By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 64 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-90905No exploit	Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0joomshaper.com · easy store extension for joomla · CWE-284 Pre-auth Broken access control (IDOR) CSRF	High7.2	—	0.3%	Sep 23, 2026
29Monitor	CVE-2026-92730No exploit	LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column namelimesurvey · limesurvey · CWE-79 Pre-auth XSS	High7.4	—	0.5%	Sep 23, 2026
28Monitor	CVE-2026-93526No exploit	WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerabilitynexcess · event tickets · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Sep 23, 2026
34Monitor	CVE-2026-93527No exploit	WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerabilitybdthemes · live copy paste for elementor · CWE-89 SQL injection	High8.5	—	0.3%	Sep 23, 2026
28Monitor	CVE-2026-93622No exploit	WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerabilitynicolaskulka · wps limit login · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Sep 23, 2026
34Monitor	CVE-2026-93773No exploit	WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerabilitynick van wobbie · mollie forms · CWE-89 SQL injection	High8.5	—	0.3%	Sep 23, 2026
28Monitor	CVE-2026-93774No exploit	WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerabilityjacob n. breetvelt · wp photo album plus · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Sep 23, 2026
34Monitor	CVE-2026-94124No exploit	WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerabilitylevelfourdevelopment · wp easycart · CWE-89 SQL injection	High8.5	—	0.2%	Sep 23, 2026
30Monitor	CVE-2026-94174No exploit	WordPress Email Log plugin <= 2.63 - SQL Injection vulnerabilitywebfactory · email log · CWE-89 SQL injection	High7.6	—	0.3%	Sep 23, 2026
28Monitor	CVE-2026-94176No exploit	WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilitykitae park · mang board wp · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Sep 23, 2026
28Monitor	CVE-2026-94179No exploit	WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerabilityrazorpay · razorpay payment button · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Sep 23, 2026
29Monitor	CVE-2026-94181No exploit	Address Bar Spoof Risk; Missing Fullscreen Notification via Select Elementthe browser company of new york · arc · CWE-451 Pre-auth	High7.4	—	0.3%	Sep 23, 2026
32Monitor	CVE-2026-94487No exploit	WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerabilitypublishpress · publishpress capabilities · CWE-352 Pre-auth CSRF	High8.1	—	0.1%	Sep 23, 2026
30Monitor	CVE-2026-95513No exploit	WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerabilityvcita · online booking & scheduling calendar for wordpress by vcita · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Sep 23, 2026
28Monitor	CVE-2026-95515No exploit	WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabilitykevin stover · ninja forms · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 23, 2026
30Monitor	CVE-2026-95522No exploit	WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerabilitysyed balkhi · easy digital downloads · CWE-89 SQL injection	High7.6	—	0.3%	Sep 23, 2026
28Monitor	CVE-2026-95528No exploit	WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerabilitymohammed kaludi · core web vitals & pagespeed booster · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Sep 23, 2026
28Monitor	CVE-2026-95529No exploit	WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerabilitycodepeople · calculated fields form · CWE-79 Pre-auth XSS	High7.1	—	0.2%	Sep 23, 2026
28Monitor	CVE-2026-95590No exploit	WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerabilitytainacan · tainacan · CWE-89 SQL injection	High7.1	—	0.2%	Sep 23, 2026
30Monitor	CVE-2026-95593No exploit	WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerabilityben roberts · ultimeter · CWE-89 SQL injection	High7.6	—	0.3%	Sep 23, 2026
37Monitor	CVE-2026-95601No exploit	WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerabilitywbw plugins · product filter by wbw · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.2%	Sep 23, 2026
