By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 63 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
29Monitor	CVE-2026-75973No exploit	Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configuredapache software foundation · apache tomcat · CWE-287 Pre-auth Auth bypass	High7.3	—	0.5%	Sep 23, 2026
30Monitor	CVE-2026-77791No exploit	Apache Tomcat: DoS via busy wait during WebSocket closeapache software foundation · apache tomcat · CWE-400 Pre-auth Denial of service	High7.5	—	0.6%	Sep 23, 2026
30Monitor	CVE-2026-78383No exploit	Apache Tomcat: AJP DoS via missing request bodyapache software foundation · apache tomcat · CWE-770 Pre-auth Denial of service	High7.5	—	0.5%	Sep 23, 2026
29Monitor	CVE-2026-78437No exploit	Apache Tomcat: HTTP/2 DoS via malformed requestapache software foundation · apache tomcat · CWE-459 Pre-auth	High7.3	—	0.5%	Sep 23, 2026
30Monitor	CVE-2026-79677No exploit	Apache Tomcat: WebSocket DoS due to lost asynchronous write timeoutapache software foundation · apache tomcat · CWE-772 Pre-auth Denial of service	High7.5	—	0.4%	Sep 23, 2026
21Monitor	CVE-2026-80444Proof of concept	Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİSabis technology ltd. co. · avesi̇s · CWE-601 Pre-auth Open redirect	Medium5.4	—	0.2%	Sep 23, 2026
33Monitor	CVE-2026-84787No exploit	Privilege Escalation vulnerabilityzohocorp · manageengine opmanager · CWE-250	High8.1	—	2.1%	Sep 23, 2026
28Monitor	CVE-2026-84789No exploit	Broken Access Control vulnerabilityzohocorp · manageengine opmanager · CWE-639 Broken access control (IDOR)	High7.1	—	1.4%	Sep 23, 2026
28Monitor	CVE-2026-84791No exploit	Broken Access Control vulnerabilityzohocorp · manageengine opmanager · CWE-639 Broken access control (IDOR)	High7.1	—	1.4%	Sep 23, 2026
39Monitor	CVE-2026-86248No exploit	Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabledapache software foundation · apache tomcat · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.4%	Sep 23, 2026
36Monitor	CVE-2026-86350Proof of concept	Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-upapache software foundation · apache tomcat · CWE-444 Pre-auth	Critical9.1	—	0.4%	Sep 23, 2026
30Monitor	CVE-2026-87022No exploit	Apache Tomcat: WebSocket message smuggling with per-message-deflateapache software foundation · apache tomcat · CWE-130 Pre-auth	High7.5	—	0.5%	Sep 23, 2026
31Monitor	CVE-2026-91789No exploit	Foxit PDF Editor/Reader U3D File Parsing Integer Overflow Remote Code Execution Vulnerabilityfoxit · pdf editor · CWE-787 RCE Memory safety	High7.8	—	0.2%	Sep 23, 2026
31Monitor	CVE-2026-91790No exploit	Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerabilityfoxit · pdf editor · CWE-416 Memory safety	High7.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91791No exploit	Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerabilityfoxit · pdf editor · CWE-416 RCE Memory safety	High7.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91792No exploit	Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerabilityfoxit · pdf editor · CWE-416 RCE Memory safety	High7.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91793No exploit	Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerabilityfoxit · pdf editor · CWE-416 Memory safety	High7.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91794No exploit	Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulnerabilityfoxit · pdf editor · CWE-787 RCE Memory safety	High7.8	—	0.2%	Sep 23, 2026
31Monitor	CVE-2026-91795No exploit	Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerabilityfoxit · pdf editor · CWE-822 RCE	High7.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91797No exploit	Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerabilityfoxit · pdf editor · CWE-73 RCE Path traversal	High7.8	—	0.3%	Sep 23, 2026
35Monitor	CVE-2026-91798No exploit	Foxit PDF Editor/Reader Updater Privilege Escalationfoxit · pdf editor · CWE-732 Local privilege escalation	High8.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91799No exploit	Foxit Editor/Reader Array resetForm Use-After-Free Vulnerabilityfoxit · pdf editor · CWE-416 RCE Memory safety	High7.8	—	0.1%	Sep 23, 2026
