By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 46 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-76552No exploit	WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Importunknown · wp import export lite · CWE-434 RCE File upload	High8.8	—	0.7%	Sep 16, 2026
27Monitor	CVE-2026-76555Proof of concept	WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversalunknown · wp import export lite · CWE-22 Path traversal	Medium6.8	—	0.4%	Sep 16, 2026
34Monitor	CVE-2026-78472No exploit	Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameterunknown · ni woocommerce sales report · CWE-89 Pre-auth SQL injection	High8.6	—	0.4%	Sep 16, 2026
35Monitor	CVE-2026-84829No exploit	Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameterunknown · optimole · CWE-79 Pre-auth XSS	High8.8	—	0.5%	Sep 16, 2026
32Monitor	CVE-2026-85530No exploit	GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatchunknown · givewp · CWE-269 Pre-auth	High8.1	—	0.3%	Sep 16, 2026
28Monitor	CVE-2026-85569No exploit	Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassificationunknown · tutor lms · CWE-269	High7.2	—	0.4%	Sep 16, 2026
28Monitor	CVE-2026-86444No exploit	LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameterunknown · learnpress · CWE-79 pre-auth RCE XSS	High7.1	—	0.2%	Sep 16, 2026
28Monitor	CVE-2026-19248No exploit	Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qtqt · qt · CWE-674 Pre-auth Denial of service	High7.1	—	0.4%	Sep 16, 2026
19Monitor	CVE-2026-19857No exploit	Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Tokenunknown · formidable forms · CWE-74 Pre-auth	Medium4.8	—	0.2%	Sep 16, 2026
30Monitor	CVE-2026-1168No exploit	Allocation of Resources Without Limits or Throttling in GitLabgitlab · gitlab · CWE-770 Pre-auth Denial of service	High7.5	—	0.6%	Sep 16, 2026
37Monitor	CVE-2026-73447No exploit	Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Requestarista networks · eos · CWE-78 RCE Command injection	Critical9.4	—	0.7%	Sep 16, 2026
34Monitor	CVE-2026-79708No exploit	Incorrect Authorization in GitLabgitlab · gitlab · CWE-863 Broken access control (IDOR)	High8.5	—	0.3%	Sep 16, 2026
39Monitor	CVE-2026-27546No exploit	Authentication Bypass in _account_logpepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-288 Pre-auth Auth bypass	Critical9.8	—	1.0%	Sep 16, 2026
36Monitor	CVE-2026-27547No exploit	Command Injection in /index.php/ajax/get_iodd_menu_infopepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High8.8	—	2.9%	Sep 16, 2026
36Monitor	CVE-2026-27548No exploit	Command Injection in /index.php/ajax/get_iodd_port_infopepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High8.8	—	2.9%	Sep 16, 2026
36Monitor	CVE-2026-27549No exploit	Command Injection in /index.php/attached_devices_tab/do_uploadpepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High8.8	—	2.9%	Sep 16, 2026
36Monitor	CVE-2026-27550No exploit	Command Injection in Field_Shadow_Password Classpepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High8.8	—	2.9%	Sep 16, 2026
36Monitor	CVE-2026-27551No exploit	Command Injection in /index.php/ajax/parameterManagepepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High8.8	—	2.9%	Sep 16, 2026
32Monitor	CVE-2026-27552No exploit	Unauthorized IODD File Upload due to Improper Authorizationpepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-863 Broken access control (IDOR)	High8.1	—	0.6%	Sep 16, 2026
36Monitor	CVE-2026-27554No exploit	Command Injection in /index.php/ajax/save_iodd_parameterspepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High8.8	—	2.9%	Sep 16, 2026
35Monitor	CVE-2026-27555No exploit	Local File Inclusion in /index.php/ajax/get_iodd_port_infopepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-98	High8.8	—	0.8%	Sep 16, 2026
35Monitor	CVE-2026-27556No exploit	Local File Inclusion in /index.php/ajax/save_iodd_parameterspepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-98	High8.8	—	0.8%	Sep 16, 2026
30Monitor	CVE-2026-27557No exploit	Path Traversal in /index.php/view_uploaded_iodd_filepepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-35 Pre-auth Path traversal	High7.5	—	0.7%	Sep 16, 2026
36Monitor	CVE-2026-27558No exploit	Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_filespepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High8.8	—	2.9%	Sep 16, 2026
36Monitor	CVE-2026-27559No exploit	Command Injection via GET in /api/status/datapepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High8.8	—	2.9%	Sep 16, 2026
