By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 68 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
31Monitor	CVE-2026-97594No exploit	landlock: Fix use-after-free of the source's parent directorylinux · linux	High7.8	—	0.1%	Sep 25, 2026
30Monitor	CVE-2026-97595No exploit	mac802154: fix use-after-free of sdata via queued RX frameslinux · linux Pre-auth	High7.5	—	0.2%	Sep 25, 2026
31Monitor	CVE-2026-97602No exploit	inet: frags: invalidate queues before flushing themlinux · linux Local privilege escalation	High7.8	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-97608No exploit	netfilter: nf_log: unregister loggers before per-net teardownlinux · linux	High7.0	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-97609No exploit	netfilter: cttimeout: prevent UAF during module unloadlinux · linux	High7.0	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-97611No exploit	net: openvswitch: fix use-after-free of the flow table mask arraylinux · linux	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-97612No exploit	net: mpls: clear inner_protocol when the last label is poppedlinux · linux	High7.8	—	0.1%	Sep 25, 2026
32Monitor	CVE-2026-97875No exploit	DNS rebinding vulnerability in rojo serve HTTP APIrojo-rbx · rojo · CWE-350 Pre-auth	High8.1	—	0.2%	Sep 25, 2026
31Monitor	CVE-2026-97903No exploit	exit: hold a reference to thread_pid across proc_flush_pidlinux · linux	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-97910No exploit	ASoC: sprd: validate compress buffer sizes against fixed allocationslinux · linux	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-97911No exploit	accel: ethosu: Ensure SRAM region size matches joblinux · linux	High7.8	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-97926No exploit	ufs: validate cylinder group metadata before caching itlinux · linux	High7.0	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-97931No exploit	ALSA: us122l: Prevent write upgrades for read mappingslinux · linux	High7.0	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-97937No exploit	ftrace: fork: Initialize function graph state before copy_exec_state()linux · linux	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-97940No exploit	ipv6: fix fib6 walker UAF on seq stoplinux · linux	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-97941Proof of concept	mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid racelinux · linux	High7.8	—	0.1%	Sep 25, 2026
0Monitor	CVE-2026-97947No exploit	x86/amd_node: Fix potential NULL pointer dereferencelinux · linux	—	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-97953No exploit	net: stmmac: fix TX descriptor availability check for TSO trafficlinux · linux Pre-auth	High7.0	—	0.4%	Sep 25, 2026
35Monitor	CVE-2026-97957No exploit	net: hinic: fix mailbox segment buffer overflowlinux · linux	High8.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-97971No exploit	nstree: check listing permission before taking a namespace referencelinux · linux	High7.8	—	0.1%	Sep 25, 2026
30Monitor	CVE-2026-97990No exploit	vdpa_sim_net: check TX pull result before RX copylinux · linux	High7.5	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-97991No exploit	vdpa_sim_blk: reject out-of-range sector startslinux · linux	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-98002No exploit	iommu/amd: Fix ineffective error check in nested domain allocationlinux · linux	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-98017No exploit	net/sched: defer qdisc freeing after failed creationlinux · linux	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-98023No exploit	vxlan: reject dynamic fdb entries that reference a nexthop idlinux · linux	High7.8	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-98027No exploit	net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer sizelinux · linux	High7.0	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-98029No exploit	eth: nfp: bound the ntuple rule dump by the caller's buffer sizelinux · linux	High7.0	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-98030No exploit	net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer sizelinux · linux	High7.0	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-98041No exploit	bpf: Don't predict JMP32 pointer vs zero comparisonslinux · linux	High7.0	—	0.1%	Sep 25, 2026