28Monitor	CVE-2026-95603No exploit	WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerabilityvictor rodriguez · reycob product import export · CWE-502 Deserialization	High7.2	—	0.5%	Sep 23, 2026
30Monitor	CVE-2026-95604No exploit	WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerabilitytangible · loops & logic · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.4%	Sep 23, 2026
37Monitor	CVE-2026-96770No exploit	s2s-proxy accepts untrusted client certificatestemporal technologies, inc. · s2s-proxy · CWE-296 Pre-auth Weak crypto	Critical9.3	—	0.3%	Sep 23, 2026
11Monitor	CVE-2026-96872Proof of concept	WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositionsthe wikimedia foundation · mediawiki - wikilambda extension · CWE-280 Pre-auth	Low2.9	—	0.3%	Sep 23, 2026
32Monitor	CVE-2026-18181No exploit	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilitiesibm · financial transaction manager · CWE-321 Pre-auth Auth bypass Hard-coded credentials	High8.1	—	0.3%	Sep 23, 2026
29Monitor	CVE-2026-18184No exploit	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilitiesibm · financial transaction manager · CWE-611 Pre-auth XXE	High7.4	—	0.3%	Sep 23, 2026
29Monitor	CVE-2026-18185No exploit	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilitiesibm · financial transaction manager · CWE-306 Pre-auth Auth bypass	High7.3	—	0.4%	Sep 23, 2026
35Monitor	CVE-2026-18490No exploit	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilitiesibm · financial transaction manager · CWE-502 pre-auth RCE Deserialization	High8.8	—	0.8%	Sep 23, 2026
37Monitor	CVE-2026-18872No exploit	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilitiesibm · financial transaction manager · CWE-79 Pre-auth XSS	Critical9.3	—	0.3%	Sep 23, 2026
29Monitor	CVE-2026-18875No exploit	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilitiesibm · financial transaction manager · CWE-74 Pre-auth	High7.3	—	0.3%	Sep 23, 2026
32Monitor	CVE-2026-19179No exploit	IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilitiesibm · financial transaction manager · CWE-74 Pre-auth	High8.2	—	0.5%	Sep 23, 2026
32Monitor	CVE-2026-68490No exploit	Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.webpros · cpanel · CWE-732	High8.2	—	0.1%	Sep 23, 2026
34Monitor	CVE-2026-68492No exploit	An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated userswebpros · plesk · CWE-426 RCE	High8.7	—	0.6%	Sep 23, 2026
34Monitor	CVE-2026-82405No exploit	Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated callerklever-io · klever-go · CWE-863 Broken access control (IDOR)	High8.7	—	0.4%	Sep 23, 2026
28Monitor	CVE-2026-82406No exploit	Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplaceklever-io · klever-go · CWE-841	High7.1	—	0.4%	Sep 23, 2026
28Monitor	CVE-2026-82407No exploit	Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoSklever-io · klever-go · CWE-20 Deserialization	High7.0	—	0.4%	Sep 23, 2026
33Monitor	CVE-2026-82409No exploit	Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgeryklever-io · klever-go · CWE-116	High8.4	—	0.3%	Sep 23, 2026
34Monitor	CVE-2026-86064No exploit	Klever-Go: /log controls global node loggingklever-io · klever-go · CWE-200 Pre-auth Info leak	High8.6	—	0.5%	Sep 23, 2026
37Monitor	CVE-2026-87898No exploit	OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.webpros · plesk extension "site import" · CWE-78 RCE Command injection	Critical9.4	—	1.0%	Sep 23, 2026
37Monitor	CVE-2026-87899No exploit	Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.webpros · cpanel · CWE-250 RCE	Critical9.4	—	0.6%	Sep 23, 2026
37Monitor	CVE-2026-87900No exploit	Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute awebpros · wp toolkit for cpanel · CWE-88 RCE	Critical9.4	—	0.6%	Sep 23, 2026
29Monitor	CVE-2026-94183No exploit	Address bar spoofing risk in affected Android versions of Arc Searchthe browser company of new york · arc search · CWE-451 Pre-auth	High7.4	—	0.3%	Sep 23, 2026
30Monitor	CVE-2026-96826No exploit	WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerabilityshazzad hossain khan · w4 post list · CWE-89 SQL injection	High7.6	—	0.3%	Sep 23, 2026
39Monitor	CVE-2025-63564No exploit	SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP reCWE-89 pre-auth RCE SQL injection	Critical9.8	—	0.7%	Sep 23, 2026