29Monitor	CVE-2026-27560No exploit	Command Injection via DELETE in /api/status/datapepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High7.2	—	2.7%	Sep 16, 2026
29Monitor	CVE-2026-27561No exploit	Command Injection via GET in /api/iodd/configpepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High7.2	—	2.7%	Sep 16, 2026
29Monitor	CVE-2026-27562No exploit	Command Injection via PUT in /api/iodd/configpepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High7.2	—	2.7%	Sep 16, 2026
29Monitor	CVE-2026-27563No exploit	Command Injection via GET in /api/datastorage/datapepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High7.2	—	2.7%	Sep 16, 2026
29Monitor	CVE-2026-27564No exploit	Command Injection via PUT in /api/datastorage/datapepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 RCE Command injection	High7.2	—	2.7%	Sep 16, 2026
39Monitor	CVE-2026-27565No exploit	Remote code execution via uploading a malicious IODD filepepperl+fuchs · ice2-8iol1-g65l-v1d · CWE-78 pre-auth RCE Command injection	Critical9.8	—	0.9%	Sep 16, 2026
34Monitor	CVE-2026-84408No exploit	QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC whequalitysoft corporation · qnd premium · CWE-782 RCE	High8.7	—	0.6%	Sep 16, 2026
34Monitor	CVE-2026-88263No exploit	XikeStor Layer3 switches miss authentication for downloading configuration data.xikestor · sks8310-8x · CWE-306 Pre-auth Auth bypass	High8.7	—	0.5%	Sep 16, 2026
34Monitor	CVE-2026-92355No exploit	In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to octopus deploy · octopus server · CWE-22 RCE Path traversal	High8.7	—	0.6%	Sep 16, 2026
30Monitor	CVE-2026-73439No exploit	Security Advisory 0164arista networks · eos · CWE-842	High7.7	—	0.3%	Sep 16, 2026
34Monitor	CVE-2026-73454No exploit	Security Advisory 0165arista networks · eos · CWE-77 RCE Command injection	High8.6	—	0.3%	Sep 16, 2026
37Monitor	CVE-2026-73461No exploit	Security Advisory 0163arista networks · eos · CWE-266	Critical9.4	—	0.3%	Sep 16, 2026
34Monitor	CVE-2026-73464No exploit	Security Advisory 0166arista networks · eos · CWE-94 RCE	High8.7	—	0.6%	Sep 16, 2026
30Monitor	CVE-2026-80225No exploit	Possible degradation of service from continuous queries on the same TCP/DoT connectionnlnetlabs · unbound · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Sep 16, 2026
30Monitor	CVE-2026-81634No exploit	Possible heap buffer overflow during DNSSEC canonicalizationnlnetlabs · unbound · CWE-122 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Sep 16, 2026
36Monitor	CVE-2026-81642Proof of concept	Heap buffer overflow and possible Remote Code Execution when digesting DNSKEYnlnetlabs · unbound · CWE-122 pre-auth RCE Memory safety	Critical9.1	—	0.9%	Sep 16, 2026
39Monitor	CVE-2026-82311No exploit	Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always falseapache · apache-airflow-providers-fab · CWE-613 Pre-auth	Critical9.8	—	0.9%	Sep 16, 2026
33Monitor	CVE-2026-82717No exploit	CNAME synthesis could lead to heap corruptionnlnetlabs · unbound · CWE-122 pre-auth RCE Memory safety	High8.4	—	0.7%	Sep 16, 2026
30Monitor	CVE-2026-85501No exploit	Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSECnlnetlabs · unbound · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Sep 16, 2026
36Monitor	CVE-2026-86462No exploit	Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessionsapache · apache-airflow-providers-fab · CWE-613 Pre-auth	Critical9.1	—	0.8%	Sep 16, 2026
35Monitor	CVE-2026-89774No exploit	Bluetooth: SCO: hold sk properly in sco_conn_readylinux · linux Pre-auth	High8.8	—	0.4%	Sep 16, 2026
30Monitor	CVE-2026-14917No exploit	Kong API Gateway Enterprise: SAML Authentication bypasskong · kong enterprise gateway · CWE-288 Pre-auth Auth bypass	High7.7	—	0.8%	Sep 16, 2026
30Monitor	CVE-2026-59739No exploit	Apache ZooKeeper: Information disclosure via SetWatches reconnect replayapache · zookeeper · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.5%	Sep 16, 2026
30Monitor	CVE-2026-59969No exploit	Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS modeapache · zookeeper · CWE-297 Pre-auth Weak crypto	High7.5	—	0.3%	Sep 16, 2026
28Monitor	CVE-2026-73435No exploit	Security Advisory 0171arista networks · eos · CWE-345 Pre-auth	High7.0	—	0.1%	Sep 16, 2026
28Monitor	CVE-2026-73438No exploit	Security Advisory 0172arista networks · eos · CWE-617 Pre-auth	High7.0	—	0.2%	Sep 16, 2026
