By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 36 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
36Monitor	CVE-2026-63696No exploit	Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability.dell · smartfabric os10 software · CWE-494	Critical9.1	—	0.3%	Sep 15, 2026
39Monitor	CVE-2026-79303Proof of concept	kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection.CWE-89 SQL injection	Critical9.9	—	0.4%	Sep 15, 2026
32Monitor	CVE-2026-79425No exploit	An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan iCWE-918 SSRF	High8.1	—	0.3%	Sep 15, 2026
30Monitor	CVE-2026-79551Proof of concept	Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.CWE-321 Pre-auth Hard-coded credentials	High7.5	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-88616No exploit	An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTasCWE-863 RCE Broken access control (IDOR)	High8.8	—	0.6%	Sep 15, 2026
39Monitor	CVE-2026-88617No exploit	SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint.CWE-863 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 15, 2026
34Monitor	CVE-2026-89025No exploit	Hirschmann HiOS Switch Platform DoS via Malformed HTTP Requestbelden · hirschmann hios switch platform · CWE-755 Pre-auth	High8.7	—	0.7%	Sep 15, 2026
28Monitor	CVE-2026-90650No exploit	MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'jetmonsters · motopress hotel booking · CWE-79 Pre-auth XSS	High7.2	—	0.4%	Sep 15, 2026
36Monitor	CVE-2023-54397No exploit	Tornado before 6.3.3 HTTP Request Smuggling via Content-Lengthtornadoweb · tornado · CWE-444 Pre-auth	Critical9.0	—	0.3%	Sep 15, 2026
36Monitor	CVE-2024-14029No exploit	Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encodingtornadoweb · tornado · CWE-444 Pre-auth	Critical9.0	—	0.3%	Sep 15, 2026
30Monitor	CVE-2026-19407No exploit	GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDKgoogle cloud · gemini enterprise agent platform sdk for python · CWE-330 pre-auth RCE Weak crypto	High7.7	—	0.6%	Sep 15, 2026
39Monitor	CVE-2026-37152No exploit	TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.CWE-798 Pre-auth Hard-coded credentials	Critical9.8	—	0.5%	Sep 15, 2026
36Monitor	CVE-2026-77866No exploit	SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hostsslab · safeurl · CWE-636 Pre-auth SSRF	Critical9.0	—	0.4%	Sep 15, 2026
36Monitor	CVE-2026-77972No exploit	safeurl validated address is not bound to the request, allowing DNS rebindingslab · safeurl · CWE-367 Pre-auth Race condition	Critical9.0	—	0.3%	Sep 15, 2026
34Monitor	CVE-2026-87791No exploit	Path traversal vulnerability in WordPress theme design-scuole-wordpress-themedevelopers italia · design-scuole-wordpress-theme · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Sep 15, 2026
34Monitor	CVE-2026-87792No exploit	Multiple authorization bypass in WordPress theme design-scuole-wordpress-themedevelopers italia · design-scuole-wordpress-theme · CWE-200 Pre-auth Info leak	High8.7	—	0.4%	Sep 15, 2026
32Monitor	CVE-2026-88619No exploit	1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module.CWE-862 Broken access control (IDOR)	High8.1	—	0.3%	Sep 15, 2026
8Monitor	CVE-2026-91849No exploit	WuzhiCMS Avatar Upload index.php setAvatar unrestricted uploadCWE-284 File upload Broken access control (IDOR)	Low2.1	—	0.3%	Sep 15, 2026
30Monitor	CVE-2026-91929No exploit	Flowise before 3.1.4 Cross-Tenant Authorization Bypassflowiseai · flowise · CWE-862 Broken access control (IDOR)	High7.6	—	0.3%	Sep 15, 2026
30Monitor	CVE-2026-91930No exploit	Flowise before 3.1.4 Cross-Tenant Organization Admin Takeoverflowiseai · flowise · CWE-266	High7.7	—	0.4%	Sep 15, 2026
36Monitor	CVE-2026-91931No exploit	Flowise before 3.1.4 Remote Code Execution via Custom MCP npxflowiseai · flowise · CWE-78 RCE Command injection	Critical9.0	—	0.6%	Sep 15, 2026
36Monitor	CVE-2026-91932No exploit	Flowise before 3.1.4 Remote Code Execution via cwd Parameterflowiseai · flowise · CWE-20 RCE	Critical9.0	—	0.7%	Sep 15, 2026
30Monitor	CVE-2026-91933No exploit	Flowise before 3.1.4 Authorization Bypass via openai-realtimeflowiseai · flowise · CWE-639 Broken access control (IDOR)	High7.6	—	0.3%	Sep 15, 2026
