved bounds checking.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-65354
32Monitor
A permissions issue was addressed with additional restrictions.
HighCVSS 8.2No exploitEPSS 0%
- Local privilege escalation
apple · ipadosSep 14, 2026
CVE-2026-65357
31Monitor
The issue was addressed with improved memory handling.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-65359
28Monitor
An out-of-bounds read was addressed with improved bounds checking.
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-65362
31Monitor
This issue was addressed with improved checks.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
apple · macosSep 14, 2026
CVE-2026-65364
30Monitor
An out-of-bounds read was addressed with improved bounds checking.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apple · macosSep 14, 2026
CVE-2026-65374
35Monitor
A memory corruption issue was addressed with improved validation.
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
apple · macosSep 14, 2026
CVE-2026-65375
30Monitor
The issue was addressed with improved authentication.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Denial of service
apple · macosSep 14, 2026
CVE-2026-65378
30Monitor
An authorization issue was addressed with improved state management.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apple · macosSep 14, 2026
CVE-2026-65381
40Plan
A validation issue existed in the entitlement verification.
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apple · macosSep 14, 2026
CVE-2026-65390
35Monitor
An integer overflow was addressed with improved input validation.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
apple · safariSep 14, 2026
CVE-2026-65391
35Monitor
An out-of-bounds write issue was addressed with improved bounds checking.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
apple · safariSep 14, 2026
CVE-2026-65398
31Monitor
An out-of-bounds access issue was addressed with improved bounds checking.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-65410
30Monitor
The issue was addressed with improved checks.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apple · ipadosSep 14, 2026
CVE-2026-65414
39Monitor
An out-of-bounds write issue was addressed with improved bounds checking.
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-65415
32Monitor
A race condition was addressed with additional validation.
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Race condition
apple · ipadosSep 14, 2026
CVE-2026-67399
37Monitor
Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Deserialization
webpros · whmcsSep 14, 2026
CVE-2026-68489
34Monitor
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execut
HighCVSS 8.7No exploitEPSS 0%
- RCE
webpros · plesk extension "ruby"Sep 14, 2026
CVE-2026-81901
28Monitor
Concrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
- XSS
concretecms · concrete cmsSep 14, 2026
CVE-2026-81902
28Monitor
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to CSRF on Orphan Block Cleanup
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- CSRF
concretecms · concrete cmsSep 14, 2026
CVE-2026-81903
28Monitor
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon
HighCVSS 7.0No exploitEPSS 0%
- XSS
concretecms · concrete cmsSep 14, 2026
CVE-2026-84497
31Monitor
A buffer overflow was addressed with improved size validation.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-84505
31Monitor
An out-of-bounds write issue was addressed with improved bounds checking.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
apple · macosSep 14, 2026
CVE-2026-84507
31Monitor
A race condition was addressed with improved state handling.
HighCVSS 7.8No exploitEPSS 0%
- Race condition
apple · ipadosSep 14, 2026
CVE-2026-84511
31Monitor
An out-of-bounds write issue was addressed with improved bounds checking.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-84512
35Monitor
A buffer overflow was addressed with improved bounds checking.
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
apple · macosSep 14, 2026
CVE-2026-84515
31Monitor
An out-of-bounds write issue was addressed with improved bounds checking.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
apple · macosSep 14, 2026
CVE-2026-84516
32Monitor
An out-of-bounds read was addressed with improved bounds checking.
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Memory safety
apple · macosSep 14, 2026
CVE-2026-84520
39Monitor
A buffer overflow was addressed with improved size validation.
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
apple · macosSep 14, 2026
CVE-2026-84535
32Monitor
An authorization issue was addressed with improved state management.
HighCVSS 8.2No exploitEPSS 0%
- Broken access control (IDOR)
apple · macosSep 14, 2026
CVE-2026-84543
30Monitor
An out-of-bounds access issue was addressed with improved bounds checking.
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
apple · macosSep 14, 2026
CVE-2026-84544
30Monitor
An integer overflow was addressed with improved input validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apple · macosSep 14, 2026
CVE-2026-84546
33Monitor
An out-of-bounds write issue was addressed with improved bounds checking.
HighCVSS 8.4No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-84548
28Monitor
An integer overflow was addressed with improved input validation.
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
apple · macosSep 14, 2026
CVE-2026-84549
30Monitor
An out-of-bounds read was addressed with improved bounds checking.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
apple · macosSep 14, 2026
CVE-2026-84553
30Monitor
A resource exhaustion issue was addressed with improved input validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apple · macosSep 14, 2026
CVE-2026-84561
39Monitor
A double free issue was addressed with improved memory management.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-84563
30Monitor
A logic issue was addressed with improved checks.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apple · macosSep 14, 2026
CVE-2026-84565
28Monitor
An out-of-bounds read was addressed with improved bounds checking.