35Monitor	CVE-2026-91800No exploit	Foxit PDF Editor installer local privilege escalationfoxit · pdf editor · CWE-732 RCE Local privilege escalation	High8.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91801No exploit	Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerabilityfoxit · pdf editor · CWE-22 RCE Path traversal	High7.8	—	0.2%	Sep 23, 2026
31Monitor	CVE-2026-91803No exploit	Security Vulnerability Report – Foxit PDF Editor/Reader Updater DLL Search Path Hijackingfoxit · pdf editor · CWE-427 Local privilege escalation	High7.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91804No exploit	Foxit PDF Editor/Reader Out-of-bounds Write Vulnerability While Renderingfoxit · pdf editor · CWE-787 Memory safety	High7.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91805No exploit	Use-after-free Vulnerability in Foxit PDF Editor/Reader Page-tree Handlingfoxit · pdf editor · CWE-416 Memory safety	High7.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91806No exploit	Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerabilityfoxit · pdf editor · CWE-416 Memory safety	High7.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91809No exploit	Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerabilityfoxit · pdf editor · CWE-416 Memory safety	High7.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91811No exploit	Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerabilityfoxit · pdf editor · CWE-787 RCE Memory safety	High7.8	—	0.1%	Sep 23, 2026
32Monitor	CVE-2026-91812No exploit	Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerabilityfoxit · pdf editor · CWE-295 pre-auth RCE Weak crypto	High8.1	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91813No exploit	Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerabilityfoxit · pdf editor · CWE-367 RCE Local privilege escalation Race condition	High7.8	—	0.0%	Sep 23, 2026
31Monitor	CVE-2026-91815No exploit	Foxit PDF Editor/Reader JPEG2000 Parsing Memory Corruption Remote Code Execution Vulnerabilityfoxit · pdf editor · CWE-787 RCE Memory safety	High7.8	—	0.1%	Sep 23, 2026
31Monitor	CVE-2026-91816No exploit	Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnerabilityfoxit · pdf editor · CWE-416 RCE Memory safety	High7.8	—	0.1%	Sep 23, 2026
41Plan	CVE-2026-19599No exploit	Remote Code Execution vulnerabilityzohocorp · manageengine opmanager · CWE-78 RCE Command injection	Critical9.9	—	5.0%	Sep 23, 2026
36Monitor	CVE-2026-75825No exploit	Authentication Bypass vulnerabilityzohocorp · manageengine opmanager · CWE-306 Auth bypass	High8.8	—	2.1%	Sep 23, 2026
37Monitor	CVE-2026-76978No exploit	Command Injection vulnerabilityzohocorp · manageengine opmanager · CWE-78 RCE Command injection	High8.8	—	8.1%	Sep 23, 2026
31Monitor	CVE-2026-76979No exploit	XML Injection vulnerabilityzohocorp · manageengine opmanager · CWE-91	High7.7	—	2.0%	Sep 23, 2026
29Monitor	CVE-2026-76980No exploit	Data Exposure vulnerabilityzohocorp · manageengine opmanager · CWE-20 Pre-auth	High7.4	—	0.8%	Sep 23, 2026
31Monitor	CVE-2026-12974No exploit	Security Policy Bypass in Forcepoint Security Engine (NGFW)forcepoint · forcepoint security engine (ngfw) · CWE-183 Pre-auth	High7.9	—	0.4%	Sep 23, 2026
40Plan	CVE-2026-59167No exploit	SunEditor: Critical XSS vulnerability - sanitizer bypassjihong88 · suneditor · CWE-79 Pre-auth XSS	Critical10.0	—	0.4%	Sep 23, 2026
29Monitor	CVE-2026-94243No exploit	Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidenceapache · sling security · CWE-346 Pre-auth	High7.3	—	0.3%	Sep 23, 2026
37Monitor	CVE-2026-86677No exploit	Broken Authentication vulnerabilityzohocorp · manageengine applications manager · CWE-89 RCE SQL injection	High8.8	—	5.0%	Sep 23, 2026
36Monitor	CVE-2026-86678No exploit	Broken Authentication vulnerabilityzohocorp · manageengine applications manager · CWE-639 Broken access control (IDOR)	High8.8	—	1.7%	Sep 23, 2026
29Monitor	CVE-2026-86679No exploit	Broken Access Control vulnerabilityzohocorp · manageengine applications manager · CWE-20 Broken access control (IDOR)	High7.1	—	1.8%	Sep 23, 2026
30Monitor	CVE-2026-86681No exploit	Broken Access Control vulnerabilityzohocorp · manageengine applications manager · CWE-306 Auth bypass Broken access control (IDOR)	High7.6	—	1.1%	Sep 23, 2026
33Monitor	CVE-2026-86683No exploit	Broken Authentication Vulnerabilityzohocorp · manageengine applications manager · CWE-20	High8.1	—	1.6%	Sep 23, 2026
