By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 58 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-92807No exploit	Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attripdfcrowd · save as pdf plugin by pdfcrowd · CWE-94 RCE	High8.8	—	0.4%	Sep 18, 2026
37Monitor	CVE-2026-93741No exploit	Totolink A3002MU formWlWds buffer overflowtotolink · a3002mu · CWE-119 Pre-auth Memory safety	Critical9.3	—	0.6%	Sep 19, 2026
28Monitor	CVE-2026-76554No exploit	WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Importunknown · wp import export lite · CWE-269	High7.2	—	0.4%	Sep 19, 2026
28Monitor	CVE-2026-76790No exploit	Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameterunknown · estatik real estate plugin · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Sep 19, 2026
32Monitor	CVE-2026-85574No exploit	Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domainsunknown · unbounce landing pages · CWE-862 Broken access control (IDOR)	High8.0	—	0.3%	Sep 19, 2026
35Monitor	CVE-2026-85680No exploit	Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Titleunknown · ultimate member · CWE-79 Pre-auth XSS	High8.8	—	0.5%	Sep 19, 2026
39Monitor	CVE-2026-86591No exploit	Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Routeunknown · botiga pro · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.8	—	0.5%	Sep 19, 2026
32Monitor	CVE-2026-86814No exploit	UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Emailunknown · userswp · CWE-269 Pre-auth	High8.1	—	0.3%	Sep 19, 2026
35Monitor	CVE-2026-88824No exploit	Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settingsunknown · master blocks · CWE-79 Pre-auth XSS	High8.8	—	0.5%	Sep 19, 2026
34Monitor	CVE-2026-88926No exploit	VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLiunknown · vikrentitems flexible rental management system · CWE-89 Pre-auth SQL injection	High8.6	—	0.4%	Sep 19, 2026
26Monitor	CVE-2026-92099Proof of concept	WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squattingunknown · wpgraphql smart cache · CWE-284 Pre-auth Broken access control (IDOR)	Medium6.5	—	0.3%	Sep 19, 2026
30Monitor	CVE-2026-92404No exploit	MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosureunknown · mgosync · CWE-200 Pre-auth Info leak	High7.5	—	0.4%	Sep 19, 2026
28Monitor	CVE-2026-15664No exploit	Quill Forms \| Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Valuemdmag · quill forms \| conversational multi step forms, surveys & quizzes · CWE-79 Pre-auth XSS	High7.2	—	0.5%	Sep 19, 2026
35Monitor	CVE-2026-4327No exploit	The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parametersebwordpress · the welcomizer · CWE-94 RCE	High8.8	—	0.6%	Sep 19, 2026
32Monitor	CVE-2026-85658No exploit	Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcoproperfraction · paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress · CWE-94 RCE	High8.1	—	0.6%	Sep 19, 2026
30Monitor	CVE-2026-1255No exploit	YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Actionysinnovations · ys leadgen – popup builder, popup maker & form builder for wordpress \| lead generation, email marketing, sales, conversions, opt-ins & subscribers · CWE-200 Pre-auth Info leak	High7.5	—	0.5%	Sep 19, 2026
35Monitor	CVE-2026-93742No exploit	Totolink A3002MU formWsc command injectiontotolink · a3002mu · CWE-74 RCE Command injection	High8.6	—	2.2%	Sep 19, 2026
39Monitor	CVE-2026-78030No exploit	DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBMCWE-470 Pre-auth	Critical9.8	—	0.4%	Sep 19, 2026
28Monitor	RUSTSEC-2026-0328No exploit	`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip) Path traversal	High7.1	—	—	Sep 19, 2026
30Monitor	CVE-2026-82560No exploit	Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output widthCWE-835 Pre-auth Denial of service	High7.5	—	0.6%	Sep 19, 2026
37Monitor	CVE-2026-93985No exploit	OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCEopenpanel-dev · openpanel · CWE-94 RCE	Critical9.4	—	0.6%	Sep 19, 2026
26Monitor	CVE-2026-94000Proof of concept	Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membershipred hat · red hat build of keycloak · CWE-862 Broken access control (IDOR)	Medium6.6	—	0.4%	Sep 19, 2026