38Monitor	CVE-2026-73453No exploit	Security Advisory 0174arista networks · eos · CWE-94 pre-auth RCE	Critical9.5	—	0.6%	Sep 16, 2026
35Monitor	CVE-2026-73455No exploit	Security Advisory 0173arista networks · eos · CWE-130 Pre-auth	High8.9	—	0.4%	Sep 16, 2026
28Monitor	CVE-2026-73468No exploit	Security Advisory 0175arista networks · eos · CWE-670 Pre-auth	High7.1	—	0.2%	Sep 16, 2026
36Monitor	CVE-2026-76186No exploit	Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identityapache · apache-airflow-providers-keycloak · CWE-565 Pre-auth	Critical9.1	—	0.8%	Sep 16, 2026
39Monitor	CVE-2026-76187No exploit	Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWTapache · apache-airflow-providers-keycloak · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.9%	Sep 16, 2026
30Monitor	CVE-2026-79993No exploit	Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znodeapache · zookeeper · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.6%	Sep 16, 2026
28Monitor	CVE-2026-82310No exploit	Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT accessapache · apache-airflow-providers-fab · CWE-613	High7.2	—	1.0%	Sep 16, 2026
28Monitor	CVE-2026-85628No exploit	Cleartext Transmission of Sensitive Information in the Pairing Process vulnerabilityfermax electronica s.a.u. · duoxme · CWE-319 Pre-auth Weak crypto	High7.0	—	0.0%	Sep 16, 2026
32Monitor	CVE-2026-86466No exploit	Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validatedapache · apache-airflow-providers-fab · CWE-346	High8.1	—	0.3%	Sep 16, 2026
30Monitor	CVE-2026-86474No exploit	Improper Certificate Validation in the Firmware Download vulnerabilityfermax electronica s.a.u. · duox plus monitor firmware (veo wi-fi range) · CWE-295 Pre-auth Weak crypto	High7.7	—	0.1%	Sep 16, 2026
35Monitor	CVE-2026-86792No exploit	Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configurationapache · apache-airflow-providers-apache-kafka · CWE-470 RCE	High8.8	—	1.1%	Sep 16, 2026
30Monitor	CVE-2025-14871No exploit	Allocation of Resources Without Limits or Throttling in GitLabgitlab · gitlab · CWE-770 Pre-auth Denial of service	High7.5	—	0.6%	Sep 16, 2026
30Monitor	CVE-2026-14916No exploit	Kong API Gateway Enterprise: JWT Algorithm-Confusionkong · kong enteprise gateway · CWE-241 Pre-auth Auth bypass	High7.7	—	0.6%	Sep 16, 2026
34Monitor	CVE-2026-86106No exploit	Security Advisory 0179arista networks · velocloud edge · CWE-306 pre-auth RCE Auth bypass	High8.7	—	0.3%	Sep 16, 2026
32Monitor	CVE-2026-86107No exploit	Security Advisory 0180arista networks · velocloud · CWE-787 Pre-auth Memory safety	High8.2	—	0.3%	Sep 16, 2026
30Monitor	CVE-2026-86585No exploit	Improper Verification of the Firmware Signature vulnerabilityfermax electronica s.a.u. · duox plus monitor firmware (veo wi-fi range) · CWE-347 Pre-auth Weak crypto	High7.7	—	0.1%	Sep 16, 2026
35Monitor	CVE-2026-8462No exploit	OpenMeter SQL Injection in ClickHouse-backed Meter Definitionsopenmeter · openmeter · CWE-89 Pre-auth SQL injection	High8.9	—	0.5%	Sep 16, 2026
28Monitor	CVE-2026-92456No exploit	yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpointsguchengwuyue · yshop-crm · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Sep 16, 2026
28Monitor	CVE-2026-92457No exploit	yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoiceguchengwuyue · yshop-crm · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Sep 16, 2026
28Monitor	CVE-2026-92459No exploit	yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpointguchengwuyue · yshop-crm · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Sep 16, 2026
28Monitor	CVE-2026-92460No exploit	yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listingguchengwuyue · yshop-crm · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Sep 16, 2026
28Monitor	CVE-2026-92462No exploit	yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStepguchengwuyue · yshop-crm · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Sep 16, 2026
28Monitor	CVE-2026-92463No exploit	yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listingguchengwuyue · yshop-crm · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Sep 16, 2026
30Monitor	CVE-2026-92465No exploit	WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerabilitythemeum · wp mega menu · CWE-89 SQL injection	High7.6	—	0.3%	Sep 16, 2026
37Monitor	CVE-2026-89775No exploit	KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluationlinux · linux	Critical9.3	—	0.2%	Sep 16, 2026
