By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 44 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
34Monitor	CVE-2026-68070No exploit	Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineupsdigital watchdog · vmax a1 g4 dvr · CWE-306 Pre-auth Auth bypass	High8.7	—	0.4%	Sep 15, 2026
37Monitor	CVE-2026-68491No exploit	An insufficient check allowed for the overwrite of arbitrary files via a symlink.webpros · solusvm · CWE-59	Critical9.4	—	0.4%	Sep 15, 2026
34Monitor	CVE-2026-68950No exploit	Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineupsdigital watchdog · vmax a1 g4 dvr · CWE-798 Pre-auth Hard-coded credentials	High8.7	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-68953No exploit	Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineupsdigital watchdog · vmax a1 g4 dvr · CWE-306 Pre-auth Auth bypass	High7.1	—	0.5%	Sep 15, 2026
34Monitor	CVE-2026-79994No exploit	Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink racedocker · docker sandboxes · CWE-367 Race condition	High8.7	—	0.1%	Sep 15, 2026
35Monitor	CVE-2026-91709No exploit	Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.4%	Sep 15, 2026
38Monitor	CVE-2026-91710No exploit	Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sangoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-91711No exploit	Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the google · chrome · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 15, 2026
33Monitor	CVE-2026-91712No exploit	Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer prgoogle · chrome · CWE-367 pre-auth RCE Race condition	High8.3	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-91715No exploit	Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.3%	Sep 15, 2026
38Monitor	CVE-2026-91716No exploit	Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 15, 2026
38Monitor	CVE-2026-91718No exploit	Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 15, 2026
32Monitor	CVE-2026-91719No exploit	Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.google · chrome · CWE-94 pre-auth RCE	High8.1	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-91721No exploit	Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-91722No exploit	Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 15, 2026
33Monitor	CVE-2026-91724No exploit	Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.3%	Sep 15, 2026
32Monitor	CVE-2026-91727No exploit	Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised google · chrome · CWE-706 RCE	High8.1	—	0.1%	Sep 15, 2026
38Monitor	CVE-2026-91728No exploit	Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a google · chrome · CWE-190 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 15, 2026
38Monitor	CVE-2026-91729No exploit	Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to execgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-91731No exploit	Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandboxgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.4%	Sep 15, 2026
32Monitor	CVE-2026-91732No exploit	Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.1	—	0.2%	Sep 15, 2026
33Monitor	CVE-2026-91733No exploit	Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer processgoogle · chrome · CWE-754 Pre-auth	High8.3	—	0.3%	Sep 15, 2026
29Monitor	CVE-2026-91734No exploit	Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outgoogle · chrome · CWE-863 RCE Broken access control (IDOR)	High7.4	—	0.1%	Sep 15, 2026
33Monitor	CVE-2026-91735No exploit	Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process google · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.3	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-91736No exploit	Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-91737Proof of concept	Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 15, 2026
38Monitor	CVE-2026-91738No exploit	Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code ogoogle · chrome · CWE-20 pre-auth RCE	Critical9.6	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-91741No exploit	Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbogoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.4%	Sep 15, 2026
33Monitor	CVE-2026-91743No exploit	Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentigoogle · chrome · CWE-367 pre-auth RCE Race condition	High8.3	—	0.2%	Sep 15, 2026
