Skip to content
Noroxi
By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 6 of 80

  • CVE-2026-84964
    32Monitor

    Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client

    HighCVSS 8.2No exploitEPSS 0%

    mongodb · c driverSep 3, 2026

  • CVE-2026-85236
    35Monitor

    MISP cullEmptyEvents CSRF Allows Irreversible Deletion of Events via GET Request

    HighCVSS 8.8No exploitEPSS 0%

    misp-project · mispSep 3, 2026

  • CVE-2026-85237
    34Monitor

    Missing Rate Limiting in Email OTP Verification Allows Brute-Force Authentication Bypass

    HighCVSS 8.6No exploitEPSS 0%

    misp-project · mispSep 3, 2026

  • CVE-2026-85238
    30Monitor

    Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking

    HighCVSS 7.6No exploitEPSS 0%

    misp-project · mispSep 3, 2026

  • CVE-2026-85239
    28Monitor

    MISP Event Template Definition Validation Bypass Allows Persistent Denial of Service

    HighCVSS 7.1No exploitEPSS 0%

    misp-project · mispSep 3, 2026

  • CVE-2026-71220
    28Monitor

    Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked di_height in gfs2_edit

    HighCVSS 7.0No exploitEPSS 0%

    redhat · enterprise linuxSep 3, 2026

  • CVE-2026-71221
    28Monitor

    Gfs2-utils: gfs2-utils: stack out-of-bounds write via unchecked height in savemeta

    HighCVSS 7.0No exploitEPSS 0%

    redhat · enterprise linuxSep 3, 2026

  • CVE-2026-73600
    31Monitor

    Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent.