33Monitor	CVE-2026-93991No exploit	Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selectorargoproj · argo-workflows · CWE-639 Broken access control (IDOR)	High8.3	—	0.4%	Sep 19, 2026
28Monitor	CVE-2026-93992No exploit	Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversalgopeedlab · gopeed · CWE-22 Pre-auth Path traversal	High7.0	—	0.9%	Sep 19, 2026
34Monitor	CVE-2026-93993No exploit	Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkoutmistralai · mistral-vibe · CWE-829 pre-auth RCE	High8.6	—	0.7%	Sep 19, 2026
30Monitor	CVE-2026-94056No exploit	Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data fromexim · exim · CWE-908 Pre-auth Memory safety	High7.5	—	0.2%	Sep 19, 2026
35Monitor	CVE-2026-93958Proof of concept	D-Link R95 DHMAPI ssi system os command injectiond-link · r95 · CWE-77 RCE Command injection	High8.5	—	2.7%	Sep 19, 2026
28Monitor	CVE-2026-93988No exploit	QloApps through 1.7.0 Arbitrary File Read via getEmailHTMLwebkul · qloapps · CWE-22 Path traversal	High7.1	—	0.5%	Sep 19, 2026
34Monitor	CVE-2026-93990No exploit	Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogatelibexpat · libexpat · CWE-176 Pre-auth	High8.7	—	0.4%	Sep 19, 2026
21Monitor	CVE-2026-86552Proof of concept	A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APPzte · smartlife · CWE-269	Medium5.4	—	0.3%	Sep 20, 2026
35Monitor	CVE-2026-86553No exploit	A password reset vulnerability in ZTE SmartLife APPzte · smartlife · CWE-269	High8.8	—	0.5%	Sep 20, 2026
22Monitor	CVE-2026-93964No exploit	NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authenticationnginxproxymanager · nginx-proxy-manager · CWE-287 Pre-auth Auth bypass	Medium5.5	—	0.4%	Sep 20, 2026
37Monitor	CVE-2026-94083No exploit	Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even thoisf · suricata · CWE-843 Pre-auth	Critical9.4	—	0.5%	Sep 20, 2026
37Monitor	CVE-2026-94084No exploit	Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with oisf · suricata · CWE-416 Pre-auth Memory safety	Critical9.4	—	0.5%	Sep 20, 2026
28Monitor	CVE-2026-81650No exploit	NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Importunknown · photo gallery, sliders, proofing and themes · CWE-434 RCE File upload	High7.2	—	0.4%	Sep 20, 2026
32Monitor	CVE-2026-82842No exploit	SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matchingunknown · saml single sign on · CWE-269 Pre-auth	High8.1	—	0.3%	Sep 20, 2026
30Monitor	CVE-2026-85017No exploit	Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injectionunknown · unlimited elements for elementor · CWE-502 Deserialization	High7.5	—	0.4%	Sep 20, 2026
34Monitor	CVE-2026-87067No exploit	Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injectionunknown · forminator forms · CWE-94 RCE	High8.5	—	0.4%	Sep 20, 2026
30Monitor	CVE-2026-87839No exploit	Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletionunknown · tripzzy · CWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Sep 20, 2026
28Monitor	CVE-2026-92540No exploit	Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_usersunknown · import and export users and customers · CWE-269	High7.2	—	0.4%	Sep 20, 2026
28Monitor	CVE-2026-92541No exploit	Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importerunknown · import and export users and customers · CWE-269	High7.2	—	0.4%	Sep 20, 2026
37Monitor	CVE-2026-94003No exploit	Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflowcomfast · cf-n1-s · CWE-119 Pre-auth Memory safety	Critical9.3	—	0.6%	Sep 20, 2026
34Monitor	CVE-2026-94104No exploit	NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanagernivocart · nivocart · CWE-434 RCE File upload	High8.7	—	0.6%	Sep 20, 2026
34Monitor	CVE-2026-94106No exploit	getID3 before 1.9.26 OS Command Injection via Unescaped Filenamesjames-heinrich · getid3 · CWE-78 RCE Command injection	High8.7	—	1.6%	Sep 20, 2026
36Monitor	CVE-2026-94107No exploit	NivoCart through 2.4.0 Predictable Administrator Password Reset Tokennivocart · nivocart · CWE-338 Pre-auth Weak crypto	Critical9.2	—	0.5%	Sep 20, 2026
33Monitor	CVE-2026-94108No exploit	getID3 through 1.9.26 XML External Entity Injection via XML2arrayjames-heinrich · getid3 · CWE-611 Pre-auth SSRF XXE	High8.3	—	0.5%	Sep 20, 2026