41Plan	CVE-2026-86708No exploit	Sensitive data exposurezohocorp · manageengine applications manager · CWE-321 Pre-auth Hard-coded credentials	Critical10.0	—	2.7%	Sep 23, 2026
37Monitor	CVE-2026-96560No exploit	LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channelmodeltc · lightllm · CWE-502 pre-auth RCE Deserialization	Critical9.3	—	1.1%	Sep 23, 2026
34Monitor	CVE-2026-55610No exploit	InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeoverinvoiceshelf · invoiceshelf · CWE-639 Broken access control (IDOR)	High8.7	—	0.4%	Sep 23, 2026
29Monitor	CVE-2026-73588No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulndell · policy manager for secure connect gateway · CWE-306 Pre-auth Auth bypass	High7.4	—	0.3%	Sep 23, 2026
30Monitor	CVE-2026-73591No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Coddell · policy manager for secure connect gateway · CWE-540 Pre-auth	High7.5	—	0.4%	Sep 23, 2026
21Monitor	CVE-2026-73858Proof of concept	Solspace Freeform: Limited Twig template injection via submitted field valuessolspace · craft-freeform · CWE-1336 pre-auth RCE SSTI	Medium5.3	—	0.5%	Sep 23, 2026
31Monitor	CVE-2026-96442No exploit	Emacs: emacs: arbitrary code execution in flymake modegnu emacs · gnu emacs · CWE-94 RCE Local privilege escalation	High7.8	—	0.2%	Sep 23, 2026
32Monitor	CVE-2026-96599No exploit	Isotope eCommerce through 2.9.10 Weak Order Identifier Generationisotope · isotope-core · CWE-330 Pre-auth Weak crypto	High8.2	—	0.4%	Sep 23, 2026
28Monitor	CVE-2026-96600No exploit	Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacksisotope · isotope-core · CWE-89 SQL injection	High7.0	—	0.4%	Sep 23, 2026
28Monitor	CVE-2026-96609No exploit	Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognizerobur · albatross · CWE-770 Denial of service	High7.1	—	0.3%	Sep 23, 2026
28Monitor	RUSTSEC-2026-0307No exploit	`uncbv`: archive extraction is vulnerable to path traversal (zip-slip)crates.io · uncbv Path traversal	High7.1	—	—	Sep 23, 2026
34Monitor	CVE-2026-79310No exploit	webpy web.py 0.76 is vulnerable to server-side template injection (SSTI).CWE-94 RCE SSTI	High8.5	—	0.6%	Sep 23, 2026
28Monitor	CVE-2026-93769No exploit	HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeoverhumhub · humhub · CWE-79 XSS	High7.2	—	0.4%	Sep 23, 2026
34Monitor	CVE-2026-96673No exploit	Photoview through 2.4.0 SQL Injection via album download routephotoview · photoview · CWE-89 Pre-auth SQL injection	High8.7	—	0.5%	Sep 23, 2026
39Monitor	CVE-2026-76183Proof of concept	Apache Tomcat: Bypass of security constraints for WebSocket endpointsapache software foundation · apache tomcat · CWE-289 Pre-auth Auth bypass	Critical9.8	—	0.5%	Sep 23, 2026
32Monitor	CVE-2026-77762No exploit	Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Requestapache software foundation · apache tomcat · CWE-362 Pre-auth Race condition	High8.1	—	0.4%	Sep 23, 2026
30Monitor	CVE-2026-19888No exploit	NULL pointer dereference in SCRAM client-final-message parsing in PgBouncerCWE-476 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Sep 23, 2026
30Monitor	CVE-2026-6668No exploit	Integer overflow causes an infinite loop in packet buffer growth in PgBouncerCWE-190 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Sep 23, 2026
38Monitor	CVE-2026-85724No exploit	Moquette pattern ACL wildcard injection allows cross-tenant authorization bypassmoquette · moquette · CWE-155	Critical9.6	—	0.3%	Sep 23, 2026
30Monitor	CVE-2026-88830No exploit	Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflowred hat · red hat hardened images · CWE-131 Pre-auth Denial of service	High7.5	—	0.3%	Sep 23, 2026
29Monitor	CVE-2026-88832No exploit	Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflowred hat · red hat hardened images · CWE-787 Memory safety	High7.3	—	0.1%	Sep 23, 2026
35Monitor	CVE-2026-93349Proof of concept	Frictionless OS Command Injection via explore Console Commandfrictionlessdata · frictionless-py · CWE-78 pre-auth RCE Command injection	High8.6	—	2.1%	Sep 23, 2026
34Monitor	CVE-2026-95842No exploit	Moquette uncaught MQTT command exceptions can terminate shared session event loopsmoquette · moquette · CWE-248 Pre-auth	High8.7	—	0.4%	Sep 23, 2026
34Monitor	CVE-2026-95843No exploit	Moquette malformed shared subscriptions can crash command processingmoquette · moquette · CWE-20 Pre-auth	High8.7	—	0.4%	Sep 23, 2026