30Monitor	CVE-2026-98050No exploit	mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue contextlinux · linux kernel · CWE-362 Pre-auth Race condition	High7.5	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-98052No exploit	net: bcmasp: clear txcb->last before writing each descriptorlinux · linux kernel	High7.8	—	0.1%	Sep 25, 2026
30Monitor	CVE-2026-98056No exploit	nvme: remove stale namespaces by NSID range during scanlinux · linux Pre-auth Denial of service	High7.5	—	0.6%	Sep 25, 2026
32Monitor	CVE-2026-98069No exploit	net/rds: acquire the fastpath locks in rds_conn_shutdown()linux · linux Pre-auth	High8.1	—	0.5%	Sep 25, 2026
32Monitor	CVE-2026-98070No exploit	net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()linux · linux Pre-auth	High8.1	—	0.4%	Sep 25, 2026
31Monitor	CVE-2026-98073No exploit	net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().linux · linux	High7.8	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-98083No exploit	btrfs: fix transaction use-after-free in raid stripe insertionlinux · linux kernel · CWE-416 Memory safety	High7.0	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-98093No exploit	ASoC: fsl_micfil: balance mclk enable/disablelinux · linux kernel · CWE-404	High7.8	—	0.1%	Sep 25, 2026
29Monitor	CVE-2026-98096No exploit	ipv6: sr: restore network header before routing and forwardinglinux · linux kernel · CWE-787 Pre-auth Memory safety	High7.4	—	0.5%	Sep 25, 2026
31Monitor	CVE-2026-98107No exploit	Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connectlinux · linux kernel · CWE-787 Memory safety	High7.8	—	0.1%	Sep 25, 2026
30Monitor	CVE-2026-98108No exploit	Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchanlinux · linux kernel · CWE-787 Pre-auth Memory safety	High7.5	—	0.2%	Sep 25, 2026
28Monitor	CVE-2026-98110No exploit	Bluetooth: btintel: bound firmware ID by TLV lengthlinux · linux kernel · CWE-125 Memory safety	High7.1	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-98111No exploit	Bluetooth: btintel: validate version TLV value lengthslinux · linux kernel · CWE-125 Memory safety	High7.1	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-98112No exploit	ksmbd: fix listener task lifetime on netdev eventslinux · linux kernel · CWE-362 Race condition	High7.8	—	0.0%	Sep 25, 2026
35Monitor	CVE-2026-98115No exploit	ksmbd: safely drain sessions during logofflinux · linux kernel · CWE-362 Race condition	High8.8	—	0.2%	Sep 25, 2026
31Monitor	CVE-2026-98116No exploit	ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAFlinux · linux kernel · CWE-416 Memory safety	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-98117No exploit	cachefiles: Fix potential UAF/KASAN warninglinux · linux kernel · CWE-416 Memory safety	High7.8	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-98118No exploit	netfs: Fix readahead synchronisation issues by loading all folios upfrontlinux · linux kernel · CWE-362 Race condition	High7.1	—	0.0%	Sep 25, 2026
31Monitor	CVE-2026-98122No exploit	vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()linux · linux kernel · CWE-416 Memory safety	High7.8	—	0.1%	Sep 25, 2026
32Monitor	CVE-2026-98130No exploit	sctp: fix a TOCTOU race in SCTP_CMD_TIMER_STARTlinux · linux kernel · CWE-362 Pre-auth Race condition	High8.1	—	0.4%	Sep 25, 2026
28Monitor	CVE-2026-98136No exploit	ntfs: bound $AttrDef table walk to the loaded table sizelinux · linux kernel · CWE-125 Memory safety	High7.1	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-98143No exploit	accel: ethosu: Don't read the U65 rounding mode as a storage modelinux · linux kernel · CWE-681	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-98149No exploit	bpf: Fix percpu map update indexing with sparse CPU IDslinux · linux kernel · CWE-125 Memory safety	High7.8	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-98150No exploit	bpf: Fix BPF_F_CPU validation for sparse CPU IDslinux · linux kernel	High7.0	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-98154No exploit	nvme-rdma: fix -EIO cleanup order in queue_rqlinux · linux kernel · CWE-415 Memory safety	High7.0	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-98155No exploit	accel/qaic: Address potential out-of-bounds read in resp_worker()linux · linux kernel · CWE-125 Memory safety	High7.1	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-98156No exploit	drm/virtio: use the DMA API for resource backing on Xenlinux · linux kernel	High7.8	—	0.1%	Sep 25, 2026