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
apple · macosSep 14, 2026
CVE-2026-84566
31Monitor
The issue was addressed with improved memory handling.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-84568
31Monitor
A path traversal issue was addressed with improved path validation.
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
- Path traversal
- Local privilege escalation
apple · macosSep 14, 2026
CVE-2026-84572
28Monitor
An out-of-bounds read was addressed with improved bounds checking.
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
apple · macosSep 14, 2026
CVE-2026-84575
31Monitor
An out-of-bounds write issue was addressed with improved bounds checking.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-84577
32Monitor
An access issue was addressed with additional sandbox restrictions.
HighCVSS 8.2No exploitEPSS 0%
- Memory safety
apple · macosSep 14, 2026
CVE-2026-84578
35Monitor
A logic issue was addressed with improved checks.
HighCVSS 8.8No exploitEPSS 0%
apple · macosSep 14, 2026
CVE-2026-84580
33Monitor
The issue was addressed with improved checks.
HighCVSS 8.4No exploitEPSS 0%
- Broken access control (IDOR)
apple · macosSep 14, 2026
CVE-2026-84581
33Monitor
A buffer overflow was addressed with improved bounds checking.
HighCVSS 8.4No exploitEPSS 0%
- Memory safety
apple · macosSep 14, 2026
CVE-2026-84584
33Monitor
This issue was addressed with improved handling of symlinks.
HighCVSS 8.4No exploitEPSS 0%
apple · macosSep 14, 2026
CVE-2026-84589
22Monitor
A permissions issue was addressed with additional restrictions.
MediumCVSS 5.5Proof of conceptEPSS 0%
- Broken access control (IDOR)
apple · macosSep 14, 2026
CVE-2026-84598
30Monitor
A path traversal issue was addressed with improved path validation.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
apple · ipadosSep 14, 2026
CVE-2026-84600
21Monitor
An authorization issue was addressed with improved state management.
MediumCVSS 5.4Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apple · ipadosSep 14, 2026
CVE-2026-84606
30Monitor
A privacy issue was addressed with improved handling of identifiers.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
apple · ipadosSep 14, 2026
CVE-2026-84607
31Monitor
A race condition was addressed with improved state management.
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Race condition
apple · ipadosSep 14, 2026
CVE-2026-84609
39Monitor
A permissions issue was addressed with improved path validation.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-84611
29Monitor
An out-of-bounds write issue was addressed with improved bounds checking.
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-84616
22Monitor
A type confusion issue was addressed with improved memory handling.
MediumCVSS 5.5Proof of conceptEPSS 0%
- Denial of service
apple · ipadosSep 14, 2026
CVE-2026-84620
29Monitor
An integer overflow was addressed with improved input validation.
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-84623
30Monitor
An authorization issue was addressed with improved state management.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
apple · ipadosSep 14, 2026
CVE-2026-84625
36Monitor
A permissions issue was addressed with additional sandbox restrictions.
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Info leak
apple · ipadosSep 14, 2026
CVE-2026-84629
30Monitor
This issue was addressed with additional entitlement checks.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apple · ipadosSep 14, 2026
CVE-2026-84631
31Monitor
This issue was addressed with additional entitlement checks.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
apple · macosSep 14, 2026
CVE-2026-84632
29Monitor
The issue was addressed with improved memory handling.
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
apple · ipadosSep 14, 2026
CVE-2026-84636
22Monitor
An authorization issue was addressed with improved state management.
MediumCVSS 5.5Proof of conceptEPSS 0%
- Broken access control (IDOR)
apple · ipadosSep 14, 2026
CVE-2026-86881
36Monitor
A certificate validation issue was addressed with improved certificate validation.
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
apple · ipadosSep 14, 2026
CVE-2026-86894
30Monitor
A logic issue was addressed with improved checks.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apple · macosSep 14, 2026
CVE-2026-86895
30Monitor
An information disclosure issue was addressed with improved state management.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
apple · ipadosSep 14, 2026
CVE-2026-86901
28Monitor
An out-of-bounds write issue was addressed with improved bounds checking.