34Monitor	CVE-2026-95845No exploit	Moquette unbounded per-session message queues allow memory exhaustionmoquette · moquette · CWE-770 Pre-auth Denial of service	High8.7	—	0.4%	Sep 23, 2026
34Monitor	CVE-2026-95846No exploit	Moquette publishes Last-Will messages without enforcing write authorizationmoquette · moquette · CWE-862 Pre-auth Broken access control (IDOR)	High8.7	—	0.3%	Sep 23, 2026
35Monitor	CVE-2026-95847No exploit	Moquette client IDs can cause cross-session H2 durable-queue corruptionmoquette · moquette · CWE-99 Pre-auth	High8.8	—	0.3%	Sep 23, 2026
37Monitor	CVE-2026-95848No exploit	Moquette fails open when configured authentication or authorization classes cannot loadmoquette · moquette · CWE-636 Pre-auth	Critical9.3	—	0.4%	Sep 23, 2026
37Monitor	CVE-2026-96755No exploit	orval @orval/effect 8.14.0 through 8.28.1 Code Injectionorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.7%	Sep 23, 2026
36Monitor	CVE-2026-96756No exploit	orval before 8.30.0 Code Injection via Factory Generationorval-labs · orval · CWE-94 pre-auth RCE	Critical9.2	—	0.8%	Sep 23, 2026
37Monitor	CVE-2026-96757No exploit	orval before 8.29.0 Code Injection via unescaped OpenAPI media-typeorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.8%	Sep 23, 2026
37Monitor	CVE-2026-96758No exploit	orval @orval/core before 8.28.0 Code Injection via Form-Dataorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.7%	Sep 23, 2026
35Monitor	CVE-2026-96775No exploit	MLflow dspy bypasses pickle deserialization controlmlflow · mlflow · CWE-502 pre-auth RCE Deserialization	High8.8	—	0.6%	Sep 23, 2026
35Monitor	CVE-2026-96804No exploit	MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _loadmlflow · mlflow · CWE-502 RCE Deserialization	High8.8	—	0.7%	Sep 23, 2026
29Monitor	CVE-2026-96808No exploit	In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validflatpak · flatpak · CWE-61 Local privilege escalation	High7.4	—	0.1%	Sep 23, 2026
30Monitor	CVE-2026-86243No exploit	Apache Tomcat Native: DoS via TLS handshakeapache · tomcat native · CWE-126 Pre-auth Denial of service	High7.5	—	0.5%	Sep 23, 2026
36Monitor	CVE-2026-86246No exploit	Apache Tomcat Native: Insecure OpenSSL options enabledapache · tomcat native · CWE-1188 Pre-auth	Critical9.1	—	0.3%	Sep 23, 2026
29Monitor	CVE-2026-86247No exploit	Apache Tomcat Native: Client certificate requirements can be down-gradedapache · tomcat native · CWE-366 Pre-auth Race condition	High7.4	—	0.2%	Sep 23, 2026
29Monitor	CVE-2026-95676No exploit	AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypasswatchguard · authentication gateway · CWE-287 Pre-auth Auth bypass	High7.4	—	0.3%	Sep 23, 2026
28Monitor	CVE-2026-18177No exploit	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilitiesibm · financial transaction manager · CWE-862 Pre-auth Broken access control (IDOR)	High7.1	—	0.2%	Sep 23, 2026
21Monitor	CVE-2026-88831No exploit	Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengthsred hat · red hat hardened images · CWE-636 Pre-auth	Medium5.3	—	0.2%	Sep 23, 2026
31Monitor	CVE-2026-96512Proof of concept	Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorizationred hat · red hat hardened images · CWE-863 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.3%	Sep 23, 2026
35Monitor	CVE-2026-96275No exploit	Flatpak: flatpak: arbitrary write access as root via extra-data extractionred hat · red hat enterprise linux 10 · CWE-22 Pre-auth Path traversal	High8.8	—	0.5%	Sep 23, 2026
31Monitor	CVE-2026-96611No exploit	FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c.ffmpeg · ffmpeg · CWE-190 Memory safety	High7.8	—	0.1%	Sep 23, 2026
34Monitor	CVE-2026-75131No exploit	NetworkManager-l2tp Privilege Escalation via pppd Username Injectionnm-l2tp · networkmanager-l2tp · CWE-88 RCE Local privilege escalation	High8.5	—	0.1%	Sep 23, 2026
30Monitor	CVE-2026-77394No exploit	OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widgetopenc3 · cosmos · CWE-79 XSS	High7.6	—	0.4%	Sep 23, 2026
35Monitor	CVE-2026-77601No exploit	OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` settingopenc3 · cosmos · CWE-78 RCE Command injection	High8.8	—	0.6%	Sep 23, 2026
30Monitor	CVE-2026-82356No exploit	Imprivata EAM: Unrotatable X.509 RSA Key Pair in Productionimprivata · imprivata enterprise access management · CWE-326 Pre-auth Weak crypto	High7.5	—	0.1%	Sep 23, 2026