    HighCVSS 7.8No exploitEPSS 0%

    dell · powerprotect data managerSep 3, 2026

  • CVE-2026-80465
    35Monitor

    A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All v

    HighCVSS 8.8No exploitEPSS 0%

    siemens · mendix saml (mendix 10 compatible)Sep 3, 2026

  • CVE-2026-80731
    31Monitor

    net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header

    HighCVSS 7.8No exploitEPSS 0%

    linux · linuxSep 3, 2026

  • CVE-2026-80734
    35Monitor

    btrfs: initialize inode mapping flags for cached inodes

    HighCVSS 8.8No exploitEPSS 0%

    linux · linuxSep 3, 2026

  • CVE-2026-80737
    31Monitor

    serial: amba-pl011: synchronize DMA teardown

    HighCVSS 7.8No exploitEPSS 0%

    linux · linuxSep 3, 2026

  • CVE-2026-80738
    29Monitor

    bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie

    HighCVSS 7.3No exploitEPSS 0%

    linux · linuxSep 3, 2026

  • CVE-2026-80747
    32Monitor

    drm/amdkfd: Add bounds check for CRAT subtype length

    HighCVSS 8.0No exploitEPSS 0%

    linux · linuxSep 3, 2026

  • CVE-2026-80754
    31Monitor

    Input: synaptics-rmi4 - fix F55 transmitter electrode count typo

    HighCVSS 7.8No exploitEPSS 0%

    linux · linuxSep 3, 2026

  • CVE-2026-85150
    30Monitor

    Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/ww

    HighCVSS 7.5No exploitEPSS 0%

    red hat · red hat enterprise linux 10Sep 3, 2026

  • CVE-2026-85165
    28Monitor

    n8n before 2.36.2 Expression Sandbox Bypass via SpreadElement

    HighCVSS 7.2No exploitEPSS 0%

    n8n · n8nSep 3, 2026

  • CVE-2026-85166
    28Monitor

    n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node

    HighCVSS 7.2No exploitEPSS 0%

    n8n · n8nSep 3, 2026

  • CVE-2026-85168
    30Monitor

    n8n before 1.123.73 Remote Code Execution via Git Node

    HighCVSS 7.7Proof of conceptEPSS 0%

    n8n · n8nSep 3, 2026

  • CVE-2026-85169
    34Monitor

    n8n before 1.123.73 Remote Code Execution via $fromAI Prototype Leak

    HighCVSS 8.7No exploitEPSS 0%

    n8n · n8nSep 3, 2026

  • CVE-2026-85170
    28Monitor

    n8n before 1.123.73 Local File Read and SSRF via Gmail and Brevo nodes

    HighCVSS 7.1No exploitEPSS 0%

    n8n · n8nSep 3, 2026

  • CVE-2026-85171
    28Monitor

    n8n before 1.123.73 Credential Exposure via Error Logging

    HighCVSS 7.1No exploitEPSS 0%

    n8n · n8nSep 3, 2026

  • CVE-2026-81292
    28Monitor

    WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    ido kobelkowsky · simple paymentSep 3, 2026

  • CVE-2026-81295
    28Monitor

    WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    underconstructionpage · under constructionSep 3, 2026

  • CVE-2026-81300
    28Monitor

    WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    silverplugins217 · calculation for contact form 7Sep 3, 2026

  • CVE-2026-81773
    28Monitor

    WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    saturday drive · ninja forms file uploads extensionSep 3, 2026

  • CVE-2026-81776
    28Monitor

    WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    advanpix · wp quicklatexSep 3, 2026

  • CVE-2026-84238
    39Monitor

    WordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    yith · yith request a quote for woocommerce premiumSep 3, 2026

  • CVE-2026-84736
    33Monitor

    In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables

    HighCVSS 8.3No exploitEPSS 0%

    eclipse foundation · eclipse aeriosSep 3, 2026

  • CVE-2026-84752
    35Monitor

    WordPress RTMKit plugin <= 2.1.5 - PHP Object Injection vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    rometheme · rtmkitSep 3, 2026

  • CVE-2026-84753
    39Monitor

    WordPress Mail Mint plugin <= 1.31.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    wpfunnels · mail mintSep 3, 2026

  • CVE-2026-84756
    28Monitor

    WordPress WCFM Membership plugin <= 2.11.11 - Privilege Escalation vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wc lovers · wcfm membershipSep 3, 2026

  • CVE-2026-84757
    32Monitor

    WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability

    HighCVSS 8.2No exploitEPSS 0%

    aresit · wp compressSep 3, 2026

  • CVE-2026-84761
    28Monitor

    WordPress LiteSpeed Cache plugin <= 7.9 - Server Side Request Forgery (SSRF) vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    litespeed technologies · litespeed cacheSep 3, 2026

  • CVE-2026-84763
    28Monitor

    WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    rometheme · rtmkitSep 3, 2026

  • CVE-2026-84765
    28Monitor

    WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    john havlik · breadcrumb navxtSep 3, 2026

  • CVE-2026-84768
    37Monitor

    WordPress VikAppointments Services Booking Calendar plugin <= 1.2.20 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    e4jvikwp · vikappointments services booking calendarSep 3, 2026

  • CVE-2026-84773
    28Monitor

    WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.2No exploitEPSS 0%

    作者: shane bishop · ewww image optimizerSep 3, 2026

  • CVE-2026-84776
    30Monitor

    WordPress MalCare Security plugin <= 6.69 - Denial of Service Attack vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    malcare · malcare securitySep 3, 2026

  • CVE-2026-84777
    29Monitor

    WordPress Really Simple SSL plugin <= 9.8.0 - 2FA Bypass vulnerability

    HighCVSS 7.4No exploitEPSS 0%

    really simple plugins · really simple sslSep 3, 2026

  • CVE-2026-84778
    30Monitor

    WordPress Migrate Guru – Site Migration & Cloning plugin <= 6.65 - Denial of Service Attack vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    migrateguru · migrate guru – site migration &amp; cloningSep 3, 2026

  • CVE-2026-84779
    32Monitor

    WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability

    HighCVSS 8.1No exploitEPSS 0%

    sheikh heera · agentimus – ai seo, llms.txt &amp; mcp for ai agentsSep 3, 2026

  • CVE-2026-84812
    28Monitor

    WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    wordplus · bp better messagesSep 3, 2026

