Skip to content
Noroxi
By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 45 of 80

  • CVE-2026-73961
    39Monitor

    Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces).

    CriticalCVSS 9.8No exploitEPSS 0%

    oracle · jdeveloperSep 15, 2026

  • CVE-2026-76820
    30Monitor

    OpenCTI: Synchronizer SSRF: stream fetch has no URL validation

    HighCVSS 7.7No exploitEPSS 0%

    opencti-platform · openctiSep 15, 2026

  • CVE-2026-76821
    28Monitor

    OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper

    HighCVSS 7.1No exploitEPSS 0%

    opencti-platform · openctiSep 15, 2026

  • CVE-2026-82993
    34Monitor

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).

    HighCVSS 8.5No exploitEPSS 0%

    oracle · peoplesoft enterprise peopletoolsSep 15, 2026

  • CVE-2026-82994
    39Monitor

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).

    CriticalCVSS 9.8No exploitEPSS 0%

    oracle · platform security for javaSep 15, 2026

  • CVE-2026-82995
    39Monitor

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).

    CriticalCVSS 9.8No exploitEPSS 0%

    oracle · platform security for javaSep 15, 2026

  • CVE-2026-82996
    31Monitor

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).

    HighCVSS 7.8No exploitEPSS 0%

    oracle · platform security for javaSep 15, 2026

  • CVE-2026-82997
    39Monitor

    Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).

    CriticalCVSS 9.9No exploitEPSS 0%

    oracle · service delivery platformSep 15, 2026

  • CVE-2026-82998
    39Monitor

    Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).

    CriticalCVSS 9.9No exploitEPSS 0%

    oracle · service delivery platformSep 15, 2026

  • CVE-2026-82999
    39Monitor

    Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).

    CriticalCVSS 9.9No exploitEPSS 0%

    oracle · service delivery platformSep 15, 2026

  • CVE-2026-83000
    39Monitor

    Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).

    CriticalCVSS 9.8No exploitEPSS 0%

    oracle · service delivery platformSep 15, 2026

  • CVE-2026-83011
    32Monitor

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · platform security for javaSep 15, 2026

  • CVE-2026-83020
    40Plan

    Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars).

    CriticalCVSS 10.0No exploitEPSS 0%

    oracle · platform security for javaSep 15, 2026

  • CVE-2026-83029
    38Monitor

    Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server).

    CriticalCVSS 9.6No exploitEPSS 0%

    oracle · managed file transferSep 15, 2026

  • CVE-2026-83030
    33Monitor

    Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server).

    HighCVSS 8.3No exploitEPSS 0%

    oracle · managed file transferSep 15, 2026

  • CVE-2026-83038
    39Monitor

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink Integration).

    CriticalCVSS 9.9No exploitEPSS 0%

    oracle · weblogic serverSep 15, 2026

  • CVE-2026-83044
    28Monitor

    Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install).

    HighCVSS 7.1No exploitEPSS 0%

    oracle · xml gatewaySep 15, 2026

  • CVE-2026-83067
    32Monitor

    Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Shared Components).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · jdeveloperSep 15, 2026

  • CVE-2026-83083
    34Monitor

    Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).

    HighCVSS 8.5No exploitEPSS 0%

    oracle · marketingSep 15, 2026

  • CVE-2026-83084
    30Monitor

    Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).

    HighCVSS 7.7No exploitEPSS 0%

    oracle · marketingSep 15, 2026

  • CVE-2026-83088
    30Monitor

    Vulnerability in the RDBMS component of Oracle Database Server.

    HighCVSS 7.7No exploitEPSS 0%

    oracle · database serverSep 15, 2026

  • CVE-2026-83091
    30Monitor

    Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 7.6No exploitEPSS 0%

    oracle · field serviceSep 15, 2026

  • CVE-2026-83110
    30Monitor

    Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).

    HighCVSS 7.5No exploitEPSS 0%

    oracle · marketingSep 15, 2026

  • CVE-2026-83111
    28Monitor

    Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 7.1No exploitEPSS 0%

    oracle · partner managementSep 15, 2026

  • CVE-2026-83123
    28Monitor

    Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 7.1No exploitEPSS 0%

    oracle · report managerSep 15, 2026

  • CVE-2026-83127
    30Monitor

    Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 7.7No exploitEPSS 0%

    oracle · sales offlineSep 15, 2026

  • CVE-2026-83128
    30Monitor

    Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 7.5No exploitEPSS 0%

    oracle · sales offlineSep 15, 2026

  • CVE-2026-83129
    30Monitor

    Vulnerability in the Oracle Sales product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 7.7No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83130
    28Monitor

    Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 7.1No exploitEPSS 0%

    oracle · site hubSep 15, 2026

  • CVE-2026-83131
    30Monitor

    Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download).

    HighCVSS 7.7No exploitEPSS 0%

    oracle · web applications desktop integratorSep 15, 2026

  • CVE-2026-83133
    30Monitor

    Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart).

    HighCVSS 7.5No exploitEPSS 0%

    oracle · istoreSep 15, 2026

  • CVE-2026-83151
    39Monitor

    Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).