35Monitor	CVE-2026-89777No exploit	vfio/pci: clear vdev->msi_perm after freeing it on init failurelinux · linux	High8.8	—	0.1%	Sep 16, 2026
39Monitor	CVE-2026-89778No exploit	isofs: fix out-of-bounds page array access on empty zisofs blocklinux · linux Pre-auth	Critical9.8	—	0.6%	Sep 16, 2026
36Monitor	CVE-2026-89779No exploit	fs/ntfs3: validate ef->size covers the record's name and valuelinux · linux Pre-auth	Critical9.1	—	0.6%	Sep 16, 2026
33Monitor	CVE-2026-89781No exploit	fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()linux · linux	High8.4	—	0.1%	Sep 16, 2026
33Monitor	CVE-2026-89782No exploit	fs/ntfs3: reject restart table growth beyond U16_MAX entrieslinux · linux	High8.4	—	0.1%	Sep 16, 2026
39Monitor	CVE-2026-89783No exploit	xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is fulllinux · linux Pre-auth	Critical9.8	—	0.7%	Sep 16, 2026
36Monitor	CVE-2026-89786No exploit	ext4: fix out-of-bounds read in ext4_read_inline_dir()linux · linux Pre-auth	Critical9.1	—	0.6%	Sep 16, 2026
39Monitor	CVE-2026-89788No exploit	ksmbd: fix tree connection use-after-free in smb2_tree_connect()linux · linux Pre-auth	Critical9.8	—	0.6%	Sep 16, 2026
31Monitor	CVE-2026-89789No exploit	gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-freelinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-89791No exploit	perf: Fix use-after-free when perf mmap() revival races with the last munmap()linux · linux	High7.8	—	0.1%	Sep 16, 2026
28Monitor	CVE-2026-89792No exploit	ksmbd: prevent out-of-bounds reads in share config responseslinux · linux	High7.1	—	0.1%	Sep 16, 2026
34Monitor	CVE-2026-19535No exploit	Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advanadvantech · eki-1242ieims · CWE-352 Pre-auth CSRF	High8.6	—	0.2%	Sep 16, 2026
34Monitor	CVE-2026-73163No exploit	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulneraadvantech · eki-1242ieims · CWE-78 RCE Command injection	High8.6	—	1.1%	Sep 16, 2026
34Monitor	CVE-2026-73164No exploit	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulneraadvantech · eki-1242ieims · CWE-78 RCE Command injection	High8.6	—	1.1%	Sep 16, 2026
34Monitor	CVE-2026-73165No exploit	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulneraadvantech · eki-1242ieims · CWE-78 RCE Command injection	High8.6	—	1.1%	Sep 16, 2026
34Monitor	CVE-2026-73166No exploit	Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management inteadvantech · eki-1242ieims · CWE-94 RCE	High8.6	—	0.7%	Sep 16, 2026
34Monitor	CVE-2026-73167No exploit	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulneraadvantech · eki-1242ieims · CWE-78 RCE Command injection	High8.6	—	1.1%	Sep 16, 2026
34Monitor	CVE-2026-73170No exploit	Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import wadvantech · eki-1242ieims · CWE-94 RCE	High8.6	—	0.5%	Sep 16, 2026
34Monitor	CVE-2026-73171No exploit	Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EKadvantech · eki-1242ieims · CWE-73 Path traversal	High8.6	—	0.5%	Sep 16, 2026
38Monitor	CVE-2026-73172No exploit	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulneraadvantech · eki-1242ieims · CWE-78 pre-auth RCE Command injection	Critical9.3	—	2.1%	Sep 16, 2026
35Monitor	CVE-2026-73173No exploit	Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol oadvantech · eki-1242ieims · CWE-306 Pre-auth Auth bypass	High8.8	—	0.7%	Sep 16, 2026
34Monitor	CVE-2026-73174No exploit	Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protocoadvantech · eki-1242ieims · CWE-319 Pre-auth Weak crypto	High8.7	—	0.1%	Sep 16, 2026
28Monitor	CVE-2026-73175No exploit	Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-advantech · eki-1242ieims · CWE-400 Pre-auth Denial of service	High7.1	—	0.2%	Sep 16, 2026
34Monitor	CVE-2026-73176No exploit	Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulneraadvantech · eki-1242ieims · CWE-78 RCE Command injection	High8.6	—	1.1%	Sep 16, 2026

CVE-2026-76552
35Monitor
WP Import Export Lite < 3.9.33 - Authenticated Arbitrary File Upload via Remote Image Import
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
unknown · wp import export liteSep 16, 2026
CVE-2026-76555
27Monitor
WP Import Export Lite < 3.9.33 - Authenticated Sensitive File Disclosure via Existing File Import Path Traversal
MediumCVSS 6.8Proof of conceptEPSS 0%
- Path traversal
unknown · wp import export liteSep 16, 2026
CVE-2026-78472
34Monitor
