By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 48 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
32Monitor	CVE-2026-89954No exploit	mtd: afs: validate v2 image info boundslinux · linux	High8.0	—	0.1%	Sep 16, 2026
35Monitor	CVE-2026-89957No exploit	s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removedlinux · linux	High8.8	—	0.1%	Sep 16, 2026
35Monitor	CVE-2026-89959No exploit	s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_removelinux · linux	High8.8	—	0.1%	Sep 16, 2026
35Monitor	CVE-2026-89960No exploit	s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()linux · linux	High8.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-89961No exploit	powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap populationlinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-89965No exploit	nvdimm/btt: reject an arena whose nfree is below the lane countlinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-89967No exploit	mm/migrate_device: avoid out-of-bounds writes for compound folioslinux · linux	High7.8	—	0.1%	Sep 16, 2026
30Monitor	CVE-2026-89968No exploit	nvmet-tcp: reject unsolicited H2CData PDUslinux · linux Pre-auth Denial of service	High7.5	—	0.8%	Sep 16, 2026
39Monitor	CVE-2026-89969No exploit	nvmet-tcp: fix out-of-bounds write when receiving an over-long PDUlinux · linux Pre-auth	Critical9.8	—	0.7%	Sep 16, 2026
39Monitor	CVE-2026-89970No exploit	nvmet-auth: Synchronize timeout work during SQ teardownlinux · linux Pre-auth	Critical9.8	—	0.8%	Sep 16, 2026
30Monitor	CVE-2026-89971No exploit	nvme: skip the zoned limits update if the zone info query failedlinux · linux Pre-auth Denial of service	High7.5	—	0.6%	Sep 16, 2026
39Monitor	CVE-2026-89972No exploit	nvme: add missing SRCU grace period in error pathlinux · linux Pre-auth	Critical9.8	—	0.7%	Sep 16, 2026
32Monitor	CVE-2026-89973No exploit	nvme-tcp: check the data direction of a C2HData PDUlinux · linux Pre-auth	High8.2	—	0.6%	Sep 16, 2026
30Monitor	CVE-2026-89974No exploit	nvme-fc: fix double free of fabrics options when nvme_add_ctrl() failslinux · linux Pre-auth	High7.5	—	0.2%	Sep 16, 2026
31Monitor	CVE-2026-89979No exploit	ALSA: pcm: Fix race between non-atomic ops and trigger-startlinux · linux	High7.8	—	0.1%	Sep 16, 2026
33Monitor	CVE-2026-89980No exploit	ALSA: harmony: initialize locks before requesting IRQlinux · linux	High8.4	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-89985No exploit	memcg: keep folio's objcg same as its nodelinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-89986No exploit	mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()linux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-89988No exploit	kprobes: Protect kprobe_blacklist with RCUlinux · linux	High7.8	—	0.1%	Sep 16, 2026
39Monitor	CVE-2026-89990No exploit	ceph: lock mutex in ceph_mds_check_access()linux · linux Pre-auth	Critical9.8	—	0.6%	Sep 16, 2026
33Monitor	CVE-2026-89992No exploit	cpuidle: dt_idle_genpd: kfree() the original name allocationlinux · linux	High8.4	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-89994No exploit	dmaengine: fsl-edma: tracing: no ptr dereference during log outputlinux · linux	High7.8	—	0.1%	Sep 16, 2026
35Monitor	CVE-2026-89995No exploit	dma-direct: return struct page from dma_direct_alloc_from_pool()linux · linux Pre-auth	High8.8	—	0.3%	Sep 16, 2026
31Monitor	CVE-2026-89997No exploit	dm: fix resume-vs-remove racelinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-89998No exploit	dm: fix race when loading and unloading a tablelinux · linux Race condition	High7.8	—	0.1%	Sep 16, 2026
32Monitor	CVE-2026-89999No exploit	HID: wacom: validate report length in wacom_intuos_pro2_bt_irqlinux · linux Pre-auth	High8.1	—	0.3%	Sep 16, 2026
35Monitor	CVE-2026-90000No exploit	HID: rmi: fix OOB access with undersized RMI reportslinux · linux Pre-auth	High8.8	—	0.3%	Sep 16, 2026
31Monitor	CVE-2026-90001No exploit	HID: bpf: serialize device reference release in struct_ops destroy pathlinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90002No exploit	ftrace: Take trace_array reference before accessing its ftrace_opslinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90003No exploit	futex: Prevent rcuwait use-after-free during requeue PIlinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90007No exploit	scsi: pm8001: Use rollback index when freeing MSI-X vectorslinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90008No exploit	scsi: megaraid_sas: Limit NVMe request size to the PRP chain framelinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90009No exploit	scsi: bsg: Fix TOCTOU in io_uring passthrough command setuplinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90010No exploit	scsi: bsg: Cap io_uring sense copy to max_response_lenlinux · linux	High7.8	—	0.1%	Sep 16, 2026