35Monitor	CVE-2026-96812No exploit	Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSEgoogle · gvisor · CWE-269 Local privilege escalation	High8.8	—	0.1%	Sep 25, 2026
36Monitor	CVE-2026-39353No exploit	InvoicePlane: Remote Code Execution via Writable Templates Directoryinvoiceplane · invoiceplane · CWE-98 RCE	Critical9.1	—	0.4%	Sep 25, 2026
36Monitor	CVE-2026-42322Proof of concept	Piwigo: Authenticated RCE via File Upload in Logo Upload Featurepiwigo · piwigo · CWE-434 RCE File upload	Critical9.1	—	1.2%	Sep 25, 2026
28Monitor	CVE-2026-42323No exploit	Piwigo: SQL Injection in Batch Managerpiwigo · piwigo · CWE-89 SQL injection	High7.2	—	0.9%	Sep 25, 2026
28Monitor	CVE-2026-42324No exploit	Piwigo: Second-Order SQL Injectionpiwigo · piwigo · CWE-89 SQL injection	High7.2	—	0.9%	Sep 25, 2026
32Monitor	CVE-2026-44642No exploit	Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)piwigo · piwigo · CWE-89 Pre-auth SQL injection	High8.1	—	1.2%	Sep 25, 2026
30Monitor	CVE-2026-49850No exploit	InvoicePlane: Missing CSRF Protection on State-Changing delete Actionsinvoiceplane · invoiceplane · CWE-22 Path traversal CSRF	High7.5	—	0.3%	Sep 25, 2026
30Monitor	CVE-2026-50547No exploit	InvoicePlane permits local file inclusion through the e-invoice XML configuration identifierinvoiceplane · invoiceplane · CWE-22 Path traversal	High7.5	—	0.4%	Sep 25, 2026
35Monitor	CVE-2025-51457No exploit	D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoCWE-77 RCE Command injection	High8.8	—	1.2%	Sep 25, 2026
28Monitor	CVE-2026-56723No exploit	Zammad: Missing authorization on ticket attachment downloadzammad · zammad · CWE-863 Broken access control (IDOR)	High7.1	—	0.2%	Sep 25, 2026
28Monitor	CVE-2026-56724No exploit	Zammad: Incorrect implementation of permission checks in the knowledge base modulezammad · zammad · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Sep 25, 2026
26Monitor	CVE-2026-51772Proof of concept	A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance.CWE-918 SSRF	Medium6.5	—	0.3%	Sep 25, 2026
32Monitor	CVE-2026-51773No exploit	An issue in the VMware datastore driver of OpenStack glance_store.CWE-918 SSRF	High8.1	—	0.3%	Sep 25, 2026
30Monitor	CVE-2026-52622No exploit	An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allowsCWE-200 Pre-auth Info leak	High7.5	—	0.3%	Sep 25, 2026
31Monitor	CVE-2026-79153No exploit	Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that alCWE-269 Local privilege escalation	High7.8	—	0.0%	Sep 25, 2026
30Monitor	CVE-2026-88421No exploit	Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to vieCWE-284 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Sep 25, 2026
37Monitor	CVE-2026-95832No exploit	Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shellkovid goyal · kitty · CWE-74 RCE	Critical9.3	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-100072No exploit	ACPI: platform: Use acpi_bus_get_primary_device()linux · linux kernel · CWE-416 Memory safety	High7.8	—	0.1%	Sep 25, 2026
39Monitor	CVE-2026-100075No exploit	RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counterslinux · linux kernel Pre-auth	Critical9.8	—	0.4%	Sep 25, 2026
35Monitor	CVE-2026-84884No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilities.ibm · guardium data protection · CWE-256	High8.8	—	0.2%	Sep 25, 2026
35Monitor	CVE-2026-85029No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilities.ibm · guardium data protection · CWE-22 RCE Path traversal	High8.8	—	0.5%	Sep 25, 2026
36Monitor	CVE-2026-85542No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilities.ibm · guardium data protection · CWE-78 RCE Command injection	High8.8	—	2.9%	Sep 25, 2026
37Monitor	CVE-2026-93641No exploit	Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitationzimbra · zimbra collaboration suite (zcs) · CWE-79 Pre-auth XSS	Critical9.3	—	0.2%	Sep 25, 2026
