By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 59 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2026-61629No exploit	nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddlewarelucasdillmann · nginx-ignition · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Sep 21, 2026
28Monitor	CVE-2026-68919No exploit	GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pagesgocd · gocd · CWE-80 XSS	High7.0	—	0.4%	Sep 21, 2026
30Monitor	CVE-2026-71543No exploit	OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Charactersopenbao · openbao · CWE-863 Broken access control (IDOR)	High7.5	—	0.4%	Sep 21, 2026
39Monitor	CVE-2026-94301No exploit	Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232apache software foundation · apache mina · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Sep 21, 2026
28Monitor	CVE-2026-36467No exploit	Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access CWE-434 RCE File upload	High7.2	—	0.5%	Sep 21, 2026
36Monitor	CVE-2026-36469No exploit	CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload CWE-918 Pre-auth SSRF	Critical9.1	—	0.2%	Sep 21, 2026
35Monitor	CVE-2026-53940No exploit	Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementationconda · conda · CWE-22 Pre-auth Path traversal	High8.8	—	0.5%	Sep 21, 2026
35Monitor	CVE-2026-55563No exploit	Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persifeast-dev · feast · CWE-863 Broken access control (IDOR)	High8.9	—	0.4%	Sep 21, 2026
28Monitor	CVE-2026-61687No exploit	hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthStatehatchet-dev · hatchet · CWE-287 Pre-auth Auth bypass CSRF	High7.1	—	0.1%	Sep 21, 2026
35Monitor	CVE-2026-82412No exploit	ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST APIntop · ntopng · CWE-78 RCE Command injection CSRF	High8.8	—	0.6%	Sep 21, 2026
39Monitor	CVE-2026-85751No exploit	Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trustmailu · mailu · CWE-290 Pre-auth Auth bypass	Critical9.8	—	0.5%	Sep 21, 2026
36Monitor	CVE-2026-61674No exploit	Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handlerfluent · fluent-bit · CWE-121 pre-auth RCE Memory safety	Critical9.2	—	0.7%	Sep 21, 2026
35Monitor	CVE-2026-62371No exploit	KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 APIkubeedge · kubeedge · CWE-78 RCE Command injection	High8.8	—	0.4%	Sep 21, 2026
35Monitor	CVE-2026-63116No exploit	deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writesdeepstreamio · deepstream.io · CWE-862 Broken access control (IDOR)	High8.8	—	0.5%	Sep 21, 2026
30Monitor	CVE-2026-76898No exploit	draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.jsjgraph · drawio · CWE-918 Pre-auth SSRF	High7.7	—	0.3%	Sep 21, 2026
32Monitor	CVE-2026-77560No exploit	Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not ontinyauthapp · tinyauth · CWE-178	High8.1	—	0.6%	Sep 21, 2026
39Monitor	CVE-2026-79920No exploit	Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install taskajenti · ajenti · CWE-862 Broken access control (IDOR)	Critical9.9	—	0.6%	Sep 21, 2026
32Monitor	CVE-2026-83621No exploit	ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLsntop · ntopng · CWE-862 Broken access control (IDOR)	High8.1	—	0.5%	Sep 21, 2026
32Monitor	CVE-2026-48826No exploit	HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switchingsysadminsmedia · homebox · CWE-269	High8.1	—	0.4%	Sep 21, 2026
32Monitor	CVE-2026-48975No exploit	HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homeboxsysadminsmedia · homebox · CWE-639 Broken access control (IDOR)	High8.1	—	0.4%	Sep 21, 2026
32Monitor	CVE-2026-48976No exploit	HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijacksysadminsmedia · homebox · CWE-522 Broken access control (IDOR) Info leak	High8.1	—	0.4%	Sep 21, 2026