  • CVE-2026-84813
    37Monitor

    WordPress GeoDirectory plugin <= 2.8.174 - SQL Injection vulnerability

    CriticalCVSS 9.3No exploitEPSS 0%

    paolo · geodirectorySep 3, 2026

  • CVE-2026-84814
    39Monitor

    WordPress Bricksforge plugin <= 3.1.8.8 - Privilege Escalation vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    bricksforge. · bricksforgeSep 3, 2026

  • CVE-2026-84834
    39Monitor

    WordPress JobSearch plugin <= 3.2.0 - PHP Object Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    eyecix · jobsearchSep 3, 2026

  • CVE-2026-84836
    28Monitor

    WordPress WC Ukraine Shipping plugin <= 1.22.3 - Insecure Direct Object References (IDOR) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    kirillbdev · wc ukraine shippingSep 3, 2026

  • CVE-2026-84847
    30Monitor

    WordPress Quick Event Manager plugin <= 9.17 - Broken Access Control vulnerability

    HighCVSS 7.5No exploitEPSS 0%

    brightvesseldev · quick event managerSep 3, 2026

  • CVE-2026-84848
    28Monitor

    WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability

    HighCVSS 7.1No exploitEPSS 0%

    brightvesseldev · quick event managerSep 3, 2026

  • CVE-2025-12737
    33Monitor

    Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

    HighCVSS 8.4No exploitEPSS 0%

    wso2 · api control planeSep 3, 2026

  • CVE-2026-58400
    36Monitor

    GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter

    CriticalCVSS 9.1No exploitEPSS 1%

    geonetwork · core-geonetworkSep 3, 2026

  • CVE-2026-63219
    34Monitor

    Unauthenticated file upload via missing authorization on formatter upload endpoint

    HighCVSS 8.6No exploitEPSS 0%

    geonetwork · core-geonetworkSep 3, 2026

  • CVE-2026-83959
    31Monitor

    Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)

    HighCVSS 7.8No exploitEPSS 0%

    adobe · substance 3d samplerSep 3, 2026

  • CVE-2026-85012
    35Monitor

    OS command injection in the Amazon CodeCatalyst blueprints SDK

    HighCVSS 8.5No exploitEPSS 2%

    aws · @amazon-codecatalyst/blueprints.blueprintSep 3, 2026

  • CVE-2026-15431
    29Monitor

    HP Support Assistant – Potential Escalation of Privilege

    HighCVSS 7.3No exploitEPSS 0%

    hp inc. · hp support assistantSep 3, 2026

  • CVE-2026-33630
    30Monitor

    c-ares : Use-after-free / double-free in c-ares query-completion handling, remotely triggerable via ares_getaddrinfo() over TCP

    HighCVSS 7.5No exploitEPSS 0%

    c-ares · c-aresSep 3, 2026

  • CVE-2026-78583
    32Monitor

    Incorrect Authorization in Kibana Leading to Privilege Escalation

    HighCVSS 8.1No exploitEPSS 0%

    elastic · kibanaSep 3, 2026

  • CVE-2026-82302
    32Monitor

    Incorrect Authorization in Kibana Leading to Unauthorized Configuration Modification

    HighCVSS 8.1No exploitEPSS 0%

    elastic · kibanaSep 3, 2026

  • CVE-2026-82526
    37Monitor

    R2R 3.6.6 SQL Injection via Vector Index Creation Endpoint

    CriticalCVSS 9.3No exploitEPSS 0%

    sciphi-ai · r2rSep 3, 2026

  • CVE-2026-85028
    29Monitor

    Creation of Temporary File in Directory with Insecure Permissions in AWS FPGA Development Kit