27Monitor	CVE-2026-94111No exploit	Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemontencent · browserskill · CWE-346 Auth bypass	Medium6.9	—	0.1%	Sep 20, 2026
30Monitor	CVE-2026-94112No exploit	mayswind ezBookkeeping before 2.0.0 TOTP Replay Attackmayswind · ezbookkeeping · CWE-294 Pre-auth Auth bypass	High7.6	—	0.3%	Sep 20, 2026
28Monitor	CVE-2026-94113No exploit	Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpointsfrappe · erpnext · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Sep 20, 2026
40Plan	CVE-2026-90817Proof of concept	An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in whicvanderbilt university · redcap · CWE-73 pre-auth RCE Path traversal	Critical9.8	—	3.7%	Sep 20, 2026
29Monitor	CVE-2026-94036Proof of concept	D-Link DIR-X1860/DIR-X1860Z routerd ubus access controld-link · dir-x1860 · CWE-266 Pre-auth	High7.4	—	0.5%	Sep 20, 2026
34Monitor	CVE-2026-94109No exploit	openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRendereropenequella · openequella · CWE-1336 RCE SSTI	High8.6	—	0.7%	Sep 20, 2026
37Monitor	CVE-2026-88854Proof of concept	Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7ordasoft.com · ordasoft joomla gallery free extension for joomla · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.3%	Sep 20, 2026
34Monitor	CVE-2026-88855No exploit	Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7ordasoft.com · ordasoft joomla gallery free extension for joomla · CWE-89 SQL injection	High8.6	—	0.3%	Sep 20, 2026
37Monitor	CVE-2026-88856No exploit	Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7ordasoft.com · ordasoft joomla gallery free extension for joomla · CWE-94 RCE	Critical9.4	—	0.6%	Sep 20, 2026
37Monitor	CVE-2026-88857No exploit	Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7ordasoft.com · ordasoft joomla gallery free extension for joomla · CWE-434 RCE File upload	Critical9.4	—	0.6%	Sep 20, 2026
37Monitor	CVE-2026-94089No exploit	D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflowd-link · dir-868l · CWE-119 Pre-auth Memory safety	Critical9.3	—	0.9%	Sep 20, 2026
35Monitor	CVE-2026-94095Proof of concept	Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injectionnetcore · nbr200v2 · CWE-74 RCE Command injection	High8.6	—	2.3%	Sep 20, 2026
35Monitor	CVE-2026-94096No exploit	Netcore NBR200V2 LAN IP Configuration network_tools command injectionnetcore · nbr200v2 · CWE-74 RCE Command injection	High8.6	—	1.9%	Sep 20, 2026
38Monitor	CVE-2026-94097No exploit	Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injectionnetcore · nbr200v2 · CWE-74 pre-auth RCE Command injection	Critical9.3	—	2.9%	Sep 20, 2026
35Monitor	CVE-2026-94098No exploit	Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injectionnetcore · nbr200v2 · CWE-74 RCE Command injection	High8.5	—	2.3%	Sep 20, 2026
35Monitor	CVE-2026-94099No exploit	Netcore NBR200V2 Backup Restore restore.cgi command injectionnetcore · nbr200v2 · CWE-74 RCE Command injection	High8.6	—	1.6%	Sep 20, 2026
34Monitor	CVE-2026-94100No exploit	Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflownetcore · nbr200v2 · CWE-119 Memory safety	High8.6	—	0.8%	Sep 20, 2026
34Monitor	CVE-2026-94101No exploit	Netcore NBR200V2 routerd vlan_load_form_uci buffer overflownetcore · nbr200v2 · CWE-119 Memory safety	High8.6	—	0.4%	Sep 20, 2026
34Monitor	CVE-2026-94128Proof of concept	BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-wherebiostar · vivid led dj · CWE-119 Memory safety	High8.5	—	0.1%	Sep 20, 2026
34Monitor	CVE-2026-94129Proof of concept	BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-wherebiostar · valkyrie aurora · CWE-119 Memory safety	High8.5	—	0.1%	Sep 20, 2026
34Monitor	CVE-2026-94142No exploit	BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-wherebiostar · temperature monitor utility · CWE-119 Memory safety	High8.5	—	0.1%	Sep 21, 2026
39Monitor	CVE-2026-82187No exploit	WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Uploadunknown · web to print online designer · CWE-434 Pre-auth File upload	Critical9.8	—	0.5%	Sep 21, 2026
28Monitor	CVE-2026-90860No exploit	The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebViecanva · canva · CWE-212 Pre-auth	High7.1	—	0.3%	Sep 21, 2026