35Monitor	CVE-2026-62182No exploit	KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodeskubeedge · kubeedge · CWE-78 RCE Command injection	High8.8	—	0.4%	Sep 21, 2026
32Monitor	CVE-2026-62369No exploit	KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node joinkubeedge · kubeedge · CWE-22 Pre-auth Path traversal	High8.1	—	0.6%	Sep 21, 2026
34Monitor	CVE-2025-71421No exploit	UVdesk core-framework before 1.1.7 Privilege Escalation via editAgentuvdesk · core-framework · CWE-269	High8.6	—	0.6%	Sep 21, 2026
39Monitor	CVE-2026-93012No exploit	Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches CWE-78 pre-auth RCE Command injection	Critical9.8	—	0.6%	Sep 21, 2026
33Monitor	CVE-2026-94488No exploit	Telegram Desktop before 6.9.4 allows XSS in the HTML exporter.telegram · telegram desktop · CWE-79 XSS	High8.3	—	0.1%	Sep 21, 2026
31Monitor	CVE-2026-49810No exploit	Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability.dell · command powershell provider (dcpp) · CWE-532 Local privilege escalation Info leak	High7.8	—	0.1%	Sep 21, 2026
37Monitor	CVE-2026-58491No exploit	Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameterwarp-tech · warpgate · CWE-79 Pre-auth XSS Open redirect	Critical9.3	—	0.4%	Sep 21, 2026
34Monitor	CVE-2026-94403No exploit	ColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereferencecolorful · igamecenter · CWE-822	High8.5	—	0.1%	Sep 21, 2026
34Monitor	CVE-2026-94411No exploit	jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndTypejishenghua · jsherp · CWE-862 Broken access control (IDOR)	High8.7	—	0.5%	Sep 21, 2026
34Monitor	CVE-2026-94412No exploit	jshERP through 3.6 Authorization Bypass via resetPwdjishenghua · jsherp · CWE-862 Broken access control (IDOR)	High8.7	—	0.5%	Sep 21, 2026
28Monitor	CVE-2026-94413No exploit	jshERP through 3.6 Password Hash Disclosure via /user/infojishenghua · jsherp · CWE-200 Auth bypass Info leak	High7.1	—	0.5%	Sep 21, 2026
28Monitor	CVE-2026-94495No exploit	jshERP through 3.6 Missing Authorization via systemConfigjishenghua · jsherp · CWE-862 Broken access control (IDOR)	High7.1	—	0.4%	Sep 21, 2026
34Monitor	CVE-2026-94496No exploit	jshERP through 3.6 Privilege Escalation via Role Managementjishenghua · jsherp · CWE-862 Broken access control (IDOR)	High8.7	—	0.4%	Sep 21, 2026
34Monitor	CVE-2026-94497No exploit	jshERP through 3.6 Unauthorized Access via by-id Endpointsjishenghua · jsherp · CWE-639 Broken access control (IDOR)	High8.7	—	0.4%	Sep 21, 2026
34Monitor	CVE-2026-94501No exploit	jshERP through 3.6 Privilege Escalation via userBusiness CRUDjishenghua · jsherp · CWE-862 Broken access control (IDOR)	High8.7	—	0.5%	Sep 21, 2026
29Monitor	CVE-2026-75939No exploit	Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumedred hat · red hat openshift container platform 4 · CWE-347 Pre-auth Weak crypto	High7.4	—	0.3%	Sep 21, 2026
32Monitor	CVE-2026-80110No exploit	Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpointred hat · red hat certificate system 9 · CWE-863 Broken access control (IDOR)	High8.1	—	0.2%	Sep 21, 2026
36Monitor	CVE-2026-86473No exploit	Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiryapache · airflow · CWE-613 Pre-auth	Critical9.1	—	0.7%	Sep 21, 2026
33Monitor	CVE-2026-49811No exploit	Dell Command \| Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability.dell · command \| monitor (dcm) · CWE-732 Local privilege escalation	High8.4	—	0.1%	Sep 21, 2026
28Monitor	CVE-2026-52835No exploit	Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_databasetautulli · tautulli · CWE-22 Path traversal	High7.0	—	0.5%	Sep 21, 2026
35Monitor	CVE-2026-55897No exploit	luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as rootopenwrt · luci · CWE-78 RCE Command injection	High8.8	—	0.6%	Sep 21, 2026