Ni WooCommerce Sales Report < 4.2.0 - Unauthenticated SQLi via 'sort' Parameter
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · ni woocommerce sales reportSep 16, 2026
CVE-2026-84829
35Monitor
Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · optimoleSep 16, 2026
CVE-2026-85530
32Monitor
GiveWP < 4.16.8.1 - Unauthenticated Account Takeover via Donor Email Sanitization Mismatch
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
unknown · givewpSep 16, 2026
CVE-2026-85569
28Monitor
Tutor LMS 2.7.1 - < 4.0.8 - Read-Only API Key Privilege Escalation via REST Request Misclassification
HighCVSS 7.2No exploitEPSS 0%
unknown · tutor lmsSep 16, 2026
CVE-2026-86444
28Monitor
LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter
HighCVSS 7.1No exploitEPSS 0%
- pre-auth RCE
- XSS
unknown · learnpressSep 16, 2026
CVE-2026-19248
28Monitor
Unbounded recursion vulnerability in the QDomNode destructor of Qt XML impacts Qt
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
qt · qtSep 16, 2026
CVE-2026-19857
19Monitor
Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token
MediumCVSS 4.8No exploitEPSS 0%
- Pre-auth
unknown · formidable formsSep 16, 2026
CVE-2026-1168
30Monitor
Allocation of Resources Without Limits or Throttling in GitLab
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
gitlab · gitlabSep 16, 2026
CVE-2026-73447
37Monitor
Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- Command injection
arista networks · eosSep 16, 2026
CVE-2026-79708
34Monitor
Incorrect Authorization in GitLab
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
gitlab · gitlabSep 16, 2026
CVE-2026-27546
39Monitor
Authentication Bypass in _account_log
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
- Auth bypass
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27547
36Monitor
Command Injection in /index.php/ajax/get_iodd_menu_info
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27548
36Monitor
Command Injection in /index.php/ajax/get_iodd_port_info
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27549
36Monitor
Command Injection in /index.php/attached_devices_tab/do_upload
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27550
36Monitor
Command Injection in Field_Shadow_Password Class
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27551
36Monitor
Command Injection in /index.php/ajax/parameterManage
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27552
32Monitor
Unauthorized IODD File Upload due to Improper Authorization
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27554
36Monitor
Command Injection in /index.php/ajax/save_iodd_parameters
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27555
35Monitor
Local File Inclusion in /index.php/ajax/get_iodd_port_info
HighCVSS 8.8No exploitEPSS 0%
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27556
35Monitor
Local File Inclusion in /index.php/ajax/save_iodd_parameters
HighCVSS 8.8No exploitEPSS 0%
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27557
30Monitor
Path Traversal in /index.php/view_uploaded_iodd_file
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27558
36Monitor
Command Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_files
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27559
36Monitor
Command Injection via GET in /api/status/data
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27560
29Monitor
Command Injection via DELETE in /api/status/data
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27561
29Monitor
Command Injection via GET in /api/iodd/config
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27562
29Monitor
Command Injection via PUT in /api/iodd/config
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27563
29Monitor
Command Injection via GET in /api/datastorage/data
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27564
29Monitor
Command Injection via PUT in /api/datastorage/data
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-27565
39Monitor
Remote code execution via uploading a malicious IODD file
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
pepperl+fuchs · ice2-8iol1-g65l-v1dSep 16, 2026
CVE-2026-84408
34Monitor
QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in to a Windows PC whe
HighCVSS 8.7No exploitEPSS 0%
- RCE
qualitysoft corporation · qnd premiumSep 16, 2026
CVE-2026-88263
34Monitor
XikeStor Layer3 switches miss authentication for downloading configuration data.