34Monitor	CVE-2026-94146No exploit	BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-wherebiostar · bios update utility · CWE-119 Memory safety	High8.5	—	0.1%	Sep 21, 2026
30Monitor	CVE-2026-47321No exploit	Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflateapache software foundation · apache mina · CWE-409 Pre-auth Denial of service	High7.5	—	0.4%	Sep 21, 2026
34Monitor	CVE-2026-16651No exploit	temporalio/sqlparser malformed MySQL version comments can cause a panictemporal technologies, inc. · temporalio/sqlparser · CWE-129 Pre-auth	High8.7	—	0.5%	Sep 21, 2026
28Monitor	CVE-2026-16652No exploit	Temporal Server Schedule exclusion search can cause excessive CPU consumptiontemporal technologies, inc. · temporal server · CWE-606	High7.1	—	0.4%	Sep 21, 2026
34Monitor	CVE-2026-65651No exploit	temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversaltemporal technologies, inc. · temporalio/sqlparser · CWE-674 Pre-auth Denial of service	High8.7	—	0.6%	Sep 21, 2026
34Monitor	CVE-2026-65652No exploit	temporalio/tchannel-go malformed checksum type causes process terminationtemporal technologies, inc. · temporalio/tchannel-go · CWE-129 Pre-auth	High8.7	—	0.7%	Sep 21, 2026
34Monitor	CVE-2026-65653No exploit	temporalio/tchannel-go zero-chunk call fragment causes process terminationtemporal technologies, inc. · temporalio/tchannel-go · CWE-129 Pre-auth	High8.7	—	0.7%	Sep 21, 2026
34Monitor	CVE-2026-65654No exploit	temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossiptemporal technologies, inc. · temporalio/ringpop-go · CWE-770 Pre-auth Denial of service	High8.7	—	0.5%	Sep 21, 2026
28Monitor	CVE-2026-87858No exploit	Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorizationtemporal technologies, inc. · temporal server · CWE-807	High7.2	—	0.7%	Sep 21, 2026
34Monitor	CVE-2026-89139No exploit	Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service hosttemporal technologies, inc. · temporal server · CWE-78 RCE Command injection	High8.7	—	0.5%	Sep 21, 2026
30Monitor	CVE-2026-91863No exploit	Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of serviceapache · neethi · CWE-674 Pre-auth Denial of service	High7.5	—	0.4%	Sep 21, 2026
30Monitor	CVE-2026-91864No exploit	Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustionapache · neethi · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Sep 21, 2026
30Monitor	CVE-2026-91865No exploit	Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of serviceapache · neethi · CWE-770 Pre-auth Denial of service	High7.5	—	0.6%	Sep 21, 2026
30Monitor	CVE-2026-91866No exploit	Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of serviceapache · neethi · CWE-770 Pre-auth Denial of service	High7.5	—	0.6%	Sep 21, 2026
28Monitor	CVE-2026-94368No exploit	Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source headerred hat · red hat openshift data foundation 4 · CWE-347 Weak crypto	High7.1	—	0.2%	Sep 21, 2026
36Monitor	CVE-2025-12999No exploit	UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwardeclipse foundation · eclipse open vsx · CWE-345 Pre-auth	Critical9.1	—	0.3%	Sep 21, 2026
32Monitor	CVE-2026-15801No exploit	Cri-o: cri-o: insufficient validation during container checkpoint restorered hat · red hat openshift container platform 4 · CWE-22 Path traversal	High8.0	—	0.4%	Sep 21, 2026
36Monitor	CVE-2026-84285No exploit	OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5dassault systèmes · tuleap enterprise edition · CWE-78 RCE Command injection	High8.8	—	1.8%	Sep 21, 2026
33Monitor	CVE-2026-94374No exploit	MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reportsmisp · misp · CWE-472 Broken access control (IDOR)	High8.3	—	0.3%	Sep 21, 2026
34Monitor	CVE-2026-94381No exploit	MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTimemisp · misp · CWE-269	High8.7	—	0.3%	Sep 21, 2026
34Monitor	CVE-2026-94383No exploit	MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extensionmisp · misp · CWE-20 RCE	High8.6	—	0.5%	Sep 21, 2026
35Monitor	CVE-2026-92574No exploit	Cri-o: cri-o checkpoint restore bypasses destination security contextred hat · confidential compute attestation · CWE-250	High8.8	—	0.6%	Sep 21, 2026
30Monitor	CVE-2026-88806No exploit	libX11 XkbGetMap Reply Heap-based Buffer Overflowx.org · libx11 · CWE-122 Pre-auth Memory safety	High7.5	—	0.2%	Sep 21, 2026