34Monitor	CVE-2026-91934No exploit	Flowise before 3.1.4 Remote Code Execution via SQL Database Chainflowiseai · flowise · CWE-22 RCE Path traversal XSS	High8.7	—	0.7%	Sep 15, 2026
34Monitor	CVE-2026-91935No exploit	Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodesflowiseai · flowise · CWE-918 SSRF	High8.7	—	0.3%	Sep 15, 2026
33Monitor	CVE-2026-91936No exploit	Flowise before 3.1.4 Script Injection via Docker Workflowsflowiseai · flowise · CWE-78 RCE Command injection	High8.3	—	0.4%	Sep 15, 2026
34Monitor	CVE-2026-91937No exploit	Flowise before 3.1.4 NoSQL Injection via sessionIdflowiseai · flowise · CWE-943 Pre-auth SQL injection	High8.7	—	0.4%	Sep 15, 2026
30Monitor	CVE-2026-91938No exploit	Flowise before 3.1.4 Server-Side Request Forgery via document loadersflowiseai · flowise · CWE-918 SSRF	High7.6	—	0.3%	Sep 15, 2026
34Monitor	CVE-2026-91940Proof of concept	crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategyunclecode · crawl4ai · CWE-22 Pre-auth Path traversal	High8.7	—	0.4%	Sep 15, 2026
34Monitor	CVE-2026-91941No exploit	Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategyunclecode · crawl4ai · CWE-400 Pre-auth Denial of service	High8.7	—	0.4%	Sep 15, 2026
33Monitor	CVE-2026-91943No exploit	Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategyunclecode · crawl4ai · CWE-918 SSRF	High8.3	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-91945No exploit	FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATRfreerdp · freerdp · CWE-125 Memory safety	High7.1	—	0.5%	Sep 15, 2026
28Monitor	CVE-2026-91946No exploit	FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphicsfreerdp · freerdp · CWE-908 Memory safety	High7.1	—	0.5%	Sep 15, 2026
30Monitor	CVE-2026-91948No exploit	FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOLfreerdp · freerdp · CWE-191 Memory safety	High7.7	—	0.5%	Sep 15, 2026
36Monitor	CVE-2026-91949No exploit	FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypassfreerdp · freerdp · CWE-693 Pre-auth	Critical9.2	—	0.5%	Sep 15, 2026
28Monitor	CVE-2026-91950No exploit	FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparoundfreerdp · freerdp · CWE-125 Pre-auth Memory safety	High7.1	—	0.4%	Sep 15, 2026
28Monitor	CVE-2026-91951No exploit	FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrcfreerdp · freerdp · CWE-617 Pre-auth	High7.1	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-91952No exploit	FreeRDP before 3.31.0 Denial of Service via pool_decode_rectfreerdp · freerdp · CWE-835 Pre-auth Denial of service	High7.1	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-91953No exploit	FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFOfreerdp · freerdp · CWE-120 Pre-auth Memory safety	High7.1	—	0.4%	Sep 15, 2026
28Monitor	CVE-2026-91954No exploit	FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodecfreerdp · freerdp · CWE-476 Pre-auth Memory safety	High7.1	—	0.3%	Sep 15, 2026
32Monitor	CVE-2026-91955No exploit	FreeRDP before 3.31.0 Denial of Service via Desktop Dimensionsfreerdp · freerdp · CWE-369 Pre-auth	High8.2	—	0.5%	Sep 15, 2026
28Monitor	CVE-2026-91956No exploit	FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRCfreerdp · freerdp · CWE-125 Pre-auth Memory safety	High7.1	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-91959No exploit	FreeRDP before 3.31.0 Buffer Over-read via RTS Gatewayfreerdp · freerdp · CWE-125 Pre-auth Memory safety	High7.1	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-91960No exploit	FreeRDP before 3.31.0 Integer Overflow Double Freefreerdp · freerdp · CWE-190 Pre-auth Memory safety	High7.1	—	0.4%	Sep 15, 2026
28Monitor	CVE-2026-91961No exploit	FreeRDP before 3.31.0 Denial of Service via URBDRCfreerdp · freerdp · CWE-617 Pre-auth	High7.1	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-91963No exploit	FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrcfreerdp · freerdp · CWE-457 pre-auth RCE	High7.1	—	0.6%	Sep 15, 2026
34Monitor	CVE-2026-91965No exploit	WWBN AVideo through 29.0 Broken Access Control via Live Endpointswwbn · avideo · CWE-200 Pre-auth Broken access control (IDOR) Info leak	High8.7	—	0.4%	Sep 15, 2026