    CriticalCVSS 9.8No exploitEPSS 0%

    oracle · service delivery platformSep 15, 2026

  • CVE-2026-83232
    39Monitor

    Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer).

    CriticalCVSS 9.8No exploitEPSS 0%

    oracle · data integratorSep 15, 2026

  • CVE-2026-83283
    39Monitor

    Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).

    CriticalCVSS 9.8No exploitEPSS 0%

    oracle · business intelligenceSep 15, 2026

  • CVE-2026-83327
    39Monitor

    Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization).

    CriticalCVSS 9.8No exploitEPSS 0%

    oracle · applications frameworkSep 15, 2026

  • CVE-2026-83423
    35Monitor

    Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework).

    HighCVSS 8.8No exploitEPSS 0%

    oracle · jdeveloperSep 15, 2026

  • CVE-2026-83424
    30Monitor

    Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper).

    HighCVSS 7.5No exploitEPSS 0%

    oracle · jdeveloperSep 15, 2026

  • CVE-2026-83428
    32Monitor

    Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83429
    32Monitor

    Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83430
    32Monitor

    Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · product workbenchSep 15, 2026

  • CVE-2026-83432
    32Monitor

    Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83434
    32Monitor

    Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · product workbenchSep 15, 2026

  • CVE-2026-83435
    32Monitor

    Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.2No exploitEPSS 0%

    oracle · bills of materialSep 15, 2026

  • CVE-2026-83436
    28Monitor

    Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Recall Management).

    HighCVSS 7.1No exploitEPSS 0%

    oracle · depot repairSep 15, 2026

  • CVE-2026-83437
    30Monitor

    Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management).

    HighCVSS 7.7No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83438
    32Monitor

    Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.2No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83446
    32Monitor

    Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83447
    32Monitor

    Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · bills of materialSep 15, 2026

  • CVE-2026-83448
    32Monitor

    Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · bills of materialSep 15, 2026

  • CVE-2026-83449
    34Monitor

    Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.5No exploitEPSS 0%

    oracle · bills of materialSep 15, 2026

  • CVE-2026-83450
    32Monitor

    Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench).

    HighCVSS 8.0No exploitEPSS 0%

    oracle · bills of materialSep 15, 2026

  • CVE-2026-83451
    34Monitor

    Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.5No exploitEPSS 0%

    oracle · product workbenchSep 15, 2026

  • CVE-2026-83452
    39Monitor

    Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations).

    CriticalCVSS 9.8No exploitEPSS 0%

    oracle · document management and collaborationSep 15, 2026

  • CVE-2026-83453
    28Monitor

    Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 7.2No exploitEPSS 0%

    oracle · document management and collaborationSep 15, 2026

  • CVE-2026-83454
    35Monitor

    Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.8No exploitEPSS 0%

    oracle · document management and collaborationSep 15, 2026

  • CVE-2026-83455
    32Monitor

    Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83456
    35Monitor

    Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.8No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83457
    32Monitor

    Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83461
    32Monitor

    Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).

    HighCVSS 8.2No exploitEPSS 0%

    oracle · mobile application serverSep 15, 2026

  • CVE-2026-83462
    39Monitor

    Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).

    CriticalCVSS 9.8No exploitEPSS 0%

    oracle · mobile application serverSep 15, 2026

  • CVE-2026-83463
    30Monitor

    Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).

    HighCVSS 7.5No exploitEPSS 0%

    oracle · mobile application serverSep 15, 2026

  • CVE-2026-83464
    32Monitor

    Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · mobile application serverSep 15, 2026

  • CVE-2026-83465
    32Monitor

    Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server).

    HighCVSS 8.2No exploitEPSS 0%

    oracle · mobile application serverSep 15, 2026

  • CVE-2026-83477
    32Monitor

    Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Workbenches).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · work in processSep 15, 2026

  • CVE-2026-83479
    35Monitor

    Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.8No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83481
    28Monitor

    Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 7.2No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-83482
    28Monitor

    Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 7.2No exploitEPSS 0%

    oracle · e-business suiteSep 15, 2026

  • CVE-2026-87126
    28Monitor

    Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Reports Security).

    HighCVSS 7.1No exploitEPSS 0%

    oracle · report managerSep 15, 2026

  • CVE-2026-87150
    35Monitor

    Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench).

    HighCVSS 8.8No exploitEPSS 0%

    oracle · bills of materialSep 15, 2026

  • CVE-2026-87151
    30Monitor

    Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench).

    HighCVSS 7.7No exploitEPSS 0%

    oracle · bills of materialSep 15, 2026

  • CVE-2026-87152
    32Monitor

    Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · installed baseSep 15, 2026

  • CVE-2026-87157
    32Monitor

    Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · order management enterprise command centerSep 15, 2026

  • CVE-2026-87158
    28Monitor

    Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Enterprise Command Center).

    HighCVSS 7.1No exploitEPSS 0%

    oracle · order management enterprise command centerSep 15, 2026

  • CVE-2026-87159
    32Monitor

    Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.1No exploitEPSS 0%

    oracle · human resources management systemSep 15, 2026

  • CVE-2026-87160
    28Monitor

    Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 7.1No exploitEPSS 0%

    oracle · human resources management systemSep 15, 2026

  • CVE-2026-87161
    34Monitor

    Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations).