32Monitor	CVE-2026-58269No exploit	Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`sync-in · server · CWE-288 Auth bypass	High8.1	—	0.2%	Sep 21, 2026
31Monitor	CVE-2026-81469No exploit	Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability.dell · inventory collector client · CWE-428 Local privilege escalation	High7.8	—	0.1%	Sep 21, 2026
28Monitor	CVE-2026-49450No exploit	Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherNamelaurent22 · joplin · CWE-345 Pre-auth	High7.1	—	0.1%	Sep 21, 2026
28Monitor	CVE-2026-49453No exploit	Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directorylaurent22 · joplin · CWE-20 Pre-auth Path traversal	High7.0	—	0.4%	Sep 21, 2026
30Monitor	CVE-2026-55105No exploit	Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewerlaurent22 · joplin · CWE-79 XSS	High7.7	—	0.4%	Sep 21, 2026
28Monitor	CVE-2026-61647No exploit	@roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directoryroomi-fields · notebooklm-mcp · CWE-22 Path traversal	High7.1	—	0.4%	Sep 21, 2026
39Monitor	CVE-2026-67827No exploit	Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) CWE-94 pre-auth RCE Auth bypass	Critical9.8	—	0.7%	Sep 21, 2026
40Plan	CVE-2026-77521Proof of concept	MaxKB: Prompt-injectable agent can lead to command execution1panel-dev · maxkb · CWE-78 pre-auth RCE Command injection	Critical10.0	—	1.0%	Sep 21, 2026
29Monitor	CVE-2026-77523No exploit	MaxKB: Cross-workspace model parameter form write1panel-dev · maxkb · CWE-639 Broken access control (IDOR)	High7.4	—	0.2%	Sep 21, 2026
30Monitor	CVE-2026-79316No exploit	An improper access control vulnerability exists in x-ui 0.3.2.CWE-284 Broken access control (IDOR)	High7.6	—	0.3%	Sep 21, 2026
36Monitor	CVE-2026-79916No exploit	MaxKB AWS Bedrock model credential injection leads to remote code execution1panel-dev · maxkb · CWE-78 RCE Command injection	Critical9.1	—	0.4%	Sep 21, 2026
39Monitor	CVE-2026-88402No exploit	A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injeCWE-89 Pre-auth SQL injection	Critical9.8	—	0.4%	Sep 21, 2026
39Monitor	CVE-2026-88404No exploit	A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of UCWE-94 pre-auth RCE	Critical9.8	—	0.7%	Sep 21, 2026
39Monitor	CVE-2026-88405No exploit	A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of UCWE-94 pre-auth RCE	Critical9.8	—	0.7%	Sep 21, 2026
30Monitor	CVE-2026-88406No exploit	FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validCWE-121 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Sep 21, 2026
30Monitor	CVE-2026-88407No exploit	An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Sep 21, 2026
35Monitor	CVE-2026-88409No exploit	FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matriCWE-120 Memory safety	High8.8	—	0.4%	Sep 21, 2026
28Monitor	CVE-2026-88410No exploit	The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the CWE-306 Auth bypass	High7.1	—	0.3%	Sep 21, 2026
30Monitor	CVE-2026-88411No exploit	Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of SerCWE-248 Pre-auth Denial of service	High7.5	—	0.4%	Sep 21, 2026
28Monitor	CVE-2026-88746No exploit	idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.CWE-79 Pre-auth XSS	High7.1	—	0.2%	Sep 21, 2026
37Monitor	CVE-2026-94424No exploit	Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140001000 heap-based overflowmoore threads · mtt s80 driver package · CWE-119 Memory safety	Critical9.3	—	0.1%	Sep 21, 2026
37Monitor	CVE-2026-94571No exploit	In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirectopenstack · octavia · CWE-94 RCE	Critical9.4	—	0.5%	Sep 21, 2026
37Monitor	CVE-2026-94572No exploit	In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control charactopenstack · octavia · CWE-94 RCE	Critical9.4	—	0.5%	Sep 21, 2026