28Monitor	CVE-2026-91968No exploit	vikunja before 2.6.0 Denial of Service via unbounded filter recursiongo-vikunja · vikunja · CWE-674 Denial of service	High7.1	—	0.4%	Sep 15, 2026
28Monitor	CVE-2026-91969No exploit	vikunja before 2.6.0 Resource Exhaustion via CSV Migrationgo-vikunja · vikunja · CWE-400 Denial of service	High7.1	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-91970No exploit	Vikunja before 2.6.0 Resource Exhaustion via Planka Migrationgo-vikunja · vikunja · CWE-770 Denial of service	High7.1	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-91971No exploit	Vikunja before 2.6.0 Denial of Service via Avatar Uploadgo-vikunja · vikunja · CWE-400 Denial of service	High7.1	—	0.4%	Sep 15, 2026
34Monitor	CVE-2026-91972No exploit	Vikunja before 2.6.0 Authentication Bypass via Unthrottled APIgo-vikunja · vikunja · CWE-307 Pre-auth Auth bypass	High8.7	—	0.6%	Sep 15, 2026
34Monitor	CVE-2026-91973No exploit	Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuthgo-vikunja · vikunja · CWE-307 Pre-auth Auth bypass	High8.7	—	0.6%	Sep 15, 2026
28Monitor	CVE-2026-91979No exploit	Vikunja before 2.6.0 Denial of Service via Decompression Bombgo-vikunja · vikunja · CWE-400 Denial of service	High7.1	—	0.4%	Sep 15, 2026
34Monitor	CVE-2026-91985No exploit	Vikunja before 2.6.0 Privilege Escalation via Link Share Hashgo-vikunja · vikunja · CWE-200 Pre-auth Info leak	High8.7	—	0.4%	Sep 15, 2026
28Monitor	CVE-2026-91987No exploit	atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Modeldep0we · atomic-agents-stack · CWE-770 Denial of service	High7.1	—	0.4%	Sep 15, 2026
36Monitor	CVE-2026-91988No exploit	atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCPdep0we · atomic-agents-stack · CWE-319 pre-auth RCE Weak crypto	Critical9.2	—	0.3%	Sep 15, 2026
34Monitor	CVE-2026-91989No exploit	atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.pydep0we · atomic-agents-stack · CWE-22 Pre-auth Path traversal	High8.7	—	1.3%	Sep 15, 2026
34Monitor	CVE-2026-91990No exploit	Tornado before 6.5.8 Memory Amplification DoS via multiparttornadoweb · tornado · CWE-770 Pre-auth Denial of service	High8.7	—	0.3%	Sep 15, 2026
32Monitor	CVE-2026-91992No exploit	Tornado before 6.5.7 Credential Leak via Handle Reusetornadoweb · tornado · CWE-200 Pre-auth Info leak	High8.2	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92006No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL componentmozilla · firefox · CWE-120 Pre-auth Memory safety	High8.8	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92007No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL componentmozilla · firefox · CWE-120 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92008No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL componentmozilla · firefox · CWE-120 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92009No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL componentmozilla · firefox · CWE-120 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92010No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL componentmozilla · firefox · CWE-120 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92011No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL componentmozilla · firefox · CWE-120 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92012No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL componentmozilla · firefox · CWE-120 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92013No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL componentmozilla · firefox · CWE-120 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92014No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics componentmozilla · firefox · CWE-120 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92015No exploit	Privilege escalation in the WebExtensions componentmozilla · firefox · CWE-269 Pre-auth	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92016No exploit	Use-after-free in the Disability Access APIs componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92017No exploit	Privilege escalation in the DOM: Service Workers componentmozilla · firefox · CWE-269 Pre-auth	High8.8	—	0.2%	Sep 15, 2026
38Monitor	CVE-2026-92018No exploit	Sandbox escape in the DOM: Core & HTML componentmozilla · firefox · CWE-693 Pre-auth	Critical9.6	—	0.3%	Sep 15, 2026