34Monitor	CVE-2026-95844No exploit	Moquette deeply nested MQTT topics can cause stack exhaustionmoquette · moquette · CWE-674 Pre-auth Denial of service	High8.7	—	0.4%	Sep 23, 2026
28Monitor	CVE-2026-96651No exploit	Plex Media Server path traversalplex · media server · CWE-22 Path traversal	High7.1	—	0.8%	Sep 23, 2026
55Plan	CVE-2026-96652Weaponized	Plex Media Server SSRFplex · media server · CWE-918 SSRF	Medium5.3	KEV	11.8%	Sep 23, 2026
60This week	CVE-2026-96654Weaponized	Plex Media Server URL injectionplex · media server · CWE-84 Pre-auth	Medium6.9	KEV	1.9%	Sep 23, 2026
54Plan	CVE-2026-96655Weaponized	Plex Media Server arbitrary-host SSRFplex · media server · CWE-918 SSRF	Medium5.3	KEV	10.7%	Sep 23, 2026
65This week	CVE-2026-96656Weaponized	Plex Media Server arbitrary file writeplex · media server · CWE-73 Path traversal	High8.6	KEV	1.7%	Sep 23, 2026
37Monitor	CVE-2026-96754No exploit	orval @orval/hono before 8.29.0 Code Injection via OpenAPI Pathorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.5%	Sep 23, 2026
37Monitor	CVE-2026-96759No exploit	orval before 8.29.0 Code Injection via operationIdorval-labs · orval · CWE-94 pre-auth RCE	Critical9.3	—	0.5%	Sep 23, 2026
32Monitor	CVE-2026-19125Proof of concept	EthPress <= 2.3.5 - Unauthenticated Authentication Bypasslynn999 · ethpress – web3 login · CWE-287 Pre-auth Auth bypass	High8.1	—	0.6%	Sep 23, 2026
35Monitor	CVE-2026-86583Proof of concept	Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Tripcarazo · import and export users and customers · CWE-266	High8.8	—	0.5%	Sep 23, 2026
37Monitor	CVE-2026-93352No exploit	Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Uploadplank · laravel-mediable · CWE-434 pre-auth RCE File upload	Critical9.3	—	1.0%	Sep 23, 2026
31Monitor	CVE-2026-86926No exploit	A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 dataclaris · filemaker server · CWE-122 RCE Memory safety	High7.8	—	0.1%	Sep 23, 2026
36Monitor	CVE-2026-86930No exploit	An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a containeclaris · filemaker server · CWE-125 Pre-auth Memory safety	Critical9.1	—	0.2%	Sep 23, 2026
36Monitor	CVE-2026-86934No exploit	An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege headerclaris · filemaker server · CWE-639 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.3%	Sep 23, 2026
29Monitor	CVE-2026-86938No exploit	A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated adminiclaris · filemaker pro · CWE-639 RCE Local privilege escalation Broken access control (IDOR)	High7.3	—	0.1%	Sep 23, 2026
29Monitor	CVE-2026-91775No exploit	LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warningslimesurvey · limesurvey · CWE-79 Pre-auth XSS	High7.4	—	0.5%	Sep 23, 2026
30Monitor	CVE-2026-59990No exploit	Jawn: Uncontrolled nesting depth in JSON parsertypelevel · jawn · CWE-770 Pre-auth Denial of service	High7.5	—	0.6%	Sep 23, 2026
30Monitor	CVE-2026-61695No exploit	Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding servicesquare · wire · CWE-129 Pre-auth Auth bypass Denial of service	High7.5	—	0.6%	Sep 23, 2026
30Monitor	CVE-2026-61814No exploit	Jawn: Quadratic parsing effort in AsyncParsertypelevel · jawn · CWE-400 Pre-auth Denial of service	High7.5	—	0.7%	Sep 23, 2026
36Monitor	CVE-2026-63132No exploit	OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attackopenbao · openbao · CWE-208 Pre-auth	Critical9.2	—	0.6%	Sep 23, 2026
34Monitor	CVE-2026-76086No exploit	Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentialsverbb · formie · CWE-862 SSRF Broken access control (IDOR)	High8.5	—	0.5%	Sep 23, 2026
32Monitor	CVE-2026-76087No exploit	Formie: Unauthenticated users can overwrite incomplete submissions via submit actionverbb · formie · CWE-639 Pre-auth Broken access control (IDOR)	High8.2	—	0.4%	Sep 23, 2026
30Monitor	CVE-2026-76089No exploit	Formie: Missing authorization on sent notification resend modal exposes submission PIIverbb · formie · CWE-200 Info leak	High7.7	—	0.4%	Sep 23, 2026
34Monitor	CVE-2026-76648No exploit	Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job templatered hat · red hat ansible automation platform 2.7 · CWE-862 Broken access control (IDOR)	High8.5	—	0.4%	Sep 23, 2026