35Monitor	CVE-2026-84990No exploit	ntopng: Missing Authorization on System Configuration Backup Download and Listingntop · ntopng · CWE-200 Info leak	High8.8	—	0.3%	Sep 21, 2026
30Monitor	CVE-2026-94449No exploit	Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of servicered hat · exploit intelligence · CWE-400 Pre-auth Denial of service	High7.5	—	1.0%	Sep 21, 2026
29Monitor	CVE-2026-55210No exploit	Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)laurent22 · joplin · CWE-290 Pre-auth Auth bypass	High7.4	—	0.4%	Sep 21, 2026
30Monitor	CVE-2026-59814No exploit	Joplin: Stored XSS via inline-served note attachment on published shareslaurent22 · joplin · CWE-79 XSS CSRF	High7.6	—	0.3%	Sep 21, 2026
34Monitor	CVE-2026-61652No exploit	Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)kap-sh · zapros · CWE-770 Pre-auth Denial of service	High8.7	—	0.4%	Sep 21, 2026
39Monitor	CVE-2026-78847No exploit	An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter wCWE-95 pre-auth RCE	Critical9.8	—	0.5%	Sep 21, 2026
31Monitor	CVE-2026-79079No exploit	An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c comCWE-78 RCE Command injection	High7.8	—	0.1%	Sep 21, 2026
35Monitor	CVE-2026-88738No exploit	Jazzware RT1000 Edge webUI v.CWE-434 RCE Auth bypass File upload	High8.8	—	0.6%	Sep 21, 2026
29Monitor	CVE-2026-93340No exploit	Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpointgladys assistant · gladys assistant · CWE-640 Pre-auth	High7.4	—	0.5%	Sep 21, 2026
28Monitor	CVE-2026-94532No exploit	lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoByIddromara · lamp-cloud · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Sep 21, 2026
28Monitor	CVE-2026-94533No exploit	lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/filedromara · lamp-cloud · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Sep 21, 2026
28Monitor	CVE-2026-94534No exploit	lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpointsdromara · lamp-cloud · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Sep 21, 2026
28Monitor	CVE-2026-94535No exploit	lamp-cloud through 5.10.0 Unauthorized Notification Deletiondromara · lamp-cloud · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Sep 21, 2026
29Monitor	CVE-2026-94540No exploit	DesktopSMS 1.11.0 Unauthorized Access via Local Servicemrpear · desktopsms · CWE-306 Auth bypass Local privilege escalation	High7.4	—	0.1%	Sep 21, 2026
37Monitor	CVE-2026-94425No exploit	Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges managementmoore threads · mtt s80 driver package · CWE-266 Local privilege escalation	Critical9.3	—	0.1%	Sep 21, 2026
31Monitor	CVE-2026-17052No exploit	Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspacezephyrproject · zephyr · CWE-787 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 21, 2026
30Monitor	CVE-2026-63330No exploit	Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessionswarp-tech · warpgate · CWE-285 Broken access control (IDOR)	High7.7	—	0.4%	Sep 21, 2026
35Monitor	CVE-2026-55159No exploit	luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entriesopenwrt · luci-app-adblock-fast · CWE-93 RCE	High8.8	—	0.6%	Sep 21, 2026
30Monitor	CVE-2026-73512No exploit	Envoy: use-after-free in QUIC on internal redirectsenvoyproxy · envoy · CWE-416 Pre-auth Memory safety Denial of service	High7.5	—	0.8%	Sep 21, 2026
30Monitor	CVE-2026-73513No exploit	Envoy: oghttp2 upstream trailers incorrect handlingenvoyproxy · envoy · CWE-20 Pre-auth Denial of service	High7.5	—	0.4%	Sep 21, 2026
29Monitor	CVE-2026-73546No exploit	Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)envoyproxy · envoy · CWE-79 Pre-auth XSS	High7.4	—	0.6%	Sep 21, 2026
30Monitor	CVE-2026-73547No exploit	Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null checkenvoyproxy · envoy · CWE-20 Pre-auth Denial of service	High7.5	—	0.5%	Sep 21, 2026
