Exploited and new serious CVEs: September 2026

In VPU, there is a possible out-of-bounds write due to a confused deputy.

• Local privilege escalation

google · androidSep 15, 2026

In multiple locations, there is a possible use-after-free due to a logic error in the code.

• Pre-auth
• Memory safety

google · androidSep 15, 2026

In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow.

• Memory safety

google · androidSep 15, 2026

In multiple locations, there is a possible permission bypass due to a missing permission check.

• Local privilege escalation

google · androidSep 15, 2026

In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds write due to improper input validation.

• RCE

google · androidSep 15, 2026

In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check.

• Local privilege escalation
• Memory safety

google · androidSep 15, 2026

In VPU, there is a possible permission bypass due to a missing permission check.

• Local privilege escalation

google · androidSep 15, 2026

In multiple files, there is a possible way to obtain signatures due to type confusion.

• Local privilege escalation

google · androidSep 15, 2026

In multiple files, there is a possible out-of-bounds read due to type confusion.

• Local privilege escalation

google · androidSep 15, 2026

In Av1DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check.

• Memory safety

google · androidSep 15, 2026

In Modem, there is a possible information disclosure due to improper input validation.

• Pre-auth

google · androidSep 15, 2026

In the Setup Wizard, there is a possible remote package install due to a missing permission check.

• Local privilege escalation

google · androidSep 15, 2026

In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check.

• Local privilege escalation
• Memory safety

google · androidSep 15, 2026

In Bootloader, there is a possible permission bypass due to a logic error in the code.

• Local privilege escalation

google · androidSep 15, 2026

In gf_ta_test_set_config of gf_ta_test.c, there is a possible heap buffer overflow due to a logic error in the code.

• Local privilege escalation
• Memory safety

google · androidSep 15, 2026

In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation.

• RCE

google · androidSep 15, 2026

In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper input validation.

• Local privilege escalation

google · androidSep 15, 2026

In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escalation of privilege due to a missing bounds check.

• Local privilege escalation
• Memory safety

google · androidSep 15, 2026

In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read due to an incorrect bounds check.

• Local privilege escalation
• Memory safety

google · androidSep 15, 2026

In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition.

• Local privilege escalation
• Race condition

google · androidSep 15, 2026

In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds write due to a missing bounds check.

• RCE
• Memory safety

google · androidSep 15, 2026

In multiple locations, there is a possible use-after-free due to a race condition.

• Local privilege escalation
• Race condition

google · androidSep 15, 2026

In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race condition.

• Local privilege escalation
• Race condition

google · androidSep 15, 2026

In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds write due to a race condition.

• Local privilege escalation
• Race condition

google · androidSep 15, 2026

In multiple locations, there is a possible escalation of privilege due to improper input validation.

• Local privilege escalation

google · androidSep 15, 2026

In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code.

• Local privilege escalation

google · androidSep 15, 2026

Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling)

• Pre-auth

http4s · http4sSep 15, 2026

Http4s: DigestAuth nonce map grows unbounded

• Pre-auth
• Denial of service

http4s · http4sSep 15, 2026

Http4s: WebSocket decoder accepts unbounded message sizes

• Pre-auth
• Denial of service

http4s · http4sSep 15, 2026

Http4s: FollowRedirect middleware leaks credentials over https->http same-authority redirect

• Pre-auth
• Info leak

http4s · http4sSep 15, 2026

Http4s Ember HTTP/2: unbounded outbound frame queue

• Pre-auth
• Denial of service

http4s · http4sSep 15, 2026

Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

• Pre-auth
• CSRF

j2commerce.com · j2store extension for joomlaSep 15, 2026

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce thei

Sep 15, 2026

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding o

Sep 15, 2026

Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

• Pre-auth
• SQL injection

j2commerce.com · j2store extension for joomlaSep 15, 2026

Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

• Pre-auth
• Path traversal
• CSRF

j2commerce.com · j2store extension for joomlaSep 15, 2026

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7

• Pre-auth

j2commerce.com · j2store extension for joomlaSep 15, 2026

pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability

• RCE
• Memory safety

pdfforge · pdf architectSep 15, 2026

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

• RCE
• Memory safety

pdfforge · pdf architectSep 15, 2026

pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability

• RCE
• Memory safety

pdfforge · pdf architectSep 15, 2026

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

• RCE
• Memory safety

pdfforge · pdf architectSep 15, 2026

pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

• Local privilege escalation

pdfforge · pdf architectSep 15, 2026

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positi

• Pre-auth
• Weak crypto

devolutions · serverSep 15, 2026

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

• Broken access control (IDOR)

arcadedata · arcadedbSep 15, 2026

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

• SSRF
• Path traversal

arcadedata · arcadedbSep 15, 2026

surfio IRAP header size fields cause out-of-bounds reads

• Pre-auth
• Memory safety

equinor · surfioSep 15, 2026

OpenTelemetry githubreceiver silently ignores configured required_headers authentication