36Monitor	CVE-2026-90011No exploit	scsi: target: iscsi: Reserve a terminator byte for the login payloadlinux · linux Pre-auth	Critical9.1	—	0.8%	Sep 16, 2026
39Monitor	CVE-2026-90012No exploit	spi: Fix DMA mapping ownership on partial map failurelinux · linux Pre-auth	Critical9.8	—	0.6%	Sep 16, 2026
31Monitor	CVE-2026-90013No exploit	tracing: Take trace_array reference when opening options filelinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90014No exploit	tracing: Have show_event_filters/triggers files take trace array reflinux · linux	High7.8	—	0.1%	Sep 16, 2026
28Monitor	CVE-2026-90016No exploit	staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()linux · linux Pre-auth	High7.1	—	0.3%	Sep 16, 2026
28Monitor	CVE-2026-90017No exploit	staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()linux · linux Pre-auth	High7.1	—	0.3%	Sep 16, 2026
35Monitor	CVE-2026-90018No exploit	staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()linux · linux Pre-auth	High8.8	—	0.4%	Sep 16, 2026
31Monitor	CVE-2026-90022No exploit	usb: gadget: f_midi2: fix use-after-free in string attribute show pathlinux · linux	High7.8	—	0.1%	Sep 16, 2026
30Monitor	CVE-2026-90025No exploit	usb: typec: ucsi: displayport: Fix OOB altmode array indexlinux · linux	High7.7	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90026No exploit	usb: typec: qcom-pmic: cancel reset_work on stoplinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90027No exploit	usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stoplinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90030No exploit	usb: dwc3: clear forceRM when issuing EndTransferlinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90032No exploit	media: usbtv: keep device alive while ALSA card existslinux · linux	High7.8	—	0.1%	Sep 16, 2026
39Monitor	CVE-2026-90036No exploit	NFSD: Prevent client use-after-free during blocked-lock reapinglinux · linux Pre-auth	Critical9.8	—	0.4%	Sep 16, 2026
39Monitor	CVE-2026-90037No exploit	NFSD: Prevent client use-after-free during close_lru reapinglinux · linux Pre-auth	Critical9.8	—	0.5%	Sep 16, 2026
39Monitor	CVE-2026-90038No exploit	NFSD: Prevent client use-after-free during export state revocationlinux · linux Pre-auth	Critical9.8	—	0.5%	Sep 16, 2026
35Monitor	CVE-2026-90041No exploit	HID: sony: clean up device list on probe failurelinux · linux Pre-auth	High8.8	—	0.3%	Sep 16, 2026
39Monitor	CVE-2026-90042No exploit	ceph: properly decrypt filenames in vmalloc() bufferslinux · linux Pre-auth	Critical9.8	—	0.5%	Sep 16, 2026
31Monitor	CVE-2026-90043No exploit	zram: fix slot lock bit position on big-endian 64-bitlinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90044No exploit	usb: gadget: f_fs: Fix Use-After-Free in AIO error pathlinux · linux Race condition	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90045No exploit	USB: gadget: ffs: fix mm lifetime handlinglinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90046No exploit	mm/page_alloc: don't spin_trylock() in NMI on UPlinux · linux	High7.8	—	0.1%	Sep 16, 2026
31Monitor	CVE-2026-90047No exploit	drm/xe: Don't hand out the flat CCS storage as usable VRAMlinux · linux	High7.8	—	0.1%	Sep 16, 2026
39Monitor	CVE-2026-90048No exploit	fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()linux · linux Pre-auth	Critical9.8	—	0.7%	Sep 16, 2026
37Monitor	CVE-2026-90049No exploit	net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()linux · linux	Critical9.3	—	0.1%	Sep 16, 2026
30Monitor	CVE-2026-18212No exploit	Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib statered hat · red hat build of keycloak 26.4 · CWE-401 Pre-auth Denial of service	High7.5	—	0.7%	Sep 16, 2026
32Monitor	CVE-2026-63671No exploit	@nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configurationnuxt-content · mdc · CWE-79 Pre-auth XSS	High8.1	—	0.4%	Sep 16, 2026
32Monitor	CVE-2026-74909No exploit	Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segmentsred hat · red hat build of keycloak 26.4 · CWE-862 Path traversal Broken access control (IDOR)	High8.1	—	0.8%	Sep 16, 2026