30Monitor	CVE-2026-77422No exploit	JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrappingjline · jline3 · CWE-1333 Pre-auth Denial of service	High7.5	—	0.5%	Sep 23, 2026
30Monitor	CVE-2026-77423No exploit	JLine: ReDoS in Built-in Less Viewer Searchjline · jline3 · CWE-1333 Pre-auth Denial of service	High7.5	—	0.4%	Sep 23, 2026
39Monitor	CVE-2026-77602No exploit	OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)openc3 · cosmos · CWE-94 RCE	Critical9.9	—	0.7%	Sep 23, 2026
34Monitor	CVE-2026-82368No exploit	Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to cobrocade · sannav · CWE-284 Broken access control (IDOR)	High8.7	—	0.3%	Sep 23, 2026
39Monitor	CVE-2026-84474No exploit	Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure andred hat · red hat ansible automation platform 2.4 for rhel 8 · CWE-807	Critical9.9	—	0.8%	Sep 23, 2026
32Monitor	CVE-2026-84486No exploit	Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debugred hat · red hat ansible automation platform 2.6 for rhel 9 · CWE-489 Pre-auth	High8.2	—	0.6%	Sep 23, 2026
30Monitor	CVE-2026-84499No exploit	Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplatred hat · red hat ansible automation platform 2.5 for rhel 8 · CWE-209 Info leak	High7.7	—	0.3%	Sep 23, 2026
39Monitor	CVE-2026-84502No exploit	Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce red hat · red hat ansible automation platform 2.4 for rhel 8 · CWE-88 RCE	Critical9.9	—	0.6%	Sep 23, 2026
30Monitor	CVE-2026-96541No exploit	Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadlinered hat · red hat enterprise linux 10 · CWE-400 Pre-auth Denial of service	High7.5	—	0.9%	Sep 23, 2026
30Monitor	CVE-2026-66070No exploit	RabbitMQ: CORS * reflects Origin with Allow-Credentialsbroadcom · rabbitmq server · CWE-942 Pre-auth	High7.6	—	0.3%	Sep 23, 2026
32Monitor	CVE-2026-66079No exploit	RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoSbroadcom · rabbitmq server · CWE-770 Pre-auth Denial of service	High8.2	—	0.3%	Sep 23, 2026
28Monitor	CVE-2026-67238No exploit	RabbitMQ: Atom-table exhaustion via reply-to queue name decodingbroadcom · rabbitmq server · CWE-400 Denial of service	High7.1	—	0.3%	Sep 23, 2026
36Monitor	CVE-2026-75884No exploit	Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groupsred hat · red hat ansible automation platform 2.4 for rhel 8 · CWE-184	Critical9.1	—	0.4%	Sep 23, 2026
34Monitor	CVE-2026-84683No exploit	Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink red hat · red hat ansible automation platform 2.5 for rhel 8 · CWE-79 XSS	High8.7	—	0.2%	Sep 23, 2026
34Monitor	CVE-2026-84691No exploit	Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_red hat · red hat ansible automation platform 2.5 for rhel 8 · CWE-134	High8.7	—	0.2%	Sep 23, 2026
30Monitor	CVE-2026-84706No exploit	Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_enred hat · red hat ansible automation platform 2.5 for rhel 8 · CWE-184 RCE	High7.6	—	0.3%	Sep 23, 2026
28Monitor	CVE-2026-84714No exploit	Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fielred hat · red hat ansible automation platform 2.5 for rhel 8 · CWE-184 SSTI	High7.1	—	0.2%	Sep 23, 2026
39Monitor	CVE-2026-84719No exploit	Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass red hat · red hat ansible automation platform 2.4 for rhel 8 · CWE-862 Broken access control (IDOR)	Critical9.9	—	0.4%	Sep 23, 2026
28Monitor	CVE-2026-85475No exploit	Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote codred hat · red hat ansible automation platform 2.7 · CWE-96 RCE	High7.2	—	0.7%	Sep 23, 2026
30Monitor	CVE-2026-86065No exploit	Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)klever-io · klever-go · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Sep 23, 2026
22Monitor	CVE-2026-96762No exploit	kvcache-ai mooncake RPC Path UnmountSegment authorizationkvcache-ai · mooncake · CWE-285 Pre-auth Broken access control (IDOR)	Medium5.5	—	0.2%	Sep 23, 2026
31Monitor	CVE-2026-96889Proof of concept	Librsvg: use-after-free when xml includes have duplicated entitiesred hat · red hat enterprise linux 10 · CWE-416 RCE Memory safety	High7.8	—	0.5%	Sep 23, 2026