32Monitor	CVE-2026-92019No exploit	Mitigation bypass in the Remote Settings Client componentmozilla · firefox · CWE-693 Pre-auth	High8.1	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92020No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender componentmozilla · firefox · CWE-120 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92021No exploit	Use-after-free in the JavaScript Engine: JIT componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92022No exploit	Use-after-free in the DOM: HTML Parser componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92023No exploit	Use-after-free in the XML componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92024No exploit	Use-after-free in the SVG componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92025No exploit	Use-after-free in the DOM: Navigation componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92026No exploit	Use-after-free in the Networking componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92027No exploit	Use-after-free in the DOM: Streams componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92028No exploit	Use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92029No exploit	Use-after-free in the SVG componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 15, 2026
38Monitor	CVE-2026-92032No exploit	Sandbox escape due to invalid pointer in the Graphics componentmozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.6	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92033No exploit	Privilege escalation in Firefox for Androidmozilla · firefox mobile · CWE-269 Pre-auth	High8.8	—	0.3%	Sep 15, 2026
36Monitor	CVE-2026-92034No exploit	Site isolation issue in the Graphics componentmozilla · firefox · CWE-346 Pre-auth	Critical9.1	—	0.2%	Sep 15, 2026
38Monitor	CVE-2026-92035No exploit	Sandbox escape due to incorrect boundary conditions in the Graphics componentmozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.6	—	0.3%	Sep 15, 2026
39Monitor	CVE-2026-92036No exploit	Incorrect boundary conditions in the Networking: HTTP componentmozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.8	—	0.5%	Sep 15, 2026
39Monitor	CVE-2026-92037No exploit	Incorrect boundary conditions in the DOM: Animation componentmozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.8	—	0.5%	Sep 15, 2026
36Monitor	CVE-2026-92038No exploit	Mitigation bypass in the Remote Settings Client componentmozilla · firefox · CWE-693 Pre-auth	Critical9.1	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92040No exploit	Use-after-free in the JavaScript: WebAssembly componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.4%	Sep 15, 2026
36Monitor	CVE-2026-92041No exploit	Mitigation bypass in the DOM: Networking componentmozilla · firefox · CWE-693 Pre-auth	Critical9.1	—	0.3%	Sep 15, 2026
30Monitor	CVE-2026-92042No exploit	Race condition in the DOM: Content Processes componentmozilla · firefox · CWE-362 Pre-auth Race condition	High7.5	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92043No exploit	Privilege escalation due to incorrect boundary conditions in the Audio/Video componentmozilla · firefox · CWE-120 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
30Monitor	CVE-2026-92044No exploit	Information disclosure in the Networking: HTTP componentmozilla · firefox · CWE-200 Pre-auth Info leak	High7.5	—	0.3%	Sep 15, 2026
38Monitor	CVE-2026-92045No exploit	Sandbox escape due to incorrect boundary conditions in the WebRTC componentmozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.6	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-92046No exploit	Use-after-free in the Graphics componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-92047No exploit	Privilege escalation in the Crash Reporting componentmozilla · firefox · CWE-269 Pre-auth	High8.8	—	0.2%	Sep 15, 2026
36Monitor	CVE-2026-92048No exploit	Sandbox escape due to incorrect boundary conditions in the Widget: Win32 componentmozilla · firefox · CWE-119 Memory safety	Critical9.0	—	0.2%	Sep 15, 2026

CVE-2026-63696
36Monitor
Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability.