33Monitor	CVE-2026-76825No exploit	RestrictedPython: Sandbox escape via string.Formatter field resolutionzopefoundation · restrictedpython · CWE-200 Info leak	High8.4	—	0.6%	Sep 16, 2026
35Monitor	CVE-2026-77403No exploit	RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiationrabbitmq · amqp091-go · CWE-770 Pre-auth Denial of service	High8.9	—	0.5%	Sep 16, 2026
34Monitor	CVE-2026-77404No exploit	RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injectionrabbitmq · amqp091-go · CWE-116	High8.7	—	0.1%	Sep 16, 2026
37Monitor	CVE-2026-77405No exploit	RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parserrabbitmq · amqp091-go · CWE-326 Pre-auth Weak crypto	Critical9.4	—	0.2%	Sep 16, 2026
32Monitor	CVE-2026-77406No exploit	RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configurationrabbitmq · amqp091-go · CWE-195 Pre-auth	High8.2	—	0.5%	Sep 16, 2026
28Monitor	CVE-2026-77407No exploit	RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fieldsrabbitmq · amqp091-go · CWE-316	High7.0	—	0.1%	Sep 16, 2026
36Monitor	CVE-2026-77408No exploit	RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflowrabbitmq · amqp091-go · CWE-190 Pre-auth Memory safety	Critical9.1	—	0.5%	Sep 16, 2026
32Monitor	CVE-2026-77409No exploit	RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blockingrabbitmq · amqp091-go · CWE-770 Pre-auth Denial of service	High8.2	—	0.5%	Sep 16, 2026
35Monitor	CVE-2026-77410No exploit	RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocationrabbitmq · amqp091-go · CWE-789 Pre-auth	High8.9	—	0.5%	Sep 16, 2026
38Monitor	CVE-2026-77411No exploit	RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstrrabbitmq · amqp091-go · CWE-754 Pre-auth	Critical9.5	—	0.5%	Sep 16, 2026
35Monitor	CVE-2026-77412No exploit	RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Clientrabbitmq · amqp091-go · CWE-681 Pre-auth	High8.9	—	0.5%	Sep 16, 2026
30Monitor	CVE-2026-79651No exploit	Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale cachingred hat · red hat build of keycloak 26.4 · CWE-400 Pre-auth Denial of service	High7.5	—	0.8%	Sep 16, 2026
35Monitor	CVE-2026-82964No exploit	Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sysgen digital · avast free antivirus, avast one, avast premium security, avast ultimate, avast business security · CWE-281 Local privilege escalation	High8.8	—	0.1%	Sep 16, 2026
35Monitor	CVE-2026-84858No exploit	Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypassscada-lts · scada-lts · CWE-94 RCE	High8.8	—	0.8%	Sep 16, 2026
35Monitor	CVE-2026-84860No exploit	Scada-LTS DWR Authorization Bypass - Systemicscada-lts · scada-lts · CWE-639 Broken access control (IDOR)	High8.8	—	0.4%	Sep 16, 2026
32Monitor	CVE-2026-92087No exploit	@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth@fastify/auth · @fastify/auth · CWE-285 Broken access control (IDOR)	High8.1	—	0.4%	Sep 16, 2026
36Monitor	CVE-2026-92395No exploit	@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet@fastify/proxy-addr · @fastify/proxy-addr · CWE-290 Pre-auth Auth bypass	Critical9.1	—	0.3%	Sep 16, 2026
35Monitor	CVE-2026-92566No exploit	DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Previewdatageartech · datagear · CWE-918 pre-auth RCE Auth bypass SSRF	High8.8	—	0.5%	Sep 16, 2026
28Monitor	CVE-2026-92567No exploit	TDuck survey form through 5.0 Unauthorized Data Modificationtduckcloud · tduck-survey-form · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Sep 16, 2026
28Monitor	CVE-2026-92570No exploit	reNgine through 2.2.0 Unauthorized Configuration File Readyogeshojha · rengine · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Sep 16, 2026
30Monitor	CVE-2026-92616No exploit	FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritanceerror311 · filerise · CWE-613	High7.6	—	0.3%	Sep 16, 2026
34Monitor	CVE-2026-40854No exploit	Session auth bypass via cookie value in T-Mobile 5G Box IDU routerswnc · t-mobile 5g box idu · CWE-290 Pre-auth Auth bypass	High8.7	—	0.3%	Sep 16, 2026
37Monitor	CVE-2026-40855No exploit	Command Injection in T-Mobile 5G Box IDU router via ping functionalitywnc · t-mobile 5g box idu · CWE-78 RCE Command injection	Critical9.3	—	1.5%	Sep 16, 2026
28Monitor	CVE-2026-40856No exploit	Config disclosure in T-Mobile 5G Box IDU routerswnc · t-mobile 5g box idu · CWE-306 Pre-auth Auth bypass	High7.1	—	0.3%	Sep 16, 2026