    HighCVSS 7.3No exploitEPSS 0%

    aws · aws-fpgaSep 3, 2026

  • CVE-2026-85388
    34Monitor

    Worklenz through 3.0.0 SQL Injection via the sort-field Query Parameter

    HighCVSS 8.6No exploitEPSS 0%

    worklenz · worklenzSep 3, 2026

  • CVE-2026-85389
    28Monitor

    Worklenz before 3.0.0 Authorization Bypass on Task-Scoped Endpoints

    HighCVSS 7.1No exploitEPSS 0%

    worklenz · worklenzSep 3, 2026

  • CVE-2026-85390
    28Monitor

    Checkmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes

    HighCVSS 7.1No exploitEPSS 0%

    bluewave-labs · checkmateSep 3, 2026

  • CVE-2026-85391
    37Monitor

    Peppermint through 0.5.5 Use of Hard-coded JWT Signing Secret in docker-compose.yml

    CriticalCVSS 9.3No exploitEPSS 0%

    peppermint-lab · peppermintSep 3, 2026

  • CVE-2026-85393
    34Monitor

    node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery via Nested DigestAlgorithm Padding

    HighCVSS 8.7No exploitEPSS 0%

    digitalbazaar · forgeSep 3, 2026

  • CVE-2026-85394
    37Monitor

    python-jose through 3.5.0 Algorithm Confusion via DER-encoded Public Key as HMAC Secret