35Monitor	CVE-2026-91745No exploit	Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 15, 2026
33Monitor	CVE-2026-91748No exploit	Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer prgoogle · chrome · CWE-367 pre-auth RCE Race condition	High8.3	—	0.2%	Sep 15, 2026
38Monitor	CVE-2026-91749No exploit	Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside thgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 15, 2026
37Monitor	CVE-2026-91939No exploit	Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parametercotonti · cotonti · CWE-502 Pre-auth Deserialization	Critical9.3	—	0.9%	Sep 15, 2026
34Monitor	CVE-2026-92000No exploit	adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Sizecthackers · adm-zip · CWE-409 Pre-auth	High8.7	—	0.6%	Sep 15, 2026
34Monitor	CVE-2026-18111No exploit	Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verificationconcretecms · concrete cms · CWE-306 Auth bypass XSS	High8.5	—	0.1%	Sep 15, 2026
36Monitor	CVE-2026-46488No exploit	motionEye: Authentication possible via password hashmotioneye-project · motioneye · CWE-256 Pre-auth	Critical9.1	—	0.4%	Sep 15, 2026
40Plan	CVE-2026-53710No exploit	MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_serveribm · mcp-context-forge · CWE-94 pre-auth RCE Auth bypass	Critical10.0	—	1.1%	Sep 15, 2026
30Monitor	CVE-2026-55149No exploit	Vouch Proxy: Unbounded Multipart Cookie Allocation DoSvouch · vouch-proxy · CWE-789 Pre-auth Denial of service	High7.5	—	0.7%	Sep 15, 2026
30Monitor	CVE-2026-55690No exploit	EmbedVideo Extension: Stored XSS via unsanitized service name in exception textstarcitizenwiki · mediawiki-extensions-embedvideo · CWE-79 Pre-auth XSS	High7.5	—	0.4%	Sep 15, 2026
34Monitor	CVE-2026-55691No exploit	EmbedVideo Extension : Stored XSS via unsanitized class passed to templatestarcitizenwiki · mediawiki-extensions-embedvideo · CWE-79 Pre-auth XSS	High8.6	—	0.4%	Sep 15, 2026
30Monitor	CVE-2026-55692No exploit	EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabledstarcitizenwiki · mediawiki-extensions-embedvideo · CWE-79 Pre-auth XSS	High7.5	—	0.4%	Sep 15, 2026
28Monitor	CVE-2026-58200No exploit	@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signingjhb-software · payload-plugins · CWE-347 Weak crypto	High7.1	—	0.3%	Sep 15, 2026
34Monitor	CVE-2026-58201No exploit	Lokka: Azure Resource Manager URL path validation issuemerill · lokka · CWE-918 Pre-auth SSRF	High8.7	—	0.4%	Sep 15, 2026
35Monitor	CVE-2026-59160No exploit	Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/runderyeger · yeger · CWE-306 Pre-auth Auth bypass CSRF	High8.8	—	0.4%	Sep 15, 2026
33Monitor	CVE-2026-63443No exploit	Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and writecoder · coder · CWE-863 Broken access control (IDOR)	High8.3	—	0.7%	Sep 15, 2026
29Monitor	CVE-2026-10144No exploit	Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handlingweb-infra-dev · rsbuild · CWE-78 RCE Command injection	High7.1	—	1.6%	Sep 15, 2026
37Monitor	CVE-2026-73807No exploit	mySCADA myPRO Manager Missing Authorizationmyscada technologies · myscada mypro · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.7%	Sep 15, 2026
34Monitor	CVE-2026-76852No exploit	Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_writenetcore · nr268 · CWE-354	High8.7	—	0.2%	Sep 15, 2026
28Monitor	CVE-2026-76853No exploit	Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cginetcore · nr268 · CWE-353	High7.2	—	0.2%	Sep 15, 2026
28Monitor	CVE-2026-76854No exploit	Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cginetcore · nr255-v · CWE-522 Info leak	High7.1	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-76855No exploit	Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpointsnetcore · nr255-v · CWE-359 Info leak	High7.1	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-76856No exploit	Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpointsnetcore · nr255-v · CWE-352 Pre-auth CSRF	High7.0	—	0.1%	Sep 15, 2026
28Monitor	CVE-2026-76857No exploit	Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cginetcore · nr255-v · CWE-522 Info leak	High7.1	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-76859No exploit	Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cginetcore · nr255-v · CWE-522 Info leak	High7.1	—	0.3%	Sep 15, 2026
34Monitor	CVE-2026-76860No exploit	Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake_up_set.cgi via MAC and ID Tokenizationnetcore · nr255-v · CWE-121 Memory safety	High8.7	—	0.5%	Sep 15, 2026