29Monitor	CVE-2026-66077No exploit	RabbitMQ: Stored XSS via TLS peer-certificate DN in management UIbroadcom · rabbitmq server · CWE-79 XSS	High7.3	—	0.1%	Sep 23, 2026
36Monitor	CVE-2026-67231No exploit	RabbitMQ: Trust-store whitelist by Issuer+Serial onlybroadcom · rabbitmq server · CWE-295 Pre-auth Auth bypass Weak crypto	Critical9.1	—	0.2%	Sep 23, 2026
32Monitor	CVE-2026-67232No exploit	RabbitMQ: Web-MQTT decompression bombbroadcom · rabbitmq server · CWE-409 Pre-auth	High8.2	—	0.3%	Sep 23, 2026
28Monitor	CVE-2026-67235No exploit	RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated sizebroadcom · rabbitmq server · CWE-770 Denial of service	High7.1	—	0.3%	Sep 23, 2026
36Monitor	CVE-2026-67404No exploit	RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetchbroadcom · rabbitmq server · CWE-295 Pre-auth Weak crypto	Critical9.2	—	0.2%	Sep 23, 2026
39Monitor	CVE-2026-6721No exploit	Multiple Vulnerabilities in IBM Concert Softwareibm · concert · CWE-78 pre-auth RCE Command injection	Critical9.8	—	1.1%	Sep 23, 2026
31Monitor	CVE-2026-6730No exploit	Multiple Vulnerabilities in IBM Concert Softwareibm · concert · CWE-120 pre-auth RCE Memory safety	High7.8	—	0.3%	Sep 23, 2026
31Monitor	CVE-2026-6794No exploit	Multiple Vulnerabilities in IBM Concert Softwareibm · concert · CWE-415 RCE Memory safety	High7.8	—	0.1%	Sep 23, 2026
39Monitor	CVE-2026-6928No exploit	Multiple Vulnerabilities in IBM Concert Softwareibm · concert · CWE-416 pre-auth RCE Memory safety	Critical9.8	—	0.4%	Sep 23, 2026

CVE-2026-90905
28Monitor
Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
- CSRF
joomshaper.com · easy store extension for joomlaSep 23, 2026
CVE-2026-92730
29Monitor
LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- XSS
limesurvey · limesurveySep 23, 2026
CVE-2026-93526
28Monitor
WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
nexcess · event ticketsSep 23, 2026
CVE-2026-93527
34Monitor
WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
bdthemes · live copy paste for elementorSep 23, 2026
CVE-2026-93622
28Monitor
WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
nicolaskulka · wps limit loginSep 23, 2026
CVE-2026-93773
34Monitor
WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
nick van wobbie · mollie formsSep 23, 2026
CVE-2026-93774
28Monitor
WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
jacob n. breetvelt · wp photo album plusSep 23, 2026
CVE-2026-94124
34Monitor
WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability
HighCVSS 8.5No exploitEPSS 0%
- SQL injection
levelfourdevelopment · wp easycartSep 23, 2026
CVE-2026-94174
30Monitor
WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
webfactory · email logSep 23, 2026
CVE-2026-94176
28Monitor
WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kitae park · mang board wpSep 23, 2026
CVE-2026-94179
28Monitor
WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
razorpay · razorpay payment buttonSep 23, 2026
CVE-2026-94181
29Monitor
Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
the browser company of new york · arcSep 23, 2026
CVE-2026-94487
32Monitor
WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- CSRF
publishpress · publishpress capabilitiesSep 23, 2026
CVE-2026-95513
30Monitor
WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
vcita · online booking & scheduling calendar for wordpress by vcitaSep 23, 2026
CVE-2026-95515
28Monitor
WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
kevin stover · ninja formsSep 23, 2026
CVE-2026-95522
30Monitor
WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
syed balkhi · easy digital downloadsSep 23, 2026
CVE-2026-95528
28Monitor
WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
mohammed kaludi · core web vitals & pagespeed boosterSep 23, 2026
CVE-2026-95529
28Monitor
WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
codepeople · calculated fields formSep 23, 2026
CVE-2026-95590
28Monitor
WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
tainacan · tainacanSep 23, 2026
CVE-2026-95593
30Monitor
WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
ben roberts · ultimeterSep 23, 2026
CVE-2026-95601
37Monitor
WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
wbw plugins · product filter by wbwSep 23, 2026
CVE-2026-95603