• Pre-auth
• Broken access control (IDOR)

open-telemetry · opentelemetry-collector-contribSep 15, 2026

GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool

• Pre-auth
• SSRF

geonetwork · core-geonetworkSep 15, 2026

MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway

• RCE
• Local privilege escalation

docker · mcp-gatewaySep 15, 2026

@jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API `overrideAccess` Omission

• Broken access control (IDOR)

jhb-software · payload-pluginsSep 15, 2026

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary cod

• pre-auth RCE
• XSS

Sep 15, 2026

The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml

• Pre-auth
• Path traversal

Sep 15, 2026

mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi

• SSRF

agentfront · frontmcpSep 15, 2026

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

• RCE

arcadedata · arcadedbSep 15, 2026

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

• RCE
• Command injection

red hat · red hat hardened imagesSep 15, 2026

Http4s Ember HTTP/2: unbounded inbound body buffering

• Pre-auth
• Denial of service

http4s · http4sSep 15, 2026

Http4s Ember HTTP/2: does not enforce SETTINGS_MAX_CONCURRENT_STREAMS

• Pre-auth
• Denial of service

http4s · http4sSep 15, 2026

Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling)

• Pre-auth

http4s · http4sSep 15, 2026

Http4s: WebSocket decoder accepts negative length, causing infinite decode loop

• Pre-auth
• Denial of service

http4s · http4sSep 15, 2026

Http4s: Ember Server accepts duplicate Content-Length headers

• Pre-auth

http4s · http4sSep 15, 2026

Http4s Ember HTTP/2: unbounded continuation frame accumulation

• Pre-auth
• Denial of service

http4s · http4sSep 15, 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

• Pre-auth
• Auth bypass

oracle · weblogic serverSep 15, 2026

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

• Pre-auth
• Auth bypass

oracle · weblogic serverSep 15, 2026

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core).

• Pre-auth
• Auth bypass

oracle · identity managerSep 15, 2026

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core).

• Broken access control (IDOR)

oracle · identity managerSep 15, 2026

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core).

• Broken access control (IDOR)

oracle · identity managerSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Auth bypass

oracle · access managerSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Broken access control (IDOR)

oracle · access managerSep 15, 2026

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause t

• Pre-auth

arista networks · eosSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Broken access control (IDOR)

oracle · access managerSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Auth bypass

oracle · access managerSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Broken access control (IDOR)

oracle · access managerSep 15, 2026

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

• Broken access control (IDOR)

oracle · identity managerSep 15, 2026

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

• Broken access control (IDOR)

oracle · identity managerSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Auth bypass

oracle · access managerSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Broken access control (IDOR)

oracle · access managerSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Broken access control (IDOR)

oracle · access managerSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Auth bypass

oracle · access managerSep 15, 2026

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).

• Broken access control (IDOR)

oracle · webcenter portalSep 15, 2026

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services).

• Broken access control (IDOR)

oracle · webcenter portalSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Auth bypass

oracle · access managerSep 15, 2026

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services).

• Pre-auth
• Broken access control (IDOR)

oracle · webcenter portalSep 15, 2026

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services).

• Pre-auth
• Auth bypass

oracle · webcenter portalSep 15, 2026

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services).

• Pre-auth
• Auth bypass

oracle · webcenter portalSep 15, 2026

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).

• Pre-auth
• Auth bypass

oracle · webcenter portalSep 15, 2026

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services).

• Pre-auth
• Broken access control (IDOR)

oracle · webcenter portalSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Pre-auth
• Broken access control (IDOR)

oracle · access managerSep 15, 2026

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).

• Broken access control (IDOR)

oracle · webcenter portalSep 15, 2026

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

• Broken access control (IDOR)

oracle · access managerSep 15, 2026

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services).

• Pre-auth
• Auth bypass

oracle · webcenter portalSep 15, 2026

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).

• Broken access control (IDOR)

oracle corporation · siebel apps - marketingSep 15, 2026

FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC

• Race condition

freerdp · freerdpSep 15, 2026

Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator

hpe · edgeconnect operating systemSep 15, 2026

Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator

hpe · edgeconnect operating systemSep 15, 2026

Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator

• Info leak

arubanetworks · edgeconnect sd-wan orchestratorSep 15, 2026

Authentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN Orchestrator

• Pre-auth
• Auth bypass

arubanetworks · edgeconnect sd-wan orchestratorSep 15, 2026

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways

• pre-auth RCE
• Memory safety

hpe · edgeconnect operating systemSep 15, 2026

Authenticated Command Injection Vulnerability Leads to Privilege Escalation in EdgeConnect SD-WAN Gateways

• RCE
• Command injection

arubanetworks · edgeconnect sd-wan orchestratorSep 15, 2026

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in EdgeConnect SD-WAN Gateways

• pre-auth RCE
• Memory safety

arubanetworks · edgeconnect sd-wan orchestratorSep 15, 2026

Authorization Bypass Leading to Privilege Escalation in HPE Networking EdgeConnect SD-WAN Gateways

arubanetworks · edgeconnect sd-wan orchestratorSep 15, 2026