34Monitor	CVE-2026-76861No exploit	Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cginetcore · nr255-v · CWE-121 RCE Memory safety	High8.7	—	0.6%	Sep 15, 2026
34Monitor	CVE-2026-76862No exploit	Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Pathsnetcore · nr255-v · CWE-88 RCE	High8.7	—	0.5%	Sep 15, 2026
34Monitor	CVE-2026-76866No exploit	Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parametersnetcore · nr255-v · CWE-88 RCE	High8.6	—	0.5%	Sep 15, 2026
34Monitor	CVE-2026-76869No exploit	Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot_timer_set.cginetcore · nr255-v · CWE-121 Memory safety	High8.6	—	0.5%	Sep 15, 2026
28Monitor	CVE-2026-76870No exploit	Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd_write Firmware Upload Validationnetcore · nr255-v · CWE-125 Memory safety	High7.1	—	0.4%	Sep 15, 2026
28Monitor	CVE-2026-76871No exploit	Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlersnetcore · nr255-v · CWE-522 Info leak	High7.1	—	0.3%	Sep 15, 2026
38Monitor	CVE-2026-78225No exploit	Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Keywärtsilä · fos-onboard · CWE-321 Pre-auth Hard-coded credentials	Critical9.5	—	0.5%	Sep 15, 2026
37Monitor	CVE-2026-81855No exploit	Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Keywärtsilä · fos-onboard · CWE-321 Pre-auth Hard-coded credentials	Critical9.3	—	0.5%	Sep 15, 2026
32Monitor	CVE-2026-83357No exploit	Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler).oracle corporation · oracle graalvm for jdk, oracle graalvm · CWE-22 Pre-auth Path traversal	High8.1	—	0.4%	Sep 15, 2026
28Monitor	CVE-2026-83368No exploit	Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compileoracle corporation · oracle graalvm for jdk, oracle graalvm enterprise edition, oracle graalvm · CWE-284 Pre-auth Broken access control (IDOR)	High7.0	—	0.2%	Sep 15, 2026
32Monitor	CVE-2026-83408No exploit	Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler).oracle corporation · oracle graalvm for jdk, oracle graalvm · CWE-94 pre-auth RCE	High8.1	—	0.4%	Sep 15, 2026
28Monitor	CVE-2026-92256No exploit	Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlersnetcore · nr255-v · CWE-522 Info leak	High7.1	—	0.3%	Sep 15, 2026
30Monitor	CVE-2025-66974No exploit	An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a DenialCWE-20 Pre-auth Denial of service	High7.5	—	0.5%	Sep 15, 2026
30Monitor	CVE-2026-13210No exploit	Incorrect Authorization in GitLabgitlab · gitlab · CWE-863 Broken access control (IDOR)	High7.7	—	0.3%	Sep 15, 2026
35Monitor	CVE-2026-44300No exploit	OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injectionopencost · opencost · CWE-20 Pre-auth	High8.8	—	0.7%	Sep 15, 2026
39Monitor	CVE-2026-45579No exploit	DIRAC: RCE in RequestManager due to eval on untrusted inputdiracgrid · dirac · CWE-95 RCE	Critical9.9	—	0.8%	Sep 15, 2026
37Monitor	CVE-2026-53459No exploit	Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpointsmaziggy · bambuddy · CWE-636 Pre-auth Auth bypass	Critical9.3	—	0.7%	Sep 15, 2026
34Monitor	CVE-2026-54251No exploit	netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Servicenetty · netty-incubator-codec-ohttp · CWE-664 Pre-auth	High8.7	—	0.5%	Sep 15, 2026
29Monitor	CVE-2026-54547No exploit	Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Tokenpipeboard-co · meta-ads-mcp · CWE-287 Pre-auth Auth bypass	High7.4	—	0.5%	Sep 15, 2026
33Monitor	CVE-2026-54549No exploit	Meta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetchpipeboard-co · meta-ads-mcp · CWE-918 Pre-auth SSRF	High8.3	—	0.3%	Sep 15, 2026
32Monitor	CVE-2026-55225No exploit	Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`strimzi · strimzi-kafka-operator · CWE-269	High8.0	—	0.2%	Sep 15, 2026
32Monitor	CVE-2026-56825No exploit	Shopper: Missing authorization on product removal actions in CollectionProducts componentshopperlabs · shopper · CWE-862 Broken access control (IDOR)	High8.1	—	0.5%	Sep 15, 2026
32Monitor	CVE-2026-56827No exploit	Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/sshopperlabs · shopper · CWE-862 Broken access control (IDOR)	High8.1	—	0.5%	Sep 15, 2026
32Monitor	CVE-2026-56829No exploit	Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock componentshopperlabs · shopper · CWE-862 Broken access control (IDOR)	High8.1	—	0.5%	Sep 15, 2026