35Monitor	CVE-2026-88807No exploit	libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflowx.org · libxrender · CWE-122 Pre-auth Memory safety	High8.9	—	0.2%	Sep 21, 2026
33Monitor	CVE-2026-94401No exploit	MISP Arbitrary Local File Read and SSRF via MISP Export Uploadmisp · misp · CWE-73 SSRF Path traversal	High8.3	—	0.3%	Sep 21, 2026
28Monitor	CVE-2026-94404No exploit	MISP CSRF vulnerability allows unauthorized attribute modificationmisp · misp · CWE-352 Pre-auth CSRF	High7.1	—	0.2%	Sep 21, 2026
30Monitor	CVE-2026-52741No exploit	GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pagesgocd · gocd · CWE-80 XSS	High7.5	—	0.5%	Sep 21, 2026
33Monitor	CVE-2026-55071No exploit	MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`sepinetam · mcp-for-stata · CWE-94 RCE Command injection	High8.4	—	0.2%	Sep 21, 2026
32Monitor	CVE-2026-55074No exploit	Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)chofstede · ansible_jailexec · CWE-59 Pre-auth	High8.2	—	0.4%	Sep 21, 2026
31Monitor	CVE-2026-55567No exploit	BleachBit: Exploit File Delete to Escalate Privilegebleachbit · bleachbit · CWE-367 Local privilege escalation Race condition	High7.8	—	0.1%	Sep 21, 2026
32Monitor	CVE-2026-61628Proof of concept	nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Conditionlucasdillmann · nginx-ignition · CWE-362 Pre-auth Race condition	High8.1	—	0.4%	Sep 21, 2026

CVE-2026-92807
35Monitor
Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attri
HighCVSS 8.8No exploitEPSS 0%
- RCE
pdfcrowd · save as pdf plugin by pdfcrowdSep 18, 2026
CVE-2026-93741
37Monitor
Totolink A3002MU formWlWds buffer overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
totolink · a3002muSep 19, 2026
CVE-2026-76554
28Monitor
WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import
HighCVSS 7.2No exploitEPSS 0%
unknown · wp import export liteSep 19, 2026
CVE-2026-76790
28Monitor
Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
unknown · estatik real estate pluginSep 19, 2026
CVE-2026-85574
32Monitor
Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains
HighCVSS 8.0No exploitEPSS 0%
- Broken access control (IDOR)
unknown · unbounce landing pagesSep 19, 2026
CVE-2026-85680
35Monitor
Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · ultimate memberSep 19, 2026
CVE-2026-86591
39Monitor
Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · botiga proSep 19, 2026
CVE-2026-86814
32Monitor
UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
unknown · userswpSep 19, 2026
CVE-2026-88824
35Monitor
Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · master blocksSep 19, 2026
CVE-2026-88926
34Monitor
VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- SQL injection
unknown · vikrentitems flexible rental management systemSep 19, 2026
CVE-2026-92099
26Monitor
WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting
MediumCVSS 6.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · wpgraphql smart cacheSep 19, 2026
CVE-2026-92404
30Monitor
MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
unknown · mgosyncSep 19, 2026
CVE-2026-15664
28Monitor
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
mdmag · quill forms | conversational multi step forms, surveys & quizzesSep 19, 2026
CVE-2026-4327
35Monitor
The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
HighCVSS 8.8No exploitEPSS 0%
- RCE
sebwordpress · the welcomizerSep 19, 2026
CVE-2026-85658
32Monitor
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortco
HighCVSS 8.1No exploitEPSS 0%
- RCE
properfraction · paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressSep 19, 2026
CVE-2026-1255
30Monitor
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
ysinnovations · ys leadgen – popup builder, popup maker & form builder for wordpress | lead generation, email marketing, sales, conversions, opt-ins & subscribersSep 19, 2026
CVE-2026-93742
35Monitor
Totolink A3002MU formWsc command injection
HighCVSS 8.6No exploitEPSS 2%
- RCE
- Command injection
totolink · a3002muSep 19, 2026
CVE-2026-78030
39Monitor
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
Sep 19, 2026
RUSTSEC-2026-0328
28Monitor