CriticalCVSS 9.1No exploitEPSS 0%
dell · smartfabric os10 softwareSep 15, 2026
CVE-2026-79303
39Monitor
kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection.
CriticalCVSS 9.9Proof of conceptEPSS 0%
- SQL injection
Sep 15, 2026
CVE-2026-79425
32Monitor
An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan i
HighCVSS 8.1No exploitEPSS 0%
- SSRF
Sep 15, 2026
CVE-2026-79551
30Monitor
Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Hard-coded credentials
Sep 15, 2026
CVE-2026-88616
35Monitor
An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTas
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
Sep 15, 2026
CVE-2026-88617
39Monitor
SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 15, 2026
CVE-2026-89025
34Monitor
Hirschmann HiOS Switch Platform DoS via Malformed HTTP Request
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
belden · hirschmann hios switch platformSep 15, 2026
CVE-2026-90650
28Monitor
MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
jetmonsters · motopress hotel bookingSep 15, 2026
CVE-2023-54397
36Monitor
Tornado before 6.3.3 HTTP Request Smuggling via Content-Length
CriticalCVSS 9.0No exploitEPSS 0%
- Pre-auth
tornadoweb · tornadoSep 15, 2026
CVE-2024-14029
36Monitor
Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
CriticalCVSS 9.0No exploitEPSS 0%
- Pre-auth
tornadoweb · tornadoSep 15, 2026
CVE-2026-19407
30Monitor
GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK
HighCVSS 7.7No exploitEPSS 0%
- pre-auth RCE
- Weak crypto
google cloud · gemini enterprise agent platform sdk for pythonSep 15, 2026
CVE-2026-37152
39Monitor
TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
Sep 15, 2026
CVE-2026-77866
36Monitor
SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts
CriticalCVSS 9.0No exploitEPSS 0%
- Pre-auth
- SSRF
slab · safeurlSep 15, 2026
CVE-2026-77972
36Monitor
safeurl validated address is not bound to the request, allowing DNS rebinding
CriticalCVSS 9.0No exploitEPSS 0%
- Pre-auth
- Race condition
slab · safeurlSep 15, 2026
CVE-2026-87791
34Monitor
Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
developers italia · design-scuole-wordpress-themeSep 15, 2026
CVE-2026-87792
34Monitor
Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Info leak
developers italia · design-scuole-wordpress-themeSep 15, 2026
CVE-2026-88619
32Monitor
1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module.