33Monitor	CVE-2026-57441No exploit	MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalencebitbonsai · mcpvault · CWE-41	High8.4	—	0.2%	Sep 15, 2026
30Monitor	CVE-2026-58483No exploit	mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`ihor-sokoliuk · mcp-searxng · CWE-400 Pre-auth Denial of service	High7.5	—	0.6%	Sep 15, 2026
28Monitor	CVE-2026-58485No exploit	mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`ihor-sokoliuk · mcp-searxng · CWE-918 SSRF	High7.1	—	0.1%	Sep 15, 2026
28Monitor	CVE-2026-58502No exploit	githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflowgouef · githubtoplanguages · CWE-78 RCE Command injection	High7.1	—	0.5%	Sep 15, 2026
39Monitor	CVE-2026-61667No exploit	DIRAC: RCE in FileCatalog DatasetManager via SQL injection + evaldiracgrid · dirac · CWE-89 RCE SQL injection	Critical9.9	—	1.2%	Sep 15, 2026
32Monitor	CVE-2026-61668No exploit	DIRAC: Pilot code downloaded over unverified HTTPS connectiondiracgrid · dirac · CWE-295 pre-auth RCE Weak crypto	High8.1	—	0.3%	Sep 15, 2026
30Monitor	CVE-2026-85234No exploit	Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap enginered hat · red hat enterprise linux 10 · CWE-125 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Sep 15, 2026
34Monitor	CVE-2026-88765No exploit	Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLabgitlab · gitlab · CWE-77 RCE Command injection	High8.5	—	0.6%	Sep 15, 2026
65This week	CVE-2026-58704Weaponized	In Cellular Modem, there is a possible permission bypass due to a logic error in the code.google · android · CWE-285 Pre-auth Broken access control (IDOR)	High8.8	KEV	0.6%	Sep 15, 2026
35Monitor	CVE-2026-69486No exploit	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerabilitymicrosoft · edge chromium · CWE-122 pre-auth RCE Memory safety	High8.8	—	0.8%	Sep 15, 2026
36Monitor	CVE-2026-15638No exploit	Cryptographic Padding Oracledelinea · secret server (on-prem) · CWE-327 Pre-auth Weak crypto	Critical9.1	—	0.2%	Sep 15, 2026
37Monitor	CVE-2026-15639No exploit	Reflected Cross-Site Scriptingdelinea · secret server (on-prem) · CWE-79 Pre-auth XSS	Critical9.3	—	0.4%	Sep 15, 2026
38Monitor	CVE-2026-15640No exploit	Authentication Bypass via SAML Response Manipulationdelinea · secret server (on-prem) · CWE-290 Pre-auth Auth bypass	Critical9.5	—	0.3%	Sep 15, 2026
28Monitor	CVE-2026-73446No exploit	Security Advisory 0160arista networks · eos · CWE-696 Pre-auth	High7.0	—	0.2%	Sep 15, 2026
28Monitor	CVE-2026-73459No exploit	Security Advisory 0160arista networks · eos · CWE-354 Pre-auth	High7.0	—	0.1%	Sep 15, 2026
28Monitor	CVE-2026-73460No exploit	Security Advisory 0160arista networks · eos · CWE-863 Pre-auth Broken access control (IDOR)	High7.0	—	0.1%	Sep 15, 2026
32Monitor	CVE-2026-61544No exploit	libp2p-quic: Remote panic via certificate expiry race during QUIC handshakelibp2p · rust-libp2p · CWE-248 Pre-auth	High8.2	—	0.2%	Sep 15, 2026
39Monitor	CVE-2026-70748No exploit	Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).oracle · weblogic server · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.5%	Sep 15, 2026
32Monitor	CVE-2026-73954No exploit	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).oracle · peoplesoft enterprise peopletools · CWE-284 Pre-auth Broken access control (IDOR)	High8.1	—	0.3%	Sep 15, 2026
29Monitor	CVE-2026-73955No exploit	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Charting).oracle · peoplesoft enterprise peopletools · CWE-284 Broken access control (IDOR)	High7.3	—	0.3%	Sep 15, 2026
30Monitor	CVE-2026-73960No exploit	Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Ren Server).oracle · peoplesoft enterprise peopletools · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Sep 15, 2026

CVE-2026-68070
34Monitor
Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
digital watchdog · vmax a1 g4 dvrSep 15, 2026
CVE-2026-68491
37Monitor
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
CriticalCVSS 9.4No exploitEPSS 0%
webpros · solusvmSep 15, 2026
CVE-2026-68950
34Monitor
Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
digital watchdog · vmax a1 g4 dvrSep 15, 2026
CVE-2026-68953
28Monitor
Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
digital watchdog · vmax a1 g4 dvrSep 15, 2026
CVE-2026-79994
34Monitor
Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race
HighCVSS 8.7No exploitEPSS 0%
- Race condition
docker · docker sandboxesSep 15, 2026