33Monitor	CVE-2026-40857No exploit	CSRF token bypass in T-Mobile 5G Box IDU routerswnc · t-mobile 5g box idu · CWE-352 Pre-auth CSRF	High8.4	—	0.1%	Sep 16, 2026
28Monitor	CVE-2026-17526No exploit	Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accountsred hat · red hat build of keycloak 26.4 · CWE-862 Broken access control (IDOR)	High7.2	—	0.6%	Sep 16, 2026
38Monitor	CVE-2026-58146No exploit	Unauthorized remote code execution in T-Mobile 5G Box IDU routerswnc · t-mobile 5g box idu · CWE-78 pre-auth RCE Command injection	Critical9.4	—	2.8%	Sep 16, 2026
37Monitor	CVE-2026-58147No exploit	Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routerswnc · t-mobile 5g box idu · CWE-78 RCE Command injection	Critical9.3	—	1.5%	Sep 16, 2026
21Monitor	CVE-2026-19607Proof of concept	Keycloak-services: keycloak-services: broker-originated username collision causes account lockoutred hat · red hat build of keycloak 26.4 · CWE-287 Pre-auth Auth bypass Denial of service	Medium5.3	—	0.6%	Sep 16, 2026
39Monitor	CVE-2026-70416No exploit	Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability.dell · objectscale · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.8%	Sep 16, 2026
39Monitor	CVE-2026-90999No exploit	Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environmentfunctional software, inc. · sentry seer · CWE-20 Pre-auth	Critical9.8	—	0.6%	Sep 16, 2026
35Monitor	CVE-2026-92397No exploit	Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injectionruijie · rg-ew3000gx · CWE-77 RCE Command injection	High8.5	—	3.1%	Sep 16, 2026
30Monitor	CVE-2026-92625No exploit	Control iD iDSecure Unauthenticated Denial of Servicecontrol id · idsecure · CWE-306 Pre-auth Auth bypass Denial of service	High7.5	—	0.6%	Sep 16, 2026
30Monitor	CVE-2026-92626No exploit	Control iD iDSecure Unauthenticated Denial of Servicecontrol id · idsecure · CWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Sep 16, 2026
39Monitor	CVE-2026-20234No exploit	Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilitiescisco · identity services engine · CWE-522 Info leak	Critical9.9	—	0.4%	Sep 16, 2026
36Monitor	CVE-2026-20305No exploit	Cisco Identity Services Engine Command Injection Vulnerabilitycisco · cisco identity services engine software · CWE-78 RCE Command injection	Critical9.1	—	1.5%	Sep 16, 2026
36Monitor	CVE-2026-20306No exploit	Cisco Identity Services Engine Command Injection Vulnerabilitycisco · cisco identity services engine software · CWE-78 RCE Command injection	Critical9.1	—	1.5%	Sep 16, 2026
39Monitor	CVE-2026-20307No exploit	Cisco Identity Services Engine Remote Code Execution Vulnerabilitycisco · cisco identity services engine software · CWE-502 RCE Deserialization	Critical9.9	—	0.9%	Sep 16, 2026

CVE-2026-89954
32Monitor
mtd: afs: validate v2 image info bounds
HighCVSS 8.0No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89957
35Monitor
s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
HighCVSS 8.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89959
35Monitor
s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
HighCVSS 8.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89960
35Monitor
s390/vfio-ap: fix stale pqap_hook pointer on error in vfio_ap_mdev_set_kvm()
HighCVSS 8.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89961
31Monitor
powerpc/mm: fix wrong addr_pfn tracking in compound vmemmap population
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89965
31Monitor
nvdimm/btt: reject an arena whose nfree is below the lane count
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89967
31Monitor
mm/migrate_device: avoid out-of-bounds writes for compound folios
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89968
30Monitor
nvmet-tcp: reject unsolicited H2CData PDUs
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxSep 16, 2026
CVE-2026-89969
39Monitor
nvmet-tcp: fix out-of-bounds write when receiving an over-long PDU
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89970
39Monitor
nvmet-auth: Synchronize timeout work during SQ teardown
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89971
30Monitor
nvme: skip the zoned limits update if the zone info query failed
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxSep 16, 2026
CVE-2026-89972
39Monitor
nvme: add missing SRCU grace period in error path
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89973
32Monitor
nvme-tcp: check the data direction of a C2HData PDU