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
xikestor · sks8310-8xSep 16, 2026
CVE-2026-92355
34Monitor
In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Path traversal
octopus deploy · octopus serverSep 16, 2026
CVE-2026-73439
30Monitor
Security Advisory 0164
HighCVSS 7.7No exploitEPSS 0%
arista networks · eosSep 16, 2026
CVE-2026-73454
34Monitor
Security Advisory 0165
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Command injection
arista networks · eosSep 16, 2026
CVE-2026-73461
37Monitor
Security Advisory 0163
CriticalCVSS 9.4No exploitEPSS 0%
arista networks · eosSep 16, 2026
CVE-2026-73464
34Monitor
Security Advisory 0166
HighCVSS 8.7No exploitEPSS 0%
- RCE
arista networks · eosSep 16, 2026
CVE-2026-80225
30Monitor
Possible degradation of service from continuous queries on the same TCP/DoT connection
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
nlnetlabs · unboundSep 16, 2026
CVE-2026-81634
30Monitor
Possible heap buffer overflow during DNSSEC canonicalization
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
nlnetlabs · unboundSep 16, 2026
CVE-2026-81642
36Monitor
Heap buffer overflow and possible Remote Code Execution when digesting DNSKEY
CriticalCVSS 9.1Proof of conceptEPSS 0%
- pre-auth RCE
- Memory safety
nlnetlabs · unboundSep 16, 2026
CVE-2026-82311
39Monitor
Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
apache · apache-airflow-providers-fabSep 16, 2026
CVE-2026-82717
33Monitor
CNAME synthesis could lead to heap corruption
HighCVSS 8.4No exploitEPSS 0%
- pre-auth RCE
- Memory safety
nlnetlabs · unboundSep 16, 2026
CVE-2026-85501
30Monitor
Retrap: Novel Vulnerabilities to launch Algorithmic Complexity Attacks on DNSSEC
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
nlnetlabs · unboundSep 16, 2026
CVE-2026-86462
36Monitor
Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache · apache-airflow-providers-fabSep 16, 2026
CVE-2026-89774
35Monitor
Bluetooth: SCO: hold sk properly in sco_conn_ready
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-14917
30Monitor
Kong API Gateway Enterprise: SAML Authentication bypass
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
kong · kong enterprise gatewaySep 16, 2026
CVE-2026-59739
30Monitor
Apache ZooKeeper: Information disclosure via SetWatches reconnect replay
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache · zookeeperSep 16, 2026
CVE-2026-59969
30Monitor
Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
apache · zookeeperSep 16, 2026
CVE-2026-73435
28Monitor
Security Advisory 0171
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
arista networks · eosSep 16, 2026
CVE-2026-73438
28Monitor
Security Advisory 0172
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
arista networks · eosSep 16, 2026
CVE-2026-73453
38Monitor
Security Advisory 0174
CriticalCVSS 9.5No exploitEPSS 0%
- pre-auth RCE
arista networks · eosSep 16, 2026
CVE-2026-73455
35Monitor
Security Advisory 0173
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
arista networks · eosSep 16, 2026
CVE-2026-73468
28Monitor
Security Advisory 0175
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
arista networks · eosSep 16, 2026
CVE-2026-76186
36Monitor
Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache · apache-airflow-providers-keycloakSep 16, 2026
CVE-2026-76187
39Monitor
Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache · apache-airflow-providers-keycloakSep 16, 2026
CVE-2026-79993
30Monitor
Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache · zookeeperSep 16, 2026
CVE-2026-82310
28Monitor
Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access
HighCVSS 7.2No exploitEPSS 1%
apache · apache-airflow-providers-fabSep 16, 2026
CVE-2026-85628
28Monitor
Cleartext Transmission of Sensitive Information in the Pairing Process vulnerability
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Weak crypto
fermax electronica s.a.u. · duoxmeSep 16, 2026
CVE-2026-86466
32Monitor
Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
HighCVSS 8.1No exploitEPSS 0%
apache · apache-airflow-providers-fabSep 16, 2026
CVE-2026-86474
30Monitor
Improper Certificate Validation in the Firmware Download vulnerability
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
fermax electronica s.a.u. · duox plus monitor firmware (veo wi-fi range)Sep 16, 2026
CVE-2026-86792
35Monitor
Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration
HighCVSS 8.8No exploitEPSS 1%
- RCE
apache · apache-airflow-providers-apache-kafkaSep 16, 2026
CVE-2025-14871
30Monitor
Allocation of Resources Without Limits or Throttling in GitLab
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
gitlab · gitlabSep 16, 2026
CVE-2026-14916
30Monitor
Kong API Gateway Enterprise: JWT Algorithm-Confusion