CVE-2026-91709
35Monitor
Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandb
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 15, 2026
CVE-2026-91710
38Monitor
Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the san
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91711
35Monitor
Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91712
33Monitor
Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer pr
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeSep 15, 2026
CVE-2026-91715
35Monitor
Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandb
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 15, 2026
CVE-2026-91716
38Monitor
Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91718
38Monitor
Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91719
32Monitor
Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 15, 2026
CVE-2026-91721
35Monitor
Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91722
35Monitor
Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91724
33Monitor
Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potent
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91727
32Monitor
Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised
HighCVSS 8.1No exploitEPSS 0%
- RCE
google · chromeSep 15, 2026
CVE-2026-91728
38Monitor
Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91729
38Monitor
Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to exec
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91731
35Monitor
Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 15, 2026
CVE-2026-91732
32Monitor
Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer proc
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 15, 2026
CVE-2026-91733
33Monitor
Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
google · chromeSep 15, 2026
CVE-2026-91734
29Monitor
Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code out
HighCVSS 7.4No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
google · chromeSep 15, 2026
CVE-2026-91735
33Monitor
Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeSep 15, 2026
CVE-2026-91736
35Monitor
Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a c
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91737
35Monitor
Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a c
HighCVSS 8.8Proof of conceptEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91738
38Monitor
Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code o
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 15, 2026
CVE-2026-91741
35Monitor
Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbo
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 15, 2026
CVE-2026-91743
33Monitor
Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potenti
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeSep 15, 2026
CVE-2026-91745
35Monitor
Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91748
33Monitor
Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer pr
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeSep 15, 2026
CVE-2026-91749
38Monitor
Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside th
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 15, 2026
CVE-2026-91939
37Monitor
Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Deserialization
cotonti · cotontiSep 15, 2026
CVE-2026-92000
34Monitor
adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
cthackers · adm-zipSep 15, 2026
CVE-2026-18111
34Monitor
Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification
HighCVSS 8.5No exploitEPSS 0%
- Auth bypass
- XSS
concretecms · concrete cmsSep 15, 2026
CVE-2026-46488
36Monitor
motionEye: Authentication possible via password hash
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
motioneye-project · motioneyeSep 15, 2026
CVE-2026-53710
40Plan
MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python_sandbox_server
CriticalCVSS 10.0No exploitEPSS 1%
- pre-auth RCE
- Auth bypass
ibm · mcp-context-forgeSep 15, 2026
CVE-2026-55149
30Monitor
Vouch Proxy: Unbounded Multipart Cookie Allocation DoS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
vouch · vouch-proxySep 15, 2026
CVE-2026-55690
30Monitor
EmbedVideo Extension: Stored XSS via unsanitized service name in exception text
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
starcitizenwiki · mediawiki-extensions-embedvideoSep 15, 2026