30Monitor	CVE-2026-73548No exploit	Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend poolenvoyproxy · envoy · CWE-444 Pre-auth	High7.5	—	0.4%	Sep 21, 2026
30Monitor	CVE-2026-73550No exploit	Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoyenvoyproxy · envoy · CWE-401 Pre-auth Denial of service	High7.5	—	0.5%	Sep 21, 2026
30Monitor	CVE-2026-73552No exploit	Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header valuesenvoyproxy · envoy · CWE-20 Pre-auth	High7.5	—	0.4%	Sep 21, 2026
30Monitor	CVE-2026-93710No exploit	Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooksCWE-460 Pre-auth Denial of service	High7.5	—	0.6%	Sep 21, 2026
30Monitor	CVE-2026-93712No exploit	Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handlerCWE-22 Pre-auth Path traversal	High7.5	—	0.5%	Sep 21, 2026
37Monitor	CVE-2026-94493No exploit	Gigatech PDV5701 WebSocket Service index.html missing authenticationgigatech · pdv5701 · CWE-287 Pre-auth Auth bypass	Critical9.3	—	0.7%	Sep 21, 2026
36Monitor	CVE-2026-46649No exploit	Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpointlaurent22 · joplin · CWE-307 Pre-auth	Critical9.1	—	0.5%	Sep 21, 2026
30Monitor	CVE-2026-73553No exploit	Envoy: RBAC Authorization Bypass via Path Parametersenvoyproxy · envoy · CWE-436 Pre-auth	High7.5	—	0.5%	Sep 21, 2026
31Monitor	CVE-2026-65980No exploit	Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitutionchartbrew · chartbrew · CWE-89 pre-auth RCE Auth bypass SQL injection	High7.9	—	0.4%	Sep 21, 2026
34Monitor	CVE-2026-94622No exploit	vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadatavllm · vllm · CWE-248 Pre-auth	High8.7	—	0.6%	Sep 21, 2026
34Monitor	CVE-2026-94623No exploit	vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failurevllm · vllm · CWE-617 Pre-auth	High8.7	—	0.6%	Sep 21, 2026
34Monitor	CVE-2026-94624No exploit	vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessionsvllm · vllm · CWE-770 Pre-auth Denial of service	High8.7	—	0.4%	Sep 21, 2026
34Monitor	CVE-2026-94626No exploit	vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_sizevllm · vllm · CWE-789 Pre-auth	High8.7	—	0.6%	Sep 21, 2026

CVE-2026-61629
30Monitor
nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
lucasdillmann · nginx-ignitionSep 21, 2026
CVE-2026-68919
28Monitor
GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages
HighCVSS 7.0No exploitEPSS 0%
- XSS
gocd · gocdSep 21, 2026
CVE-2026-71543
30Monitor
OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters
HighCVSS 7.5No exploitEPSS 0%
- Broken access control (IDOR)
openbao · openbaoSep 21, 2026
CVE-2026-94301
39Monitor
Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
apache software foundation · apache minaSep 21, 2026
CVE-2026-36467
28Monitor
Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access
HighCVSS 7.2No exploitEPSS 0%
- RCE
- File upload
Sep 21, 2026
CVE-2026-36469
36Monitor
CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SSRF
Sep 21, 2026
CVE-2026-53940
35Monitor
Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
conda · condaSep 21, 2026
CVE-2026-55563
35Monitor
Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persi
HighCVSS 8.9No exploitEPSS 0%
- Broken access control (IDOR)
feast-dev · feastSep 21, 2026
CVE-2026-61687
28Monitor
hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- CSRF
hatchet-dev · hatchetSep 21, 2026
CVE-2026-82412
35Monitor
ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
- CSRF
ntop · ntopngSep 21, 2026
CVE-2026-85751
39Monitor
Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
mailu · mailuSep 21, 2026
CVE-2026-61674
36Monitor
Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- Memory safety
fluent · fluent-bitSep 21, 2026
CVE-2026-62371
35Monitor
KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