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
apple · macosSep 14, 2026
CVE-2026-86904
30Monitor
A privacy issue was addressed with improved state management.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
apple · ipadosSep 14, 2026
CVE-2026-86917
31Monitor
A permissions issue was addressed with additional restrictions.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
apple · macosSep 14, 2026
CVE-2026-90896
32Monitor
Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
marcoscamara01 · ecommerce templateSep 14, 2026
CVE-2026-54155
30Monitor
node-opcua: Missing nonce verification in UserNameIdentityToken authentication
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
node-opcua · node-opcuaSep 14, 2026
CVE-2026-54156
30Monitor
node-opcua: Unbounded nonce cache enables unauthenticated heap exhaustion DoS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
node-opcua · node-opcuaSep 14, 2026
CVE-2026-55451
33Monitor
gettext-converter: Prototype pollution in js2i18next() via crafted translation keys
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Prototype pollution
locize · gettext-converterSep 14, 2026
CVE-2026-57579
30Monitor
Alchemy: Unauthenticated nested page API leaks restricted & unpublished content
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
alchemycms · alchemy_cmsSep 14, 2026
CVE-2026-59960
30Monitor
Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core
HighCVSS 7.5No exploitEPSS 0%
- RCE
- Command injection
argos-ci · argos-javascriptSep 14, 2026
CVE-2026-61701
35Monitor
Laravel MagicLink: Insecure Deserialization of MagicLink Actions Leads to Remote Code Execution
HighCVSS 8.8No exploitEPSS 0%
- RCE
- SQL injection
- Deserialization
cesargb · laravel-magiclinkSep 14, 2026
CVE-2026-12756
28Monitor
Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
HighCVSS 7.1No exploitEPSS 0%
- XXE
ibm · business automation workflow containers and traditionalSep 14, 2026
CVE-2026-91144
34Monitor
ZFile through 5.0.5 Share Entry Filter Bypass via Download Endpoint
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
zfile-dev · zfileSep 14, 2026
CVE-2026-91145
28Monitor
Activiti through 7.1.0.M6 Expression Injection via Mail Task
HighCVSS 7.1No exploitEPSS 0%
- RCE
activiti · activitiSep 14, 2026
CVE-2026-34151
33Monitor
XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+
HighCVSS 8.2Proof of conceptEPSS 2%
- Pre-auth
- Path traversal
xwiki · xwiki-platformSep 14, 2026
CVE-2026-49250
34Monitor
Conform: parseSubmission vulnerable to CPU exhaustion when parsing many unique form fields
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
edmundhung · conformSep 14, 2026
CVE-2026-50270
30Monitor
dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
datadog · dd-trace-javaSep 14, 2026
CVE-2026-53659
30Monitor
http4k: Unbounded gzip decompression in `ServerFilters.GZip` / `RequestFilters.GunZip` allowed memory-exhaustion DoS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
http4k · http4kSep 14, 2026
CVE-2026-53752
30Monitor
docx4j: Stack Overflow via Cyclic `w:basedOn` Style Chain leads to Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
plutext · docx4jSep 14, 2026
CVE-2026-54087
30Monitor
EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField
HighCVSS 7.6No exploitEPSS 0%
- XSS
- CSRF
easycorp · easyadminbundleSep 14, 2026
CVE-2026-54175
30Monitor
backpack/crud: Unverified password change in MyAccountController via mass assignment
HighCVSS 7.6No exploitEPSS 0%
laravel-backpack · crudSep 14, 2026
CVE-2026-54178
32Monitor
backpack/crud: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
laravel-backpack · crudSep 14, 2026
CVE-2026-54180
30Monitor
backpack/crud: CRUD panel query scopes are not enforced on Update, Delete, and Reorder (cross-tenant IDOR)
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
laravel-backpack · crudSep 14, 2026
CVE-2026-54182
32Monitor
backpack/crud: OS command injection in Stats::makeCurlRequest via attacker-controlled Host header (pre-auth)
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Command injection
laravel-backpack · crudSep 14, 2026
CVE-2026-54567
30Monitor
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
HighCVSS 7.5No exploitEPSS 0%
jugmac00 · flask-reuploadedSep 14, 2026
CVE-2026-55091
30Monitor
flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Prototype pollution
joaonuno · flat-to-nested-jsSep 14, 2026
CVE-2026-55253
30Monitor
LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
HighCVSS 7.7No exploitEPSS 0%
- SQL injection
langchain-ai · langchain-mongodbSep 14, 2026
CVE-2026-57577
32Monitor
DotVVM: ReDOS in routing
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
riganti · dotvvmSep 14, 2026
CVE-2026-57578
36Monitor
DotVVM: Missing authorization in AuthorizeActionFilter
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
riganti · dotvvmSep 14, 2026