CVE-2026-55691
34Monitor
EmbedVideo Extension : Stored XSS via unsanitized class passed to template
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- XSS
starcitizenwiki · mediawiki-extensions-embedvideoSep 15, 2026
CVE-2026-55692
30Monitor
EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
starcitizenwiki · mediawiki-extensions-embedvideoSep 15, 2026
CVE-2026-58200
28Monitor
@jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing
HighCVSS 7.1No exploitEPSS 0%
- Weak crypto
jhb-software · payload-pluginsSep 15, 2026
CVE-2026-58201
34Monitor
Lokka: Azure Resource Manager URL path validation issue
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SSRF
merill · lokkaSep 15, 2026
CVE-2026-59160
35Monitor
Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
- CSRF
deryeger · yegerSep 15, 2026
CVE-2026-63443
33Monitor
Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
coder · coderSep 15, 2026
CVE-2026-10144
29Monitor
Rsbuild < 2.0.9 Command Injection via openBrowser() URL Handling
HighCVSS 7.1No exploitEPSS 1%
- RCE
- Command injection
web-infra-dev · rsbuildSep 15, 2026
CVE-2026-73807
37Monitor
mySCADA myPRO Manager Missing Authorization
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
myscada technologies · myscada myproSep 15, 2026
CVE-2026-76852
34Monitor
Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd_write
HighCVSS 8.7No exploitEPSS 0%
netcore · nr268Sep 15, 2026
CVE-2026-76853
28Monitor
Netcore NR268 1.7.121109 Security Check Bypass in parame_put_file.cgi
HighCVSS 7.2No exploitEPSS 0%
netcore · nr268Sep 15, 2026
CVE-2026-76854
28Monitor
Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7_web_auth_user_show.cgi
HighCVSS 7.1No exploitEPSS 0%
- Info leak
netcore · nr255-vSep 15, 2026
CVE-2026-76855
28Monitor
Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Info leak
netcore · nr255-vSep 15, 2026
CVE-2026-76856
28Monitor
Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- CSRF
netcore · nr255-vSep 15, 2026
CVE-2026-76857
28Monitor
Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns_wan_list_show.cgi
HighCVSS 7.1No exploitEPSS 0%
- Info leak
netcore · nr255-vSep 15, 2026
CVE-2026-76859
28Monitor
Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user_pass_show.cgi
HighCVSS 7.1No exploitEPSS 0%
- Info leak
netcore · nr255-vSep 15, 2026
CVE-2026-76860
34Monitor
Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake_up_set.cgi via MAC and ID Tokenization
HighCVSS 8.7No exploitEPSS 0%
- Memory safety
netcore · nr255-vSep 15, 2026
CVE-2026-76861
34Monitor
Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgi
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Memory safety
netcore · nr255-vSep 15, 2026
CVE-2026-76862
34Monitor
Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths
HighCVSS 8.7No exploitEPSS 0%
- RCE
netcore · nr255-vSep 15, 2026
CVE-2026-76866
34Monitor
Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters
HighCVSS 8.6No exploitEPSS 0%
- RCE
netcore · nr255-vSep 15, 2026
CVE-2026-76869
34Monitor
Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot_timer_set.cgi
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
netcore · nr255-vSep 15, 2026
CVE-2026-76870
28Monitor
Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd_write Firmware Upload Validation
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
netcore · nr255-vSep 15, 2026
CVE-2026-76871
28Monitor
Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers
HighCVSS 7.1No exploitEPSS 0%
- Info leak
netcore · nr255-vSep 15, 2026
CVE-2026-78225
38Monitor
Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key
CriticalCVSS 9.5No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
wärtsilä · fos-onboardSep 15, 2026
CVE-2026-81855
37Monitor
Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
wärtsilä · fos-onboardSep 15, 2026
CVE-2026-83357
32Monitor
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler).
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Path traversal
oracle corporation · oracle graalvm for jdk, oracle graalvmSep 15, 2026
CVE-2026-83368
28Monitor
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compile
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle corporation · oracle graalvm for jdk, oracle graalvm enterprise edition, oracle graalvmSep 15, 2026
CVE-2026-83408
32Monitor
Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler).