kubeedge · kubeedgeSep 21, 2026
CVE-2026-63116
35Monitor
deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
deepstreamio · deepstream.ioSep 21, 2026
CVE-2026-76898
30Monitor
draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- SSRF
jgraph · drawioSep 21, 2026
CVE-2026-77560
32Monitor
Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on
HighCVSS 8.1No exploitEPSS 0%
tinyauthapp · tinyauthSep 21, 2026
CVE-2026-79920
39Monitor
Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task
CriticalCVSS 9.9No exploitEPSS 0%
- Broken access control (IDOR)
ajenti · ajentiSep 21, 2026
CVE-2026-83621
32Monitor
ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
ntop · ntopngSep 21, 2026
CVE-2026-48826
32Monitor
HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching
HighCVSS 8.1No exploitEPSS 0%
sysadminsmedia · homeboxSep 21, 2026
CVE-2026-48975
32Monitor
HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
sysadminsmedia · homeboxSep 21, 2026
CVE-2026-48976
32Monitor
HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
- Info leak
sysadminsmedia · homeboxSep 21, 2026
CVE-2026-62182
35Monitor
KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
kubeedge · kubeedgeSep 21, 2026
CVE-2026-62369
32Monitor
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Path traversal
kubeedge · kubeedgeSep 21, 2026
CVE-2025-71421
34Monitor
UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent
HighCVSS 8.6No exploitEPSS 0%
uvdesk · core-frameworkSep 21, 2026
CVE-2026-93012
39Monitor
Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Command injection
Sep 21, 2026
CVE-2026-94488
33Monitor
Telegram Desktop before 6.9.4 allows XSS in the HTML exporter.
HighCVSS 8.3No exploitEPSS 0%
- XSS
telegram · telegram desktopSep 21, 2026
CVE-2026-49810
31Monitor
Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Info leak
dell · command powershell provider (dcpp)Sep 21, 2026
CVE-2026-58491
37Monitor
Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
- Open redirect
warp-tech · warpgateSep 21, 2026
CVE-2026-94403
34Monitor
ColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereference
HighCVSS 8.5No exploitEPSS 0%
colorful · igamecenterSep 21, 2026
CVE-2026-94411
34Monitor
jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
jishenghua · jsherpSep 21, 2026
CVE-2026-94412
34Monitor
jshERP through 3.6 Authorization Bypass via resetPwd
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
jishenghua · jsherpSep 21, 2026
CVE-2026-94413
28Monitor
jshERP through 3.6 Password Hash Disclosure via /user/info
HighCVSS 7.1No exploitEPSS 0%
- Auth bypass
- Info leak
jishenghua · jsherpSep 21, 2026
CVE-2026-94495
28Monitor
jshERP through 3.6 Missing Authorization via systemConfig
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
jishenghua · jsherpSep 21, 2026
CVE-2026-94496
34Monitor
jshERP through 3.6 Privilege Escalation via Role Management
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
jishenghua · jsherpSep 21, 2026
CVE-2026-94497
34Monitor
jshERP through 3.6 Unauthorized Access via by-id Endpoints
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
jishenghua · jsherpSep 21, 2026
CVE-2026-94501
34Monitor
jshERP through 3.6 Privilege Escalation via userBusiness CRUD
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
jishenghua · jsherpSep 21, 2026
CVE-2026-75939
29Monitor
Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Weak crypto
red hat · red hat openshift container platform 4Sep 21, 2026
CVE-2026-80110
32Monitor
Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
red hat · red hat certificate system 9Sep 21, 2026
CVE-2026-86473
36Monitor
Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache · airflowSep 21, 2026
CVE-2026-49811
33Monitor
Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability.