28Monitor
WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
victor rodriguez · reycob product import exportSep 23, 2026
CVE-2026-95604
30Monitor
WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
tangible · loops & logicSep 23, 2026
CVE-2026-96770
37Monitor
s2s-proxy accepts untrusted client certificates
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
temporal technologies, inc. · s2s-proxySep 23, 2026
CVE-2026-96872
11Monitor
WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions
LowCVSS 2.9Proof of conceptEPSS 0%
- Pre-auth
the wikimedia foundation · mediawiki - wikilambda extensionSep 23, 2026
CVE-2026-18181
32Monitor
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
ibm · financial transaction managerSep 23, 2026
CVE-2026-18184
29Monitor
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- XXE
ibm · financial transaction managerSep 23, 2026
CVE-2026-18185
29Monitor
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · financial transaction managerSep 23, 2026
CVE-2026-18490
35Monitor
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
ibm · financial transaction managerSep 23, 2026
CVE-2026-18872
37Monitor
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
ibm · financial transaction managerSep 23, 2026
CVE-2026-18875
29Monitor
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
ibm · financial transaction managerSep 23, 2026
CVE-2026-19179
32Monitor
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
ibm · financial transaction managerSep 23, 2026
CVE-2026-68490
32Monitor
Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.
HighCVSS 8.2No exploitEPSS 0%
webpros · cpanelSep 23, 2026
CVE-2026-68492
34Monitor
An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users
HighCVSS 8.7No exploitEPSS 0%
- RCE
webpros · pleskSep 23, 2026
CVE-2026-82405
34Monitor
Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
klever-io · klever-goSep 23, 2026
CVE-2026-82406
28Monitor
Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace
HighCVSS 7.1No exploitEPSS 0%
klever-io · klever-goSep 23, 2026
CVE-2026-82407
28Monitor
Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS
HighCVSS 7.0No exploitEPSS 0%
- Deserialization
klever-io · klever-goSep 23, 2026
CVE-2026-82409
33Monitor
Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery
HighCVSS 8.4No exploitEPSS 0%
klever-io · klever-goSep 23, 2026
CVE-2026-86064
34Monitor
Klever-Go: /log controls global node logging
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Info leak
klever-io · klever-goSep 23, 2026
CVE-2026-87898
37Monitor
OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
CriticalCVSS 9.4No exploitEPSS 1%
- RCE
- Command injection
webpros · plesk extension "site import"Sep 23, 2026
CVE-2026-87899
37Monitor
Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
webpros · cpanelSep 23, 2026
CVE-2026-87900
37Monitor
Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute a
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
webpros · wp toolkit for cpanelSep 23, 2026
CVE-2026-94183
29Monitor
Address bar spoofing risk in affected Android versions of Arc Search
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
the browser company of new york · arc searchSep 23, 2026
CVE-2026-96826
30Monitor
WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability
HighCVSS 7.6No exploitEPSS 0%
- SQL injection
shazzad hossain khan · w4 post listSep 23, 2026
CVE-2025-63564
39Monitor
SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP re
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- SQL injection
Sep 23, 2026
CVE-2026-95844
34Monitor
Moquette deeply nested MQTT topics can cause stack exhaustion
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
moquette · moquetteSep 23, 2026
CVE-2026-96651
28Monitor
Plex Media Server path traversal
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
plex · media serverSep 23, 2026
CVE-2026-96652
55Plan
Plex Media Server SSRF
MediumCVSS 5.3KEVWeaponizedEPSS 11%
- SSRF
plex · media serverSep 23, 2026
CVE-2026-96654
60This week
Plex Media Server URL injection
MediumCVSS 6.9KEVWeaponizedEPSS 1%
- Pre-auth
plex · media serverSep 23, 2026
CVE-2026-96655
54Plan
Plex Media Server arbitrary-host SSRF