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
oracle corporation · oracle graalvm for jdk, oracle graalvmSep 15, 2026
CVE-2026-92256
28Monitor
Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd_config_show.cgi Read Handlers
HighCVSS 7.1No exploitEPSS 0%
- Info leak
netcore · nr255-vSep 15, 2026
CVE-2025-66974
30Monitor
An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Sep 15, 2026
CVE-2026-13210
30Monitor
Incorrect Authorization in GitLab
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
gitlab · gitlabSep 15, 2026
CVE-2026-44300
35Monitor
OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
opencost · opencostSep 15, 2026
CVE-2026-45579
39Monitor
DIRAC: RCE in RequestManager due to eval on untrusted input
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
diracgrid · diracSep 15, 2026
CVE-2026-53459
37Monitor
Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
maziggy · bambuddySep 15, 2026
CVE-2026-54251
34Monitor
netty-incubator-codec-ohttp: [OHttpServerCodec] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
netty · netty-incubator-codec-ohttpSep 15, 2026
CVE-2026-54547
29Monitor
Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
pipeboard-co · meta-ads-mcpSep 15, 2026
CVE-2026-54549
33Monitor
Meta Ads MCP: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- SSRF
pipeboard-co · meta-ads-mcpSep 15, 2026
CVE-2026-55225
32Monitor
Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`
HighCVSS 8.0No exploitEPSS 0%
strimzi · strimzi-kafka-operatorSep 15, 2026
CVE-2026-56825
32Monitor
Shopper: Missing authorization on product removal actions in CollectionProducts component
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
shopperlabs · shopperSep 15, 2026
CVE-2026-56827
32Monitor
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/s
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
shopperlabs · shopperSep 15, 2026
CVE-2026-56829
32Monitor
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
shopperlabs · shopperSep 15, 2026
CVE-2026-57441
33Monitor
MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence
HighCVSS 8.4No exploitEPSS 0%
bitbonsai · mcpvaultSep 15, 2026
CVE-2026-58483
30Monitor
mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ihor-sokoliuk · mcp-searxngSep 15, 2026
CVE-2026-58485
28Monitor
mcp-searxng: DNS-resolved Private Hostname SSRF in `web_url_read`
HighCVSS 7.1No exploitEPSS 0%
- SSRF
ihor-sokoliuk · mcp-searxngSep 15, 2026
CVE-2026-58502
28Monitor
githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow
HighCVSS 7.1No exploitEPSS 0%
- RCE
- Command injection
gouef · githubtoplanguagesSep 15, 2026
CVE-2026-61667
39Monitor
DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval
CriticalCVSS 9.9No exploitEPSS 1%
- RCE
- SQL injection
diracgrid · diracSep 15, 2026
CVE-2026-61668
32Monitor
DIRAC: Pilot code downloaded over unverified HTTPS connection
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Weak crypto
diracgrid · diracSep 15, 2026
CVE-2026-85234
30Monitor
Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
red hat · red hat enterprise linux 10Sep 15, 2026
CVE-2026-88765
34Monitor
Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
gitlab · gitlabSep 15, 2026
CVE-2026-58704
65This week
In Cellular Modem, there is a possible permission bypass due to a logic error in the code.
HighCVSS 8.8KEVWeaponizedEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · androidSep 15, 2026
CVE-2026-69486
35Monitor
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
microsoft · edge chromiumSep 15, 2026
CVE-2026-15638
36Monitor
Cryptographic Padding Oracle
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
delinea · secret server (on-prem)Sep 15, 2026
CVE-2026-15639
37Monitor
Reflected Cross-Site Scripting
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
delinea · secret server (on-prem)Sep 15, 2026
CVE-2026-15640
38Monitor
Authentication Bypass via SAML Response Manipulation
CriticalCVSS 9.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
delinea · secret server (on-prem)Sep 15, 2026
CVE-2026-73446
28Monitor
Security Advisory 0160
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
arista networks · eosSep 15, 2026
CVE-2026-73459
28Monitor
Security Advisory 0160
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
arista networks · eosSep 15, 2026
CVE-2026-73460
28Monitor
Security Advisory 0160
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
arista networks · eosSep 15, 2026
CVE-2026-61544
32Monitor
libp2p-quic: Remote panic via certificate expiry race during QUIC handshake
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
libp2p · rust-libp2pSep 15, 2026
CVE-2026-70748
39Monitor
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
oracle · weblogic serverSep 15, 2026
CVE-2026-73954
32Monitor
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
oracle · peoplesoft enterprise peopletoolsSep 15, 2026
CVE-2026-73955
29Monitor
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Charting).
HighCVSS 7.3No exploitEPSS 0%
- Broken access control (IDOR)
oracle · peoplesoft enterprise peopletoolsSep 15, 2026
CVE-2026-73960
30Monitor
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Ren Server).
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
oracle · peoplesoft enterprise peopletoolsSep 15, 2026