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
Sep 15, 2026
CVE-2026-91849
8Monitor
WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload
LowCVSS 2.1No exploitEPSS 0%
- File upload
- Broken access control (IDOR)
Sep 15, 2026
CVE-2026-91929
30Monitor
Flowise before 3.1.4 Cross-Tenant Authorization Bypass
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
flowiseai · flowiseSep 15, 2026
CVE-2026-91930
30Monitor
Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover
HighCVSS 7.7No exploitEPSS 0%
flowiseai · flowiseSep 15, 2026
CVE-2026-91931
36Monitor
Flowise before 3.1.4 Remote Code Execution via Custom MCP npx
CriticalCVSS 9.0No exploitEPSS 0%
- RCE
- Command injection
flowiseai · flowiseSep 15, 2026
CVE-2026-91932
36Monitor
Flowise before 3.1.4 Remote Code Execution via cwd Parameter
CriticalCVSS 9.0No exploitEPSS 0%
- RCE
flowiseai · flowiseSep 15, 2026
CVE-2026-91933
30Monitor
Flowise before 3.1.4 Authorization Bypass via openai-realtime
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
flowiseai · flowiseSep 15, 2026
CVE-2026-91934
34Monitor
Flowise before 3.1.4 Remote Code Execution via SQL Database Chain
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
- XSS
flowiseai · flowiseSep 15, 2026
CVE-2026-91935
34Monitor
Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes
HighCVSS 8.7No exploitEPSS 0%
- SSRF
flowiseai · flowiseSep 15, 2026
CVE-2026-91936
33Monitor
Flowise before 3.1.4 Script Injection via Docker Workflows
HighCVSS 8.3No exploitEPSS 0%
- RCE
- Command injection
flowiseai · flowiseSep 15, 2026
CVE-2026-91937
34Monitor
Flowise before 3.1.4 NoSQL Injection via sessionId
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SQL injection
flowiseai · flowiseSep 15, 2026
CVE-2026-91938
30Monitor
Flowise before 3.1.4 Server-Side Request Forgery via document loaders
HighCVSS 7.6No exploitEPSS 0%
- SSRF
flowiseai · flowiseSep 15, 2026
CVE-2026-91940
34Monitor
crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
unclecode · crawl4aiSep 15, 2026
CVE-2026-91941
34Monitor
Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
unclecode · crawl4aiSep 15, 2026
CVE-2026-91943
33Monitor
Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy
HighCVSS 8.3No exploitEPSS 0%
- SSRF
unclecode · crawl4aiSep 15, 2026
CVE-2026-91945
28Monitor
FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
freerdp · freerdpSep 15, 2026
CVE-2026-91946
28Monitor
FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
freerdp · freerdpSep 15, 2026
CVE-2026-91948
30Monitor
FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL
HighCVSS 7.7No exploitEPSS 0%
- Memory safety
freerdp · freerdpSep 15, 2026
CVE-2026-91949
36Monitor
FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
freerdp · freerdpSep 15, 2026
CVE-2026-91950
28Monitor
FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpSep 15, 2026
CVE-2026-91951
28Monitor
FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
freerdp · freerdpSep 15, 2026
CVE-2026-91952
28Monitor
FreeRDP before 3.31.0 Denial of Service via pool_decode_rect
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
freerdp · freerdpSep 15, 2026
CVE-2026-91953
28Monitor
FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpSep 15, 2026
CVE-2026-91954
28Monitor
FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpSep 15, 2026
CVE-2026-91955
32Monitor
FreeRDP before 3.31.0 Denial of Service via Desktop Dimensions
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
freerdp · freerdpSep 15, 2026
CVE-2026-91956
28Monitor
FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpSep 15, 2026
CVE-2026-91959
28Monitor
FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpSep 15, 2026
CVE-2026-91960
28Monitor
FreeRDP before 3.31.0 Integer Overflow Double Free
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
freerdp · freerdpSep 15, 2026
CVE-2026-91961
28Monitor
FreeRDP before 3.31.0 Denial of Service via URBDRC
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
freerdp · freerdpSep 15, 2026
CVE-2026-91963
28Monitor
FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc
HighCVSS 7.1No exploitEPSS 0%
- pre-auth RCE
freerdp · freerdpSep 15, 2026
CVE-2026-91965
34Monitor
WWBN AVideo through 29.0 Broken Access Control via Live Endpoints
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Info leak
wwbn · avideoSep 15, 2026
CVE-2026-91968
28Monitor
vikunja before 2.6.0 Denial of Service via unbounded filter recursion
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
go-vikunja · vikunjaSep 15, 2026
CVE-2026-91969
28Monitor
vikunja before 2.6.0 Resource Exhaustion via CSV Migration
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
go-vikunja · vikunjaSep 15, 2026
CVE-2026-91970
28Monitor
Vikunja before 2.6.0 Resource Exhaustion via Planka Migration
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
go-vikunja · vikunjaSep 15, 2026
CVE-2026-91971
28Monitor
Vikunja before 2.6.0 Denial of Service via Avatar Upload
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
go-vikunja · vikunjaSep 15, 2026
CVE-2026-91972
34Monitor
Vikunja before 2.6.0 Authentication Bypass via Unthrottled API
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
go-vikunja · vikunjaSep 15, 2026
CVE-2026-91973
34Monitor
Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
go-vikunja · vikunjaSep 15, 2026
CVE-2026-91979
28Monitor
Vikunja before 2.6.0 Denial of Service via Decompression Bomb
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
go-vikunja · vikunjaSep 15, 2026
CVE-2026-91985
34Monitor