    HighCVSS 8.5No exploitEPSS 0%

    oracle · human resources management systemSep 15, 2026

  • CVE-2026-87264
    30Monitor

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).

    HighCVSS 7.7No exploitEPSS 0%

    oracle · peoplesoft enterprise peopletoolsSep 15, 2026

  • GHSA-5648-rgj9-v224
    32Monitor

    @zereight/mcp-gitlab has multiple safety-control bypasses: execute_graphql read-only + allow-list bypass, unauthenticated transports, session-exhaustion DoS

    HighCVSS 8.1No exploit

    npm · @zereight/mcp-gitlabSep 15, 2026

  • CVE-2026-54337
    39Monitor

    Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    shaneisrael · fireshareSep 15, 2026

  • CVE-2026-54544
    28Monitor

    Fireshare has unauthenticated SSRF via missing login_required on webhook test endpoints

    HighCVSS 7.2No exploitEPSS 0%

    shaneisrael · fireshareSep 15, 2026

  • CVE-2026-61554
    30Monitor

    emp3r0r has an unauthenticated HTTP Polling DoS

    HighCVSS 7.5No exploitEPSS 0%

    jm33-m0 · emp3r0rSep 15, 2026

  • CVE-2026-61559
    38Monitor

    @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery

    CriticalCVSS 9.6No exploitEPSS 0%

    zereight · gitlab-mcpSep 15, 2026

  • CVE-2026-61568
    38Monitor

    @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport

    CriticalCVSS 9.6No exploitEPSS 0%

    zereight · gitlab-mcpSep 15, 2026

  • CVE-2026-88065
    30Monitor

    `tts-be` application has a Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    niaefeup · tts-beSep 15, 2026

  • CVE-2026-61560
    40Plan

    @zereight/mcp-gitlab's unauthenticated arbitrary file read via `upload_markdown` enables PAT exfiltration and full account takeover

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    zereight · gitlab-mcpSep 15, 2026

  • CVE-2026-92248
    31Monitor

    Gimp: integer overflow when generating a thumbnail preview for a psd file

    HighCVSS 7.8No exploitEPSS 0%

    gnome · gimpSep 15, 2026

  • CVE-2026-92299
    28Monitor

    @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

    HighCVSS 7.1No exploitEPSS 0%

    jitsi · @jitsi/electron-sdkSep 15, 2026

  • CVE-2026-73450
    28Monitor

    Security Advisory 0161

    HighCVSS 7.0No exploitEPSS 0%

    arista networks · eosSep 15, 2026

  • CVE-2026-86108
    30Monitor

    Security Advisory 0181

    HighCVSS 7.5No exploitEPSS 0%

    arista networks · velocloud edgeSep 15, 2026

  • CVE-2026-86109
    30Monitor

    Security Advisory 0182

    HighCVSS 7.5No exploitEPSS 0%

    arista networks · velocloud edgeSep 15, 2026

  • CVE-2026-92247
    8Monitor

    synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload

    LowCVSS 2.0Proof of conceptEPSS 0%

    synaptikcms · synaptik-cmsSep 15, 2026

  • CVE-2026-85893
    35Monitor

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · edge chromiumSep 15, 2026

  • CVE-2026-12793
    39Monitor

    JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    jetmonsters · jetformbuilder — dynamic blocks form builderSep 16, 2026

  • CVE-2026-14349
    39Monitor

    TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action

    CriticalCVSS 9.8No exploitEPSS 0%

    themetechmount · truebooker – appointment booking and scheduler systemSep 16, 2026

  • CVE-2026-18595
    28Monitor

    WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request

    HighCVSS 7.2No exploitEPSS 0%

    wp-lab · wp-lister lite for ebaySep 16, 2026

  • CVE-2026-78088
    35Monitor

    Contest Gallery <= 32.0.1 - Unauthenticated Arbitrary File Upload via 'baseUrlForFacebook' Parameter

    HighCVSS 8.8No exploitEPSS 0%

    contest-gallery · contest gallery – upload & vote photos, media, sell with paypal & stripeSep 16, 2026

  • CVE-2026-89063
    30Monitor

    Online Scheduling and Appointment Booking System <= 28.1 - Insecure Direct Object Reference to Unauthenticated Sensitive Data Access and Message Injection via '

    HighCVSS 7.5Proof of conceptEPSS 1%

    ladela · online scheduling and appointment booking system – booklySep 16, 2026

  • CVE-2026-74926
    28Monitor

    MultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint

    HighCVSS 7.1No exploitEPSS 0%

    unknown · multivendorxSep 16, 2026

  • CVE-2026-76550
    28Monitor

    WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal

    HighCVSS 7.2No exploitEPSS 0%

    unknown · wp import export liteSep 16, 2026

  • CVE-2026-76551
    28Monitor

    WP Import Export Lite < 3.9.33 - Authenticated RCE via Export Field PHP Function

    HighCVSS 7.2No exploitEPSS 0%

    unknown · wp import export liteSep 16, 2026