`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)
HighCVSS 7.1No exploit
- Path traversal
Sep 19, 2026
CVE-2026-82560
30Monitor
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Sep 19, 2026
CVE-2026-93985
37Monitor
OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
openpanel-dev · openpanelSep 19, 2026
CVE-2026-94000
26Monitor
Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership
MediumCVSS 6.6Proof of conceptEPSS 0%
- Broken access control (IDOR)
red hat · red hat build of keycloakSep 19, 2026
CVE-2026-93991
33Monitor
Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
argoproj · argo-workflowsSep 19, 2026
CVE-2026-93992
28Monitor
Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Path traversal
gopeedlab · gopeedSep 19, 2026
CVE-2026-93993
34Monitor
Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout
HighCVSS 8.6No exploitEPSS 0%
- pre-auth RCE
mistralai · mistral-vibeSep 19, 2026
CVE-2026-94056
30Monitor
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
exim · eximSep 19, 2026
CVE-2026-93958
35Monitor
D-Link R95 DHMAPI ssi system os command injection
HighCVSS 8.5Proof of conceptEPSS 2%
- RCE
- Command injection
d-link · r95Sep 19, 2026
CVE-2026-93988
28Monitor
QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
webkul · qloappsSep 19, 2026
CVE-2026-93990
34Monitor
Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
libexpat · libexpatSep 19, 2026
CVE-2026-86552
21Monitor
A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
MediumCVSS 5.4Proof of conceptEPSS 0%
zte · smartlifeSep 20, 2026
CVE-2026-86553
35Monitor
A password reset vulnerability in ZTE SmartLife APP
HighCVSS 8.8No exploitEPSS 0%
zte · smartlifeSep 20, 2026
CVE-2026-93964
22Monitor
NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication
MediumCVSS 5.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
nginxproxymanager · nginx-proxy-managerSep 20, 2026
CVE-2026-94083
37Monitor
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even th
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
oisf · suricataSep 20, 2026
CVE-2026-94084
37Monitor
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Memory safety
oisf · suricataSep 20, 2026
CVE-2026-81650
28Monitor
NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import
HighCVSS 7.2No exploitEPSS 0%
- RCE
- File upload
unknown · photo gallery, sliders, proofing and themesSep 20, 2026
CVE-2026-82842
32Monitor
SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
unknown · saml single sign onSep 20, 2026
CVE-2026-85017
30Monitor
Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection
HighCVSS 7.5No exploitEPSS 0%
- Deserialization
unknown · unlimited elements for elementorSep 20, 2026
CVE-2026-87067
34Monitor
Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
HighCVSS 8.5No exploitEPSS 0%
- RCE
unknown · forminator formsSep 20, 2026
CVE-2026-87839
30Monitor
Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · tripzzySep 20, 2026
CVE-2026-92540
28Monitor
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users
HighCVSS 7.2No exploitEPSS 0%
unknown · import and export users and customersSep 20, 2026
CVE-2026-92541
28Monitor
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer
HighCVSS 7.2No exploitEPSS 0%
unknown · import and export users and customersSep 20, 2026
CVE-2026-94003
37Monitor
Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
comfast · cf-n1-sSep 20, 2026
CVE-2026-94104
34Monitor
NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
HighCVSS 8.7No exploitEPSS 0%
- RCE
- File upload
nivocart · nivocartSep 20, 2026
CVE-2026-94106
34Monitor
getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
HighCVSS 8.7No exploitEPSS 1%
- RCE
- Command injection
james-heinrich · getid3Sep 20, 2026
CVE-2026-94107
36Monitor
NivoCart through 2.4.0 Predictable Administrator Password Reset Token
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
nivocart · nivocartSep 20, 2026
CVE-2026-94108
33Monitor
getID3 through 1.9.26 XML External Entity Injection via XML2array
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- SSRF
- XXE
james-heinrich · getid3Sep 20, 2026
CVE-2026-94111
27Monitor
Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon
MediumCVSS 6.9No exploitEPSS 0%