32Monitor	CVE-2026-90899No exploit	Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0joomshaper.com · easy store extension for joomla · CWE-200 Pre-auth Broken access control (IDOR) Info leak	High8.2	—	0.4%	Sep 23, 2026
34Monitor	CVE-2026-90901No exploit	Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0joomshaper.com · easy store extension for joomla · CWE-89 SQL injection	High8.6	—	0.3%	Sep 23, 2026
34Monitor	CVE-2026-90902No exploit	Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0joomshaper.com · easy store extension for joomla · CWE-89 SQL injection	High8.6	—	0.2%	Sep 23, 2026
28Monitor	CVE-2026-90903No exploit	Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0joomshaper.com · easy store extension for joomla · CWE-352 Pre-auth CSRF	High7.2	—	0.2%	Sep 23, 2026
34Monitor	CVE-2026-90904No exploit	Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0joomshaper.com · easy store extension for joomla · CWE-284 Broken access control (IDOR)	High8.6	—	0.4%	Sep 23, 2026

CVE-2026-75973
29Monitor
Apache Tomcat: Cross-context authentication mix-up with Jakarta Authentication configured
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache tomcatSep 23, 2026
CVE-2026-77791
30Monitor
Apache Tomcat: DoS via busy wait during WebSocket close
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache tomcatSep 23, 2026
CVE-2026-78383
30Monitor
Apache Tomcat: AJP DoS via missing request body
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache tomcatSep 23, 2026
CVE-2026-78437
29Monitor
Apache Tomcat: HTTP/2 DoS via malformed request
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
apache software foundation · apache tomcatSep 23, 2026
CVE-2026-79677
30Monitor
Apache Tomcat: WebSocket DoS due to lost asynchronous write timeout
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache software foundation · apache tomcatSep 23, 2026
CVE-2026-80444
21Monitor
Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİS
MediumCVSS 5.4Proof of conceptEPSS 0%
- Pre-auth
- Open redirect
abis technology ltd. co. · avesi̇sSep 23, 2026
CVE-2026-84787
33Monitor
Privilege Escalation vulnerability
HighCVSS 8.1No exploitEPSS 2%
zohocorp · manageengine opmanagerSep 23, 2026
CVE-2026-84789
28Monitor
Broken Access Control vulnerability
HighCVSS 7.1No exploitEPSS 1%
- Broken access control (IDOR)
zohocorp · manageengine opmanagerSep 23, 2026
CVE-2026-84791
28Monitor
Broken Access Control vulnerability
HighCVSS 7.1No exploitEPSS 1%
- Broken access control (IDOR)
zohocorp · manageengine opmanagerSep 23, 2026
CVE-2026-86248
39Monitor
Apache Tomcat: Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache tomcatSep 23, 2026
CVE-2026-86350
36Monitor
Apache Tomcat: Regression in fix for CVE-2026-41293 can trigger request header mix-up
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
apache software foundation · apache tomcatSep 23, 2026
CVE-2026-87022
30Monitor
Apache Tomcat: WebSocket message smuggling with per-message-deflate
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
apache software foundation · apache tomcatSep 23, 2026
CVE-2026-91789
31Monitor
Foxit PDF Editor/Reader U3D File Parsing Integer Overflow Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91790
31Monitor
Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91791
31Monitor
Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91792
31Monitor
Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91793
31Monitor
Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91794
31Monitor
Foxit PDF Editor/Reader DeviceN Colorspace Out-Of-Bounds Write Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91795
31Monitor
Foxit PDF Editor/Reader FileOpen Uninitialized Variable Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
foxit · pdf editorSep 23, 2026
CVE-2026-91797
31Monitor
Foxit PDF Editor/Reader Portfolio Directory Traversal Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Path traversal
foxit · pdf editorSep 23, 2026
CVE-2026-91798
35Monitor
Foxit PDF Editor/Reader Updater Privilege Escalation
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
foxit · pdf editorSep 23, 2026
CVE-2026-91799
31Monitor
Foxit Editor/Reader Array resetForm Use-After-Free Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91800
35Monitor