HighCVSS 8.4No exploitEPSS 0%
- Local privilege escalation
dell · command | monitor (dcm)Sep 21, 2026
CVE-2026-52835
28Monitor
Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database
HighCVSS 7.0No exploitEPSS 0%
- Path traversal
tautulli · tautulliSep 21, 2026
CVE-2026-55897
35Monitor
luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
openwrt · luciSep 21, 2026
CVE-2026-58269
32Monitor
Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
HighCVSS 8.1No exploitEPSS 0%
- Auth bypass
sync-in · serverSep 21, 2026
CVE-2026-81469
31Monitor
Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
dell · inventory collector clientSep 21, 2026
CVE-2026-49450
28Monitor
Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
laurent22 · joplinSep 21, 2026
CVE-2026-49453
28Monitor
Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
- Path traversal
laurent22 · joplinSep 21, 2026
CVE-2026-55105
30Monitor
Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer
HighCVSS 7.7No exploitEPSS 0%
- XSS
laurent22 · joplinSep 21, 2026
CVE-2026-61647
28Monitor
@roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
roomi-fields · notebooklm-mcpSep 21, 2026
CVE-2026-67827
39Monitor
Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE)
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
Sep 21, 2026
CVE-2026-77521
40Plan
MaxKB: Prompt-injectable agent can lead to command execution
CriticalCVSS 10.0Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
1panel-dev · maxkbSep 21, 2026
CVE-2026-77523
29Monitor
MaxKB: Cross-workspace model parameter form write
HighCVSS 7.4No exploitEPSS 0%
- Broken access control (IDOR)
1panel-dev · maxkbSep 21, 2026
CVE-2026-79316
30Monitor
An improper access control vulnerability exists in x-ui 0.3.2.
HighCVSS 7.6No exploitEPSS 0%
- Broken access control (IDOR)
Sep 21, 2026
CVE-2026-79916
36Monitor
MaxKB AWS Bedrock model credential injection leads to remote code execution
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Command injection
1panel-dev · maxkbSep 21, 2026
CVE-2026-88402
39Monitor
A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via inje
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- SQL injection
Sep 21, 2026
CVE-2026-88404
39Monitor
A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of U
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 21, 2026
CVE-2026-88405
39Monitor
A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of U
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 21, 2026
CVE-2026-88406
30Monitor
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_valid
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
Sep 21, 2026
CVE-2026-88407
30Monitor
An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
Sep 21, 2026
CVE-2026-88409
35Monitor
FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matri
HighCVSS 8.8No exploitEPSS 0%
- Memory safety
Sep 21, 2026
CVE-2026-88410
28Monitor
The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the
HighCVSS 7.1No exploitEPSS 0%
- Auth bypass
Sep 21, 2026
CVE-2026-88411
30Monitor
Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Ser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Sep 21, 2026
CVE-2026-88746
28Monitor
idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
Sep 21, 2026
CVE-2026-94424
37Monitor
Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140001000 heap-based overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Memory safety
moore threads · mtt s80 driver packageSep 21, 2026
CVE-2026-94571
37Monitor
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
openstack · octaviaSep 21, 2026
CVE-2026-94572
37Monitor
In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control charact
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
openstack · octaviaSep 21, 2026
CVE-2026-84990
35Monitor
ntopng: Missing Authorization on System Configuration Backup Download and Listing
HighCVSS 8.8No exploitEPSS 0%
- Info leak
ntop · ntopngSep 21, 2026
CVE-2026-94449
30Monitor
Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service
HighCVSS 7.5No exploitEPSS 1%
- Pre-auth
- Denial of service
red hat · exploit intelligenceSep 21, 2026
CVE-2026-55210
29Monitor
Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
laurent22 · joplinSep 21, 2026
CVE-2026-59814
30Monitor
Joplin: Stored XSS via inline-served note attachment on published shares
HighCVSS 7.6No exploitEPSS 0%
- XSS
- CSRF
laurent22 · joplinSep 21, 2026
CVE-2026-61652
34Monitor
Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
kap-sh · zaprosSep 21, 2026
CVE-2026-78847
39Monitor
An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter w
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 21, 2026
CVE-2026-79079
31Monitor
An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c com
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
Sep 21, 2026
CVE-2026-88738
35Monitor
Jazzware RT1000 Edge webUI v.