- Auth bypass
tencent · browserskillSep 20, 2026
CVE-2026-94112
30Monitor
mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Auth bypass
mayswind · ezbookkeepingSep 20, 2026
CVE-2026-94113
28Monitor
Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
frappe · erpnextSep 20, 2026
CVE-2026-90817
40Plan
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in whic
CriticalCVSS 9.8Proof of conceptEPSS 3%
- pre-auth RCE
- Path traversal
vanderbilt university · redcapSep 20, 2026
CVE-2026-94036
29Monitor
D-Link DIR-X1860/DIR-X1860Z routerd ubus access control
HighCVSS 7.4Proof of conceptEPSS 0%
- Pre-auth
d-link · dir-x1860Sep 20, 2026
CVE-2026-94109
34Monitor
openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer
HighCVSS 8.6No exploitEPSS 0%
- RCE
- SSTI
openequella · openequellaSep 20, 2026
CVE-2026-88854
37Monitor
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
CriticalCVSS 9.3Proof of conceptEPSS 0%
- Pre-auth
- SQL injection
ordasoft.com · ordasoft joomla gallery free extension for joomlaSep 20, 2026
CVE-2026-88855
34Monitor
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
HighCVSS 8.6No exploitEPSS 0%
- SQL injection
ordasoft.com · ordasoft joomla gallery free extension for joomlaSep 20, 2026
CVE-2026-88856
37Monitor
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
ordasoft.com · ordasoft joomla gallery free extension for joomlaSep 20, 2026
CVE-2026-88857
37Monitor
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- File upload
ordasoft.com · ordasoft joomla gallery free extension for joomlaSep 20, 2026
CVE-2026-94089
37Monitor
D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
d-link · dir-868lSep 20, 2026
CVE-2026-94095
35Monitor
Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection
HighCVSS 8.6Proof of conceptEPSS 2%
- RCE
- Command injection
netcore · nbr200v2Sep 20, 2026
CVE-2026-94096
35Monitor
Netcore NBR200V2 LAN IP Configuration network_tools command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
netcore · nbr200v2Sep 20, 2026
CVE-2026-94097
38Monitor
Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
netcore · nbr200v2Sep 20, 2026
CVE-2026-94098
35Monitor
Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
netcore · nbr200v2Sep 20, 2026
CVE-2026-94099
35Monitor
Netcore NBR200V2 Backup Restore restore.cgi command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
netcore · nbr200v2Sep 20, 2026
CVE-2026-94100
34Monitor
Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
netcore · nbr200v2Sep 20, 2026
CVE-2026-94101
34Monitor
Netcore NBR200V2 routerd vlan_load_form_uci buffer overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
netcore · nbr200v2Sep 20, 2026
CVE-2026-94128
34Monitor
BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where
HighCVSS 8.5Proof of conceptEPSS 0%
- Memory safety
biostar · vivid led djSep 20, 2026
CVE-2026-94129
34Monitor
BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where
HighCVSS 8.5Proof of conceptEPSS 0%
- Memory safety
biostar · valkyrie auroraSep 20, 2026
CVE-2026-94142
34Monitor
BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-where
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
biostar · temperature monitor utilitySep 21, 2026
CVE-2026-82187
39Monitor
WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- File upload
unknown · web to print online designerSep 21, 2026
CVE-2026-90860
28Monitor
The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebVie
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
canva · canvaSep 21, 2026
CVE-2026-94146
34Monitor
BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where
HighCVSS 8.5No exploitEPSS 0%
- Memory safety
biostar · bios update utilitySep 21, 2026
CVE-2026-47321
30Monitor
Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache minaSep 21, 2026
CVE-2026-16651
34Monitor
temporalio/sqlparser malformed MySQL version comments can cause a panic
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
temporal technologies, inc. · temporalio/sqlparserSep 21, 2026
CVE-2026-16652
28Monitor
Temporal Server Schedule exclusion search can cause excessive CPU consumption
HighCVSS 7.1No exploitEPSS 0%
temporal technologies, inc. · temporal serverSep 21, 2026