MediumCVSS 5.3KEVWeaponizedEPSS 10%
- SSRF
plex · media serverSep 23, 2026
CVE-2026-96656
65This week
Plex Media Server arbitrary file write
HighCVSS 8.6KEVWeaponizedEPSS 1%
- Path traversal
plex · media serverSep 23, 2026
CVE-2026-96754
37Monitor
orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalSep 23, 2026
CVE-2026-96759
37Monitor
orval before 8.29.0 Code Injection via operationId
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
orval-labs · orvalSep 23, 2026
CVE-2026-19125
32Monitor
EthPress <= 2.3.5 - Unauthenticated Authentication Bypass
HighCVSS 8.1Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
lynn999 · ethpress – web3 loginSep 23, 2026
CVE-2026-86583
35Monitor
Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip
HighCVSS 8.8Proof of conceptEPSS 0%
carazo · import and export users and customersSep 23, 2026
CVE-2026-93352
37Monitor
Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload
CriticalCVSS 9.3No exploitEPSS 1%
- pre-auth RCE
- File upload
plank · laravel-mediableSep 23, 2026
CVE-2026-86926
31Monitor
A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 data
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
claris · filemaker serverSep 23, 2026
CVE-2026-86930
36Monitor
An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a containe
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
claris · filemaker serverSep 23, 2026
CVE-2026-86934
36Monitor
An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
claris · filemaker serverSep 23, 2026
CVE-2026-86938
29Monitor
A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated admini
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Local privilege escalation
- Broken access control (IDOR)
claris · filemaker proSep 23, 2026
CVE-2026-91775
29Monitor
LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- XSS
limesurvey · limesurveySep 23, 2026
CVE-2026-59990
30Monitor
Jawn: Uncontrolled nesting depth in JSON parser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
typelevel · jawnSep 23, 2026
CVE-2026-61695
30Monitor
Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Denial of service
square · wireSep 23, 2026
CVE-2026-61814
30Monitor
Jawn: Quadratic parsing effort in AsyncParser
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
typelevel · jawnSep 23, 2026
CVE-2026-63132
36Monitor
OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
openbao · openbaoSep 23, 2026
CVE-2026-76086
34Monitor
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
HighCVSS 8.5No exploitEPSS 0%
- SSRF
- Broken access control (IDOR)
verbb · formieSep 23, 2026
CVE-2026-76087
32Monitor
Formie: Unauthenticated users can overwrite incomplete submissions via submit action
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
verbb · formieSep 23, 2026
CVE-2026-76089
30Monitor
Formie: Missing authorization on sent notification resend modal exposes submission PII
HighCVSS 7.7No exploitEPSS 0%
- Info leak
verbb · formieSep 23, 2026
CVE-2026-76648
34Monitor
Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
red hat · red hat ansible automation platform 2.7Sep 23, 2026
CVE-2026-77422
30Monitor
JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
jline · jline3Sep 23, 2026
CVE-2026-77423
30Monitor
JLine: ReDoS in Built-in Less Viewer Search
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
jline · jline3Sep 23, 2026
CVE-2026-77602
39Monitor
OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
openc3 · cosmosSep 23, 2026
CVE-2026-82368
34Monitor
Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to co
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
brocade · sannavSep 23, 2026
CVE-2026-84474
39Monitor
Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and
CriticalCVSS 9.9No exploitEPSS 0%
red hat · red hat ansible automation platform 2.4 for rhel 8Sep 23, 2026
CVE-2026-84486
32Monitor
Automation-controller: automation-controller-container: automation-controller: unauthenticated debug scheduler-trigger endpoints (allowany, routed without debug
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
red hat · red hat ansible automation platform 2.6 for rhel 9Sep 23, 2026
CVE-2026-84499
30Monitor