Foxit PDF Editor installer local privilege escalation
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Local privilege escalation
foxit · pdf editorSep 23, 2026
CVE-2026-91801
31Monitor
Foxit PDF Editor/Reader RichMedia Annotation Directory Traversal Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Path traversal
foxit · pdf editorSep 23, 2026
CVE-2026-91803
31Monitor
Security Vulnerability Report – Foxit PDF Editor/Reader Updater DLL Search Path Hijacking
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
foxit · pdf editorSep 23, 2026
CVE-2026-91804
31Monitor
Foxit PDF Editor/Reader Out-of-bounds Write Vulnerability While Rendering
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91805
31Monitor
Use-after-free Vulnerability in Foxit PDF Editor/Reader Page-tree Handling
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91806
31Monitor
Foxit PDF Editor/Reader Doc Object Use-After-Free Information Disclosure Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91809
31Monitor
Foxit PDF Editor/Reader Annotation Use-After-Free Information Disclosure Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91811
31Monitor
Foxit PDF Editor/Reader PRC Stream Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91812
32Monitor
Foxit PDF Editor/Reader FoxitUpdater Improper Certificate Validation Local Privilege Escalation Vulnerability
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Weak crypto
foxit · pdf editorSep 23, 2026
CVE-2026-91813
31Monitor
Foxit PDF Editor/Reader FoxitUpdater Race Condition Local Privilege Escalation Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Race condition
foxit · pdf editorSep 23, 2026
CVE-2026-91815
31Monitor
Foxit PDF Editor/Reader JPEG2000 Parsing Memory Corruption Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-91816
31Monitor
Foxit PDF Editor/Reader AcroForm Use-After-Free Remote Code Execution Vulnerability
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
foxit · pdf editorSep 23, 2026
CVE-2026-19599
41Plan
Remote Code Execution vulnerability
CriticalCVSS 9.9No exploitEPSS 5%
- RCE
- Command injection
zohocorp · manageengine opmanagerSep 23, 2026
CVE-2026-75825
36Monitor
Authentication Bypass vulnerability
HighCVSS 8.8No exploitEPSS 2%
- Auth bypass
zohocorp · manageengine opmanagerSep 23, 2026
CVE-2026-76978
37Monitor
Command Injection vulnerability
HighCVSS 8.8No exploitEPSS 8%
- RCE
- Command injection
zohocorp · manageengine opmanagerSep 23, 2026
CVE-2026-76979
31Monitor
XML Injection vulnerability
HighCVSS 7.7No exploitEPSS 2%
zohocorp · manageengine opmanagerSep 23, 2026
CVE-2026-76980
29Monitor
Data Exposure vulnerability
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
zohocorp · manageengine opmanagerSep 23, 2026
CVE-2026-12974
31Monitor
Security Policy Bypass in Forcepoint Security Engine (NGFW)
HighCVSS 7.9No exploitEPSS 0%
- Pre-auth
forcepoint · forcepoint security engine (ngfw)Sep 23, 2026
CVE-2026-59167
40Plan
SunEditor: Critical XSS vulnerability - sanitizer bypass
CriticalCVSS 10.0No exploitEPSS 0%
- Pre-auth
- XSS
jihong88 · suneditorSep 23, 2026
CVE-2026-94243
29Monitor
Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
apache · sling securitySep 23, 2026
CVE-2026-86677
37Monitor
Broken Authentication vulnerability
HighCVSS 8.8No exploitEPSS 5%
- RCE
- SQL injection
zohocorp · manageengine applications managerSep 23, 2026
CVE-2026-86678
36Monitor
Broken Authentication vulnerability
HighCVSS 8.8No exploitEPSS 1%
- Broken access control (IDOR)
zohocorp · manageengine applications managerSep 23, 2026
CVE-2026-86679
29Monitor
Broken Access Control vulnerability
HighCVSS 7.1No exploitEPSS 1%
- Broken access control (IDOR)
zohocorp · manageengine applications managerSep 23, 2026
CVE-2026-86681
30Monitor
Broken Access Control vulnerability
HighCVSS 7.6No exploitEPSS 1%
- Auth bypass
- Broken access control (IDOR)
zohocorp · manageengine applications managerSep 23, 2026
CVE-2026-86683
33Monitor
Broken Authentication Vulnerability
HighCVSS 8.1No exploitEPSS 1%
zohocorp · manageengine applications managerSep 23, 2026
CVE-2026-86708
41Plan
Sensitive data exposure
CriticalCVSS 10.0No exploitEPSS 2%
- Pre-auth
- Hard-coded credentials
zohocorp · manageengine applications managerSep 23, 2026
CVE-2026-96560
37Monitor