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89974
30Monitor
nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89979
31Monitor
ALSA: pcm: Fix race between non-atomic ops and trigger-start
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89980
33Monitor
ALSA: harmony: initialize locks before requesting IRQ
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89985
31Monitor
memcg: keep folio's objcg same as its node
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89986
31Monitor
mm/mempolicy: fix sleeping allocation in alloc_pages_bulk_weighted_interleave()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89988
31Monitor
kprobes: Protect kprobe_blacklist with RCU
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89990
39Monitor
ceph: lock mutex in ceph_mds_check_access()
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89992
33Monitor
cpuidle: dt_idle_genpd: kfree() the original name allocation
HighCVSS 8.4No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89994
31Monitor
dmaengine: fsl-edma: tracing: no ptr dereference during log output
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89995
35Monitor
dma-direct: return struct page from dma_direct_alloc_from_pool()
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-89997
31Monitor
dm: fix resume-vs-remove race
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-89998
31Monitor
dm: fix race when loading and unloading a table
HighCVSS 7.8No exploitEPSS 0%
- Race condition
linux · linuxSep 16, 2026
CVE-2026-89999
32Monitor
HID: wacom: validate report length in wacom_intuos_pro2_bt_irq
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90000
35Monitor
HID: rmi: fix OOB access with undersized RMI reports
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90001
31Monitor
HID: bpf: serialize device reference release in struct_ops destroy path
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90002
31Monitor
ftrace: Take trace_array reference before accessing its ftrace_ops
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90003
31Monitor
futex: Prevent rcuwait use-after-free during requeue PI
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90007
31Monitor
scsi: pm8001: Use rollback index when freeing MSI-X vectors
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90008
31Monitor
scsi: megaraid_sas: Limit NVMe request size to the PRP chain frame
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90009
31Monitor
scsi: bsg: Fix TOCTOU in io_uring passthrough command setup
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90010
31Monitor
scsi: bsg: Cap io_uring sense copy to max_response_len
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90011
36Monitor
scsi: target: iscsi: Reserve a terminator byte for the login payload
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90012
39Monitor
spi: Fix DMA mapping ownership on partial map failure
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90013
31Monitor
tracing: Take trace_array reference when opening options file
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90014
31Monitor
tracing: Have show_event_filters/triggers files take trace array ref
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90016
28Monitor
staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie()
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90017
28Monitor
staging: rtl8723bs: fix OOB read in rtw_action_frame_parse()
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90018
35Monitor
staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr()
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90022
31Monitor
usb: gadget: f_midi2: fix use-after-free in string attribute show path
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90025
30Monitor
usb: typec: ucsi: displayport: Fix OOB altmode array index
HighCVSS 7.7No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90026
31Monitor
usb: typec: qcom-pmic: cancel reset_work on stop
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90027
31Monitor
usb: typec: qcom-pmic-typec: disable cc_debounce_dwork on stop
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90030
31Monitor
usb: dwc3: clear forceRM when issuing EndTransfer
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90032
31Monitor
media: usbtv: keep device alive while ALSA card exists
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90036