CVE-2026-65651
34Monitor
temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
temporal technologies, inc. · temporalio/sqlparserSep 21, 2026
CVE-2026-65652
34Monitor
temporalio/tchannel-go malformed checksum type causes process termination
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
temporal technologies, inc. · temporalio/tchannel-goSep 21, 2026
CVE-2026-65653
34Monitor
temporalio/tchannel-go zero-chunk call fragment causes process termination
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
temporal technologies, inc. · temporalio/tchannel-goSep 21, 2026
CVE-2026-65654
34Monitor
temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
temporal technologies, inc. · temporalio/ringpop-goSep 21, 2026
CVE-2026-87858
28Monitor
Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
HighCVSS 7.2No exploitEPSS 0%
temporal technologies, inc. · temporal serverSep 21, 2026
CVE-2026-89139
34Monitor
Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Command injection
temporal technologies, inc. · temporal serverSep 21, 2026
CVE-2026-91863
30Monitor
Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · neethiSep 21, 2026
CVE-2026-91864
30Monitor
Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · neethiSep 21, 2026
CVE-2026-91865
30Monitor
Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · neethiSep 21, 2026
CVE-2026-91866
30Monitor
Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · neethiSep 21, 2026
CVE-2026-94368
28Monitor
Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header
HighCVSS 7.1No exploitEPSS 0%
- Weak crypto
red hat · red hat openshift data foundation 4Sep 21, 2026
CVE-2025-12999
36Monitor
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forward
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
eclipse foundation · eclipse open vsxSep 21, 2026
CVE-2026-15801
32Monitor
Cri-o: cri-o: insufficient validation during container checkpoint restore
HighCVSS 8.0No exploitEPSS 0%
- Path traversal
red hat · red hat openshift container platform 4Sep 21, 2026
CVE-2026-84285
36Monitor
OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
dassault systèmes · tuleap enterprise editionSep 21, 2026
CVE-2026-94374
33Monitor
MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports
HighCVSS 8.3No exploitEPSS 0%
- Broken access control (IDOR)
misp · mispSep 21, 2026
CVE-2026-94381
34Monitor
MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime
HighCVSS 8.7No exploitEPSS 0%
misp · mispSep 21, 2026
CVE-2026-94383
34Monitor
MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension
HighCVSS 8.6No exploitEPSS 0%
- RCE
misp · mispSep 21, 2026
CVE-2026-92574
35Monitor
Cri-o: cri-o checkpoint restore bypasses destination security context
HighCVSS 8.8No exploitEPSS 0%
red hat · confidential compute attestationSep 21, 2026
CVE-2026-88806
30Monitor
libX11 XkbGetMap Reply Heap-based Buffer Overflow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
x.org · libx11Sep 21, 2026
CVE-2026-88807
35Monitor
libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- Memory safety
x.org · libxrenderSep 21, 2026
CVE-2026-94401
33Monitor
MISP Arbitrary Local File Read and SSRF via MISP Export Upload
HighCVSS 8.3No exploitEPSS 0%
- SSRF
- Path traversal
misp · mispSep 21, 2026
CVE-2026-94404
28Monitor
MISP CSRF vulnerability allows unauthorized attribute modification
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- CSRF
misp · mispSep 21, 2026
CVE-2026-52741
30Monitor
GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages
HighCVSS 7.5No exploitEPSS 0%
- XSS
gocd · gocdSep 21, 2026
CVE-2026-55071
33Monitor
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Command injection
sepinetam · mcp-for-stataSep 21, 2026
CVE-2026-55074
32Monitor
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
chofstede · ansible_jailexecSep 21, 2026
CVE-2026-55567
31Monitor
BleachBit: Exploit File Delete to Escalate Privilege
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Race condition
bleachbit · bleachbitSep 21, 2026
CVE-2026-61628
32Monitor
nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
HighCVSS 8.1Proof of conceptEPSS 0%
- Pre-auth
- Race condition
lucasdillmann · nginx-ignitionSep 21, 2026