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via NCCL PD RPyC Control Channel
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- Deserialization
modeltc · lightllmSep 23, 2026
CVE-2026-55610
34Monitor
InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
invoiceshelf · invoiceshelfSep 23, 2026
CVE-2026-73588
29Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vuln
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
dell · policy manager for secure connect gatewaySep 23, 2026
CVE-2026-73591
30Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Cod
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
dell · policy manager for secure connect gatewaySep 23, 2026
CVE-2026-73858
21Monitor
Solspace Freeform: Limited Twig template injection via submitted field values
MediumCVSS 5.3Proof of conceptEPSS 0%
- pre-auth RCE
- SSTI
solspace · craft-freeformSep 23, 2026
CVE-2026-96442
31Monitor
Emacs: emacs: arbitrary code execution in flymake mode
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
gnu emacs · gnu emacsSep 23, 2026
CVE-2026-96599
32Monitor
Isotope eCommerce through 2.9.10 Weak Order Identifier Generation
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
isotope · isotope-coreSep 23, 2026
CVE-2026-96600
28Monitor
Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks
HighCVSS 7.0No exploitEPSS 0%
- SQL injection
isotope · isotope-coreSep 23, 2026
CVE-2026-96609
28Monitor
Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognize
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
robur · albatrossSep 23, 2026
RUSTSEC-2026-0307
28Monitor
`uncbv`: archive extraction is vulnerable to path traversal (zip-slip)
HighCVSS 7.1No exploit
- Path traversal
crates.io · uncbvSep 23, 2026
CVE-2026-79310
34Monitor
webpy web.py 0.76 is vulnerable to server-side template injection (SSTI).
HighCVSS 8.5No exploitEPSS 0%
- RCE
- SSTI
Sep 23, 2026
CVE-2026-93769
28Monitor
HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover
HighCVSS 7.2No exploitEPSS 0%
- XSS
humhub · humhubSep 23, 2026
CVE-2026-96673
34Monitor
Photoview through 2.4.0 SQL Injection via album download route
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SQL injection
photoview · photoviewSep 23, 2026
CVE-2026-76183
39Monitor
Apache Tomcat: Bypass of security constraints for WebSocket endpoints
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache tomcatSep 23, 2026
CVE-2026-77762
32Monitor
Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Race condition
apache software foundation · apache tomcatSep 23, 2026
CVE-2026-19888
30Monitor
NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
Sep 23, 2026
CVE-2026-6668
30Monitor
Integer overflow causes an infinite loop in packet buffer growth in PgBouncer
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
Sep 23, 2026
CVE-2026-85724
38Monitor
Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass
CriticalCVSS 9.6No exploitEPSS 0%
moquette · moquetteSep 23, 2026
CVE-2026-88830
30Monitor
Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat hardened imagesSep 23, 2026
CVE-2026-88832
29Monitor
Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
red hat · red hat hardened imagesSep 23, 2026
CVE-2026-93349
35Monitor
Frictionless OS Command Injection via explore Console Command
HighCVSS 8.6Proof of conceptEPSS 2%
- pre-auth RCE
- Command injection
frictionlessdata · frictionless-pySep 23, 2026
CVE-2026-95842
34Monitor
Moquette uncaught MQTT command exceptions can terminate shared session event loops
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
moquette · moquetteSep 23, 2026
CVE-2026-95843
34Monitor
Moquette malformed shared subscriptions can crash command processing
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
moquette · moquetteSep 23, 2026
CVE-2026-95845
34Monitor
Moquette unbounded per-session message queues allow memory exhaustion
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
moquette · moquetteSep 23, 2026
CVE-2026-95846
34Monitor
Moquette publishes Last-Will messages without enforcing write authorization
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
moquette · moquetteSep 23, 2026
CVE-2026-95847
35Monitor
Moquette client IDs can cause cross-session H2 durable-queue corruption
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
moquette · moquetteSep 23, 2026
CVE-2026-95848
37Monitor