Automation-controller: automation-controller-container: automation-controller: write-only survey password recovered in plaintext via schedule/workflowjobtemplat
HighCVSS 7.7No exploitEPSS 0%
- Info leak
red hat · red hat ansible automation platform 2.5 for rhel 8Sep 23, 2026
CVE-2026-84502
39Monitor
Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
red hat · red hat ansible automation platform 2.4 for rhel 8Sep 23, 2026
CVE-2026-96541
30Monitor
Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
red hat · red hat enterprise linux 10Sep 23, 2026
CVE-2026-66070
30Monitor
RabbitMQ: CORS * reflects Origin with Allow-Credentials
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
broadcom · rabbitmq serverSep 23, 2026
CVE-2026-66079
32Monitor
RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
broadcom · rabbitmq serverSep 23, 2026
CVE-2026-67238
28Monitor
RabbitMQ: Atom-table exhaustion via reply-to queue name decoding
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
broadcom · rabbitmq serverSep 23, 2026
CVE-2026-75884
36Monitor
Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups
CriticalCVSS 9.1No exploitEPSS 0%
red hat · red hat ansible automation platform 2.4 for rhel 8Sep 23, 2026
CVE-2026-84683
34Monitor
Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink
HighCVSS 8.7No exploitEPSS 0%
- XSS
red hat · red hat ansible automation platform 2.5 for rhel 8Sep 23, 2026
CVE-2026-84691
34Monitor
Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_
HighCVSS 8.7No exploitEPSS 0%
red hat · red hat ansible automation platform 2.5 for rhel 8Sep 23, 2026
CVE-2026-84706
30Monitor
Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_en
HighCVSS 7.6No exploitEPSS 0%
- RCE
red hat · red hat ansible automation platform 2.5 for rhel 8Sep 23, 2026
CVE-2026-84714
28Monitor
Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fiel
HighCVSS 7.1No exploitEPSS 0%
- SSTI
red hat · red hat ansible automation platform 2.5 for rhel 8Sep 23, 2026
CVE-2026-84719
39Monitor
Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass
CriticalCVSS 9.9No exploitEPSS 0%
- Broken access control (IDOR)
red hat · red hat ansible automation platform 2.4 for rhel 8Sep 23, 2026
CVE-2026-85475
28Monitor
Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote cod
HighCVSS 7.2No exploitEPSS 0%
- RCE
red hat · red hat ansible automation platform 2.7Sep 23, 2026
CVE-2026-86065
30Monitor
Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
klever-io · klever-goSep 23, 2026
CVE-2026-96762
22Monitor
kvcache-ai mooncake RPC Path UnmountSegment authorization
MediumCVSS 5.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
kvcache-ai · mooncakeSep 23, 2026
CVE-2026-96889
31Monitor
Librsvg: use-after-free when xml includes have duplicated entities
HighCVSS 7.8Proof of conceptEPSS 0%
- RCE
- Memory safety
red hat · red hat enterprise linux 10Sep 23, 2026
CVE-2026-66077
29Monitor
RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI
HighCVSS 7.3No exploitEPSS 0%
- XSS
broadcom · rabbitmq serverSep 23, 2026
CVE-2026-67231
36Monitor
RabbitMQ: Trust-store whitelist by Issuer+Serial only
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
broadcom · rabbitmq serverSep 23, 2026
CVE-2026-67232
32Monitor
RabbitMQ: Web-MQTT decompression bomb
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
broadcom · rabbitmq serverSep 23, 2026
CVE-2026-67235
28Monitor
RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
broadcom · rabbitmq serverSep 23, 2026
CVE-2026-67404
36Monitor
RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Weak crypto
broadcom · rabbitmq serverSep 23, 2026
CVE-2026-6721
39Monitor
Multiple Vulnerabilities in IBM Concert Software
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Command injection
ibm · concertSep 23, 2026
CVE-2026-6730
31Monitor
Multiple Vulnerabilities in IBM Concert Software
HighCVSS 7.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · concertSep 23, 2026
CVE-2026-6794
31Monitor
Multiple Vulnerabilities in IBM Concert Software
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
ibm · concertSep 23, 2026
CVE-2026-6928
39Monitor
Multiple Vulnerabilities in IBM Concert Software
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
ibm · concertSep 23, 2026