39Monitor
NFSD: Prevent client use-after-free during blocked-lock reaping
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90037
39Monitor
NFSD: Prevent client use-after-free during close_lru reaping
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90038
39Monitor
NFSD: Prevent client use-after-free during export state revocation
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90041
35Monitor
HID: sony: clean up device list on probe failure
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90042
39Monitor
ceph: properly decrypt filenames in vmalloc() buffers
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90043
31Monitor
zram: fix slot lock bit position on big-endian 64-bit
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90044
31Monitor
usb: gadget: f_fs: Fix Use-After-Free in AIO error path
HighCVSS 7.8No exploitEPSS 0%
- Race condition
linux · linuxSep 16, 2026
CVE-2026-90045
31Monitor
USB: gadget: ffs: fix mm lifetime handling
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90046
31Monitor
mm/page_alloc: don't spin_trylock() in NMI on UP
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90047
31Monitor
drm/xe: Don't hand out the flat CCS storage as usable VRAM
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-90048
39Monitor
fs/ntfs3: fix slab-out-of-bounds write in ni_create_attr_list()
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linuxSep 16, 2026
CVE-2026-90049
37Monitor
net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy()
CriticalCVSS 9.3No exploitEPSS 0%
linux · linuxSep 16, 2026
CVE-2026-18212
30Monitor
Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat build of keycloak 26.4Sep 16, 2026
CVE-2026-63671
32Monitor
@nuxtjs/mdc: the URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- XSS
nuxt-content · mdcSep 16, 2026
CVE-2026-74909
32Monitor
Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
- Broken access control (IDOR)
red hat · red hat build of keycloak 26.4Sep 16, 2026
CVE-2026-76825
33Monitor
RestrictedPython: Sandbox escape via string.Formatter field resolution
HighCVSS 8.4No exploitEPSS 0%
- Info leak
zopefoundation · restrictedpythonSep 16, 2026
CVE-2026-77403
35Monitor
RabbitMQ amqp091-go: Denial of Service via Sub-Spec Frame Size Negotiation
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- Denial of service
rabbitmq · amqp091-goSep 16, 2026
CVE-2026-77404
34Monitor
RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection
HighCVSS 8.7No exploitEPSS 0%
rabbitmq · amqp091-goSep 16, 2026
CVE-2026-77405
37Monitor
RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
rabbitmq · amqp091-goSep 16, 2026
CVE-2026-77406
32Monitor
RabbitMQ amqp091-go: Consumer Message Flooding via Signed-to-Unsigned Integer Casting in Qos Configuration
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
rabbitmq · amqp091-goSep 16, 2026
CVE-2026-77407
28Monitor
RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields
HighCVSS 7.0No exploitEPSS 0%
rabbitmq · amqp091-goSep 16, 2026
CVE-2026-77408
36Monitor
RabbitMQ amqp091-go: Silent Data Truncation and State Corruption via Shortstr Integer Overflow
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
rabbitmq · amqp091-goSep 16, 2026
CVE-2026-77409
32Monitor
RabbitMQ amqp091-go: Denial of Service via Synchronous Event Channel Blocking
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
rabbitmq · amqp091-goSep 16, 2026
CVE-2026-77410
35Monitor
RabbitMQ amqp091-go: Resource Exhaustion (OOM) via Unbounded Body Buffer Allocation
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
rabbitmq · amqp091-goSep 16, 2026
CVE-2026-77411
38Monitor
RabbitMQ amqp091-go: Protocol Desynchronization and Frame Injection via Integer Overflow in readLongstr
CriticalCVSS 9.5No exploitEPSS 0%
- Pre-auth
rabbitmq · amqp091-goSep 16, 2026
CVE-2026-77412
35Monitor
RabbitMQ amqp091-go: Denial of Service via Malicious Field Length in AMQP Client
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
rabbitmq · amqp091-goSep 16, 2026
CVE-2026-79651
30Monitor
Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat build of keycloak 26.4Sep 16, 2026
CVE-2026-82964
35Monitor
Avast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
gen digital · avast free antivirus, avast one, avast premium security, avast ultimate, avast business securitySep 16, 2026
CVE-2026-84858
35Monitor
Scada-LTS Authenticated Remote Code Execution via Scripting Sandbox Bypass