Vikunja before 2.6.0 Privilege Escalation via Link Share Hash
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Info leak
go-vikunja · vikunjaSep 15, 2026
CVE-2026-91987
28Monitor
atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
dep0we · atomic-agents-stackSep 15, 2026
CVE-2026-91988
36Monitor
atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- Weak crypto
dep0we · atomic-agents-stackSep 15, 2026
CVE-2026-91989
34Monitor
atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py
HighCVSS 8.7No exploitEPSS 1%
- Pre-auth
- Path traversal
dep0we · atomic-agents-stackSep 15, 2026
CVE-2026-91990
34Monitor
Tornado before 6.5.8 Memory Amplification DoS via multipart
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
tornadoweb · tornadoSep 15, 2026
CVE-2026-91992
32Monitor
Tornado before 6.5.7 Credential Leak via Handle Reuse
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Info leak
tornadoweb · tornadoSep 15, 2026
CVE-2026-92006
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92007
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92008
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92009
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92010
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92011
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92012
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92013
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92014
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92015
35Monitor
Privilege escalation in the WebExtensions component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 15, 2026
CVE-2026-92016
35Monitor
Use-after-free in the Disability Access APIs component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92017
35Monitor
Privilege escalation in the DOM: Service Workers component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 15, 2026
CVE-2026-92018
38Monitor
Sandbox escape in the DOM: Core & HTML component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 15, 2026
CVE-2026-92019
32Monitor
Mitigation bypass in the Remote Settings Client component
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 15, 2026
CVE-2026-92020
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92021
35Monitor
Use-after-free in the JavaScript Engine: JIT component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92022
35Monitor
Use-after-free in the DOM: HTML Parser component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92023
35Monitor
Use-after-free in the XML component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92024
35Monitor
Use-after-free in the SVG component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92025
35Monitor
Use-after-free in the DOM: Navigation component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92026
35Monitor
Use-after-free in the Networking component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92027
35Monitor
Use-after-free in the DOM: Streams component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92028
35Monitor
Use-after-free in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92029
35Monitor
Use-after-free in the SVG component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92032
38Monitor
Sandbox escape due to invalid pointer in the Graphics component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92033
35Monitor
Privilege escalation in Firefox for Android
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefox mobileSep 15, 2026
CVE-2026-92034
36Monitor
Site isolation issue in the Graphics component
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 15, 2026
CVE-2026-92035
38Monitor
Sandbox escape due to incorrect boundary conditions in the Graphics component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92036
39Monitor
Incorrect boundary conditions in the Networking: HTTP component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92037
39Monitor
Incorrect boundary conditions in the DOM: Animation component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92038
36Monitor
Mitigation bypass in the Remote Settings Client component
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 15, 2026
CVE-2026-92040
35Monitor
Use-after-free in the JavaScript: WebAssembly component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92041
36Monitor
Mitigation bypass in the DOM: Networking component
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 15, 2026
CVE-2026-92042
30Monitor
Race condition in the DOM: Content Processes component
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Race condition
mozilla · firefoxSep 15, 2026
CVE-2026-92043
35Monitor
Privilege escalation due to incorrect boundary conditions in the Audio/Video component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92044
30Monitor
Information disclosure in the Networking: HTTP component
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
mozilla · firefoxSep 15, 2026
CVE-2026-92045
38Monitor
Sandbox escape due to incorrect boundary conditions in the WebRTC component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92046
35Monitor
Use-after-free in the Graphics component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 15, 2026
CVE-2026-92047
35Monitor
Privilege escalation in the Crash Reporting component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 15, 2026
CVE-2026-92048
36Monitor
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component
CriticalCVSS 9.0No exploitEPSS 0%
- Memory safety
mozilla · firefoxSep 15, 2026