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
kong · kong enteprise gatewaySep 16, 2026
CVE-2026-86106
34Monitor
Security Advisory 0179
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
arista networks · velocloud edgeSep 16, 2026
CVE-2026-86107
32Monitor
Security Advisory 0180
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
arista networks · velocloudSep 16, 2026
CVE-2026-86585
30Monitor
Improper Verification of the Firmware Signature vulnerability
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
fermax electronica s.a.u. · duox plus monitor firmware (veo wi-fi range)Sep 16, 2026
CVE-2026-8462
35Monitor
OpenMeter SQL Injection in ClickHouse-backed Meter Definitions
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- SQL injection
openmeter · openmeterSep 16, 2026
CVE-2026-92456
28Monitor
yshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
guchengwuyue · yshop-crmSep 16, 2026
CVE-2026-92457
28Monitor
yshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
guchengwuyue · yshop-crmSep 16, 2026
CVE-2026-92459
28Monitor
yshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
guchengwuyue · yshop-crmSep 16, 2026
CVE-2026-92460
28Monitor
yshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
guchengwuyue · yshop-crmSep 16, 2026
CVE-2026-92462
28Monitor
yshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
guchengwuyue · yshop-crmSep 16, 2026
CVE-2026-92463
28Monitor
yshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
guchengwuyue · yshop-crmSep 16, 2026
CVE-2026-92465
30Monitor
WordPress WP Mega Menu plugin <= 1.4.2 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
themeum · wp mega menuSep 16, 2026
CVE-2026-89775
37Monitor
KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation
CriticalCVSS 9.3No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89777
35Monitor
vfio/pci: clear vdev->msi_perm after freeing it on init failure
HighCVSS 8.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89778
39Monitor
isofs: fix out-of-bounds page array access on empty zisofs block
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89779
36Monitor
fs/ntfs3: validate ef->size covers the record's name and value
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89781
33Monitor
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89782
33Monitor
fs/ntfs3: reject restart table growth beyond U16_MAX entries
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89783
39Monitor
xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89786
36Monitor
ext4: fix out-of-bounds read in ext4_read_inline_dir()
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89788
39Monitor
ksmbd: fix tree connection use-after-free in smb2_tree_connect()
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89789
31Monitor
gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89791
31Monitor
perf: Fix use-after-free when perf mmap() revival races with the last munmap()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89792
28Monitor
ksmbd: prevent out-of-bounds reads in share config responses
HighCVSS 7.1No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-19535
34Monitor
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advan
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- CSRF
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73163
34Monitor
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73164
34Monitor
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73165
34Monitor
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73166
34Monitor
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management inte
HighCVSS 8.6No exploitEPSS 0%
- RCE
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73167
34Monitor
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73170
34Monitor
Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import w
HighCVSS 8.6No exploitEPSS 0%
- RCE
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73171
34Monitor
Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EK
HighCVSS 8.6No exploitEPSS 0%
- Path traversal
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73172
38Monitor
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73173
35Monitor
Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol o
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73174
34Monitor
Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protoco
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Weak crypto
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73175
28Monitor
Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Denial of service
advantech · eki-1242ieimsSep 16, 2026
CVE-2026-73176
34Monitor
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
advantech · eki-1242ieimsSep 16, 2026