HighCVSS 8.8No exploitEPSS 0%
- RCE
scada-lts · scada-ltsSep 16, 2026
CVE-2026-84860
35Monitor
Scada-LTS DWR Authorization Bypass - Systemic
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
scada-lts · scada-ltsSep 16, 2026
CVE-2026-92087
32Monitor
@fastify/auth vulnerable to Authorization Bypass via order-dependent evaluation of composed auth
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
@fastify/auth · @fastify/authSep 16, 2026
CVE-2026-92395
36Monitor
@fastify/proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
@fastify/proxy-addr · @fastify/proxy-addrSep 16, 2026
CVE-2026-92566
35Monitor
DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
- SSRF
datageartech · datagearSep 16, 2026
CVE-2026-92567
28Monitor
TDuck survey form through 5.0 Unauthorized Data Modification
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
tduckcloud · tduck-survey-formSep 16, 2026
CVE-2026-92570
28Monitor
reNgine through 2.2.0 Unauthorized Configuration File Read
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
yogeshojha · rengineSep 16, 2026
CVE-2026-92616
30Monitor
FileRise < 3.28.0 Privilege Escalation via WebDAV Session Inheritance
HighCVSS 7.6No exploitEPSS 0%
error311 · fileriseSep 16, 2026
CVE-2026-40854
34Monitor
Session auth bypass via cookie value in T-Mobile 5G Box IDU routers
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
wnc · t-mobile 5g box iduSep 16, 2026
CVE-2026-40855
37Monitor
Command Injection in T-Mobile 5G Box IDU router via ping functionality
CriticalCVSS 9.3No exploitEPSS 1%
- RCE
- Command injection
wnc · t-mobile 5g box iduSep 16, 2026
CVE-2026-40856
28Monitor
Config disclosure in T-Mobile 5G Box IDU routers
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
wnc · t-mobile 5g box iduSep 16, 2026
CVE-2026-40857
33Monitor
CSRF token bypass in T-Mobile 5G Box IDU routers
HighCVSS 8.4No exploitEPSS 0%
- Pre-auth
- CSRF
wnc · t-mobile 5g box iduSep 16, 2026
CVE-2026-17526
28Monitor
Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
red hat · red hat build of keycloak 26.4Sep 16, 2026
CVE-2026-58146
38Monitor
Unauthorized remote code execution in T-Mobile 5G Box IDU routers
CriticalCVSS 9.4No exploitEPSS 2%
- pre-auth RCE
- Command injection
wnc · t-mobile 5g box iduSep 16, 2026
CVE-2026-58147
37Monitor
Authorized remote code execution via password change functionality in T-Mobile 5G Box IDU routers
CriticalCVSS 9.3No exploitEPSS 1%
- RCE
- Command injection
wnc · t-mobile 5g box iduSep 16, 2026
CVE-2026-19607
21Monitor
Keycloak-services: keycloak-services: broker-originated username collision causes account lockout
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- Denial of service
red hat · red hat build of keycloak 26.4Sep 16, 2026
CVE-2026-70416
39Monitor
Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
dell · objectscaleSep 16, 2026
CVE-2026-90999
39Monitor
Sentry Seer vulnerability allows attacker-controlled input to be executed in a privileged environment
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
functional software, inc. · sentry seerSep 16, 2026
CVE-2026-92397
35Monitor
Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection
HighCVSS 8.5No exploitEPSS 3%
- RCE
- Command injection
ruijie · rg-ew3000gxSep 16, 2026
CVE-2026-92625
30Monitor
Control iD iDSecure Unauthenticated Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Denial of service
control id · idsecureSep 16, 2026
CVE-2026-92626
30Monitor
Control iD iDSecure Unauthenticated Denial of Service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
control id · idsecureSep 16, 2026
CVE-2026-20234
39Monitor
Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilities
CriticalCVSS 9.9No exploitEPSS 0%
- Info leak
cisco · identity services engineSep 16, 2026
CVE-2026-20305
36Monitor
Cisco Identity Services Engine Command Injection Vulnerability
CriticalCVSS 9.1No exploitEPSS 1%
- RCE
- Command injection
cisco · cisco identity services engine softwareSep 16, 2026
CVE-2026-20306
36Monitor
Cisco Identity Services Engine Command Injection Vulnerability
CriticalCVSS 9.1No exploitEPSS 1%
- RCE
- Command injection
cisco · cisco identity services engine softwareSep 16, 2026
CVE-2026-20307
39Monitor
Cisco Identity Services Engine Remote Code Execution Vulnerability
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Deserialization
cisco · cisco identity services engine softwareSep 16, 2026