Moquette fails open when configured authentication or authorization classes cannot load
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
moquette · moquetteSep 23, 2026
CVE-2026-96755
37Monitor
orval @orval/effect 8.14.0 through 8.28.1 Code Injection
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalSep 23, 2026
CVE-2026-96756
36Monitor
orval before 8.30.0 Code Injection via Factory Generation
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalSep 23, 2026
CVE-2026-96757
37Monitor
orval before 8.29.0 Code Injection via unescaped OpenAPI media-type
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalSep 23, 2026
CVE-2026-96758
37Monitor
orval @orval/core before 8.28.0 Code Injection via Form-Data
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalSep 23, 2026
CVE-2026-96775
35Monitor
MLflow dspy bypasses pickle deserialization control
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
mlflow · mlflowSep 23, 2026
CVE-2026-96804
35Monitor
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Deserialization
mlflow · mlflowSep 23, 2026
CVE-2026-96808
29Monitor
In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, valid
HighCVSS 7.4No exploitEPSS 0%
- Local privilege escalation
flatpak · flatpakSep 23, 2026
CVE-2026-86243
30Monitor
Apache Tomcat Native: DoS via TLS handshake
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · tomcat nativeSep 23, 2026
CVE-2026-86246
36Monitor
Apache Tomcat Native: Insecure OpenSSL options enabled
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
apache · tomcat nativeSep 23, 2026
CVE-2026-86247
29Monitor
Apache Tomcat Native: Client certificate requirements can be down-graded
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Race condition
apache · tomcat nativeSep 23, 2026
CVE-2026-95676
29Monitor
AuthPoint Gateway Improper Authentication in LDAP Sync Allows First-Factor Authentication Bypass
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
watchguard · authentication gatewaySep 23, 2026
CVE-2026-18177
28Monitor
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
ibm · financial transaction managerSep 23, 2026
CVE-2026-88831
21Monitor
Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
red hat · red hat hardened imagesSep 23, 2026
CVE-2026-96512
31Monitor
Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization
HighCVSS 7.8Proof of conceptEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
red hat · red hat hardened imagesSep 23, 2026
CVE-2026-96275
35Monitor
Flatpak: flatpak: arbitrary write access as root via extra-data extraction
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
red hat · red hat enterprise linux 10Sep 23, 2026
CVE-2026-96611
31Monitor
FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c.
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
ffmpeg · ffmpegSep 23, 2026
CVE-2026-75131
34Monitor
NetworkManager-l2tp Privilege Escalation via pppd Username Injection
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
nm-l2tp · networkmanager-l2tpSep 23, 2026
CVE-2026-77394
30Monitor
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
HighCVSS 7.6No exploitEPSS 0%
- XSS
openc3 · cosmosSep 23, 2026
CVE-2026-77601
35Monitor
OpenC3 COSMOS: Authenticated OS command injection via the `pypi_url` setting
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
openc3 · cosmosSep 23, 2026
CVE-2026-82356
30Monitor
Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Weak crypto
imprivata · imprivata enterprise access managementSep 23, 2026
CVE-2026-90899
32Monitor
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- Info leak
joomshaper.com · easy store extension for joomlaSep 23, 2026
CVE-2026-90901
34Monitor
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0
HighCVSS 8.6No exploitEPSS 0%
- SQL injection
joomshaper.com · easy store extension for joomlaSep 23, 2026
CVE-2026-90902
34Monitor
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0
HighCVSS 8.6No exploitEPSS 0%
- SQL injection
joomshaper.com · easy store extension for joomlaSep 23, 2026
CVE-2026-90903
28Monitor
Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- CSRF
joomshaper.com · easy store extension for joomlaSep 23, 2026
CVE-2026-90904
34Monitor
Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
joomshaper.com · easy store extension for joomlaSep 23, 2026