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Auth bypass
- File upload
Sep 21, 2026
CVE-2026-93340
29Monitor
Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
gladys assistant · gladys assistantSep 21, 2026
CVE-2026-94532
28Monitor
lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dromara · lamp-cloudSep 21, 2026
CVE-2026-94533
28Monitor
lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dromara · lamp-cloudSep 21, 2026
CVE-2026-94534
28Monitor
lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dromara · lamp-cloudSep 21, 2026
CVE-2026-94535
28Monitor
lamp-cloud through 5.10.0 Unauthorized Notification Deletion
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
dromara · lamp-cloudSep 21, 2026
CVE-2026-94540
29Monitor
DesktopSMS 1.11.0 Unauthorized Access via Local Service
HighCVSS 7.4No exploitEPSS 0%
- Auth bypass
- Local privilege escalation
mrpear · desktopsmsSep 21, 2026
CVE-2026-94425
37Monitor
Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management
CriticalCVSS 9.3No exploitEPSS 0%
- Local privilege escalation
moore threads · mtt s80 driver packageSep 21, 2026
CVE-2026-17052
31Monitor
Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
zephyrproject · zephyrSep 21, 2026
CVE-2026-63330
30Monitor
Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
warp-tech · warpgateSep 21, 2026
CVE-2026-55159
35Monitor
luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries
HighCVSS 8.8No exploitEPSS 0%
- RCE
openwrt · luci-app-adblock-fastSep 21, 2026
CVE-2026-73512
30Monitor
Envoy: use-after-free in QUIC on internal redirects
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
envoyproxy · envoySep 21, 2026
CVE-2026-73513
30Monitor
Envoy: oghttp2 upstream trailers incorrect handling
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
envoyproxy · envoySep 21, 2026
CVE-2026-73546
29Monitor
Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- XSS
envoyproxy · envoySep 21, 2026
CVE-2026-73547
30Monitor
Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
envoyproxy · envoySep 21, 2026
CVE-2026-73548
30Monitor
Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
envoyproxy · envoySep 21, 2026
CVE-2026-73550
30Monitor
Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
envoyproxy · envoySep 21, 2026
CVE-2026-73552
30Monitor
Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
envoyproxy · envoySep 21, 2026
CVE-2026-93710
30Monitor
Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Sep 21, 2026
CVE-2026-93712
30Monitor
Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Path traversal
Sep 21, 2026
CVE-2026-94493
37Monitor
Gigatech PDV5701 WebSocket Service index.html missing authentication
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
gigatech · pdv5701Sep 21, 2026
CVE-2026-46649
36Monitor
Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
laurent22 · joplinSep 21, 2026
CVE-2026-73553
30Monitor
Envoy: RBAC Authorization Bypass via Path Parameters
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
envoyproxy · envoySep 21, 2026
CVE-2026-65980
31Monitor
Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution
HighCVSS 7.9No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
- SQL injection
chartbrew · chartbrewSep 21, 2026
CVE-2026-94622
34Monitor
vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
vllm · vllmSep 21, 2026
CVE-2026-94623
34Monitor
vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
vllm · vllmSep 21, 2026
CVE-2026-94624
34Monitor
vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
vllm · vllmSep 21, 2026
CVE-2026-94626
34Monitor
vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
vllm · vllmSep 21, 2026