    CriticalCVSS 9.3No exploitEPSS 0%

    mpdavis · python-joseSep 3, 2026

  • CVE-2026-85395
    28Monitor

    UnoPim before 2.1.3 Missing Authorization on Integration Management Routes

    HighCVSS 7.1No exploitEPSS 0%

    unopim · unopimSep 3, 2026

  • CVE-2026-85396
    34Monitor

    rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

    HighCVSS 8.7No exploitEPSS 0%

    rubyzip · rubyzipSep 3, 2026

  • CVE-2026-44506
    32Monitor

    Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

    HighCVSS 8.2No exploitEPSS 0%

    medplum · medplumSep 3, 2026

  • CVE-2026-53728
    28Monitor

    Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

    HighCVSS 7.1No exploitEPSS 0%

    medplum · medplumSep 3, 2026

  • CVE-2026-82527
    34Monitor

    R2R 3.6.6 SQL Injection via Retrieval Search Filter Key

    HighCVSS 8.7No exploitEPSS 0%

    sciphi-ai · r2rSep 3, 2026

  • CVE-2026-85042
    38Monitor

    Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox v

    CriticalCVSS 9.6No exploitEPSS 0%

    google · chromeSep 3, 2026

  • CVE-2026-85043
    36Monitor

    Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via cra

    CriticalCVSS 9.1No exploitEPSS 0%

    google · chromeSep 3, 2026

  • CVE-2026-85045
    30Monitor

    Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr

    HighCVSS 7.5Proof of conceptEPSS 0%

    google · chromeSep 3, 2026

  • CVE-2026-85046
    66This week

    Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr

    HighCVSS 8.8KEVWeaponizedEPSS 1%

    google · chromeSep 3, 2026

  • CVE-2026-85047
    38Monitor

    Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentiall

    CriticalCVSS 9.6No exploitEPSS 0%

    google · chromeSep 3, 2026

  • CVE-2026-85048
    33Monitor

    Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to

    HighCVSS 8.3Proof of conceptEPSS 0%

    google · chromeSep 3, 2026

  • CVE-2026-85049
    35Monitor

    Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a

    HighCVSS 8.8No exploitEPSS 0%

    google · chromeSep 3, 2026

  • CVE-2026-85050
    38Monitor

    Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outsi

    CriticalCVSS 9.6No exploitEPSS 0%

    google · chromeSep 3, 2026

  • CVE-2026-85051
    35Monitor

    Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox

    HighCVSS 8.8No exploitEPSS 0%

    google · chromeSep 3, 2026

  • CVE-2026-85053
    35Monitor

    Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code insid

    HighCVSS 8.8No exploitEPSS 0%

    google · chromeSep 3, 2026

  • CVE-2026-75034
    29Monitor

    Rancher: SAML Assertion Replay

    HighCVSS 7.4No exploitEPSS 0%

    suse · rancherSep 3, 2026

  • CVE-2026-63376
    32Monitor

    toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

    HighCVSS 8.2No exploitEPSS 0%

    binarymuse · toml-nodeSep 3, 2026

  • CVE-2026-77465
    30Monitor

    toml-node: Uncontrolled Recursion

    HighCVSS 7.5No exploitEPSS 0%

    binarymuse · toml-nodeSep 3, 2026

  • CVE-2026-82520
    34Monitor

    parsedmarc < 11.0.1 Zip Bomb DoS via Compressed Email Attachments

    HighCVSS 8.7No exploitEPSS 0%

    domainaware · parsedmarcSep 3, 2026

  • CVE-2026-85061
    40Plan

    MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

    CriticalCVSS 10.0No exploitEPSS 0%

    maplibre · maplibre-gl-jsSep 3, 2026

  • CVE-2026-85222
    35Monitor

    D-Link DNS-340L Add-On Center addon_center.cgi os command injection

    HighCVSS 8.5No exploitEPSS 3%

    d-link · dns-340lSep 3, 2026

  • CVE-2026-8862
    30Monitor

    Vulnerabilities exists in IBM Netezza Software

    HighCVSS 7.5No exploitEPSS 0%

    ibm · netezza performance serverSep 3, 2026

  • CVE-2026-64195
    34Monitor

    Out Of Bounds Write parsing a .DSB file in DASYLab due to lack of proper validation of user-supplied data

    HighCVSS 8.5No exploitEPSS 0%

    ni · dasylabSep 3, 2026

  • CVE-2026-64196
    34Monitor

    Out Of Bounds Write when parsing a .DSB file in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated heap

    HighCVSS 8.5No exploitEPSS 0%

    ni · dasylabSep 3, 2026

  • CVE-2026-64197
    34Monitor

    Out Of Bounds Write when parsing a .DSB file in DASYLab due to improper validation of user-supplied data, resulting in a write past the end of an allocated data

    HighCVSS 8.5No exploitEPSS 0%

    ni · dasylabSep 3, 2026

  • CVE-2026-64198
    34Monitor

    Out Of Bounds Read in file handling when parsing a .DSB file in DASYLab

    HighCVSS 8.5No exploitEPSS 0%

    ni · dasylabSep 3, 2026

  • CVE-2026-64199
    34Monitor

    Out Of Bounds Read outside the bounds of an allocated data structure when parsing a .DSB file in DASYLab

    HighCVSS 8.6No exploitEPSS 0%

    ni · dasylabSep 3, 2026

  • CVE-2026-64200
    34Monitor

    Out Of Bounds Read during string conversion when parsing a .DSB file in DASYLab

    HighCVSS 8.5No exploitEPSS 0%

    ni · dasylabSep 3, 2026

  • CVE-2026-85223
    35Monitor

    D-Link DNS-340L CGI dropbox.cgi os command injection

    HighCVSS 8.6No exploitEPSS 3%

    d-link · dns-340lSep 3, 2026

  • CVE-2026-85224
    35Monitor

    D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection

    HighCVSS 8.5No exploitEPSS 3%

    d-link · dns-320 sharecenterSep 3, 2026

  • CVE-2026-18167
    30Monitor

    Stack-based buffer overflow in TP-Link Archer AX55 v4

    HighCVSS 7.7No exploitEPSS 0%

    tp-link systems inc. · archer ax55 v4Sep 3, 2026

  • CVE-2026-62916
    39Monitor

    Microsoft Entra ID Elevation of Privilege Vulnerability

    CriticalCVSS 9.8No exploitEPSS 0%

    microsoft · entra idSep 3, 2026

  • CVE-2026-65818
    39Monitor

    Power Automate Elevation of Privilege Vulnerability

    CriticalCVSS 9.9No exploitEPSS 0%

    microsoft · power platformSep 3, 2026

  • CVE-2026-69857
    35Monitor

    Azure Cosmos DB Spoofing Vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    microsoft · azure cosmos dbSep 3, 2026