37Monitor	CVE-2026-93642No exploit	Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitationzimbra · zimbra collaboration suite (zcs) · CWE-79 Pre-auth XSS	Critical9.3	—	0.2%	Sep 25, 2026
39Monitor	CVE-2026-93643No exploit	Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Requestzimbra · zimbra collaboration suite (zcs) · CWE-22 pre-auth RCE Path traversal	Critical9.8	—	0.9%	Sep 25, 2026
37Monitor	CVE-2026-93647No exploit	Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Addresszimbra · zimbra collaboration suite (zcs) · CWE-79 Pre-auth XSS	Critical9.3	—	0.2%	Sep 25, 2026
35Monitor	CVE-2026-93834Proof of concept	Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escapered hat · red hat enterprise linux 10 · CWE-416 Path traversal Memory safety Race condition	High8.8	—	0.4%	Sep 25, 2026
28Monitor	CVE-2026-56727No exploit	Zammad: PGP signature spoofing via unvalidated verification returnzammad · zammad · CWE-287 Pre-auth Auth bypass	High7.1	—	0.2%	Sep 25, 2026
33Monitor	CVE-2026-56731No exploit	Zammad: Cross-Site Scripting in Ticket Notificationszammad · zammad · CWE-79 XSS	High8.4	—	0.2%	Sep 25, 2026
34Monitor	CVE-2026-56733No exploit	Zammad: Incorrect Authorization and Improper Privilege Managementzammad · zammad · CWE-269	High8.7	—	0.2%	Sep 25, 2026
35Monitor	CVE-2026-61525No exploit	Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controllerzammad · zammad · CWE-22 Pre-auth Path traversal	High8.8	—	0.3%	Sep 25, 2026
34Monitor	CVE-2026-84462No exploit	Zammad: AI Agent template sanitizer bypass leads to remote code executionzammad · zammad · CWE-20 RCE	High8.6	—	0.2%	Sep 25, 2026
34Monitor	CVE-2026-47679No exploit	GLPI: arbitrary file deletionglpi-project · glpi · CWE-22 Path traversal	High8.5	—	0.3%	Sep 25, 2026
30Monitor	CVE-2026-49470No exploit	GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Forceglpi-project · glpi · CWE-307	High7.7	—	0.3%	Sep 25, 2026
30Monitor	CVE-2026-53625Proof of concept	GLPI: Privilege Escalation via authtype API manipulationglpi-project · glpi · CWE-862 Broken access control (IDOR)	High7.5	—	0.5%	Sep 25, 2026
28Monitor	CVE-2026-53629Proof of concept	GLPI: SQL injection in history tabglpi-project · glpi · CWE-89 SQL injection	High7.1	—	1.0%	Sep 25, 2026
28Monitor	CVE-2026-84862No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilities.ibm · guardium data protection · CWE-502 RCE Deserialization	High7.2	—	0.3%	Sep 25, 2026
28Monitor	CVE-2026-93306No exploit	This Power System update is being released to addressibm · power system e1080 (9080-hex) firmware · CWE-125 Pre-auth Memory safety	High7.1	—	0.1%	Sep 25, 2026
36Monitor	CVE-2026-84458No exploit	Zammad: Account takeover via unverified email matching during SSO auto-linkzammad · zammad · CWE-287 Pre-auth Auth bypass	Critical9.1	—	0.3%	Sep 25, 2026
28Monitor	CVE-2026-84464No exploit	Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization datazammad · zammad · CWE-200 Broken access control (IDOR) Info leak	High7.1	—	0.2%	Sep 25, 2026
28Monitor	CVE-2026-33639No exploit	InvoicePlane permits DDL injection through tax_rate_decimal_placesinvoiceplane · invoiceplane · CWE-89 SQL injection	High7.2	—	0.5%	Sep 25, 2026
36Monitor	CVE-2026-62262No exploit	Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`piwigo · piwigo · CWE-89 Pre-auth SQL injection	Critical9.1	—	0.7%	Sep 25, 2026
32Monitor	CVE-2026-67236No exploit	RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /loginbroadcom · rabbitmq server · CWE-312 Pre-auth XSS	High8.2	—	0.1%	Sep 25, 2026
39Monitor	CVE-2026-92161No exploit	FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth providerfriendsofflarum · oauth · CWE-345 Pre-auth	Critical9.8	—	0.2%	Sep 25, 2026

CVE-2026-97594
31Monitor
landlock: Fix use-after-free of the source's parent directory
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97595
30Monitor
mac802154: fix use-after-free of sdata via queued RX frames
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
linux · linuxSep 25, 2026
CVE-2026-97602
31Monitor
inet: frags: invalidate queues before flushing them
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
linux · linuxSep 25, 2026
CVE-2026-97608
28Monitor
netfilter: nf_log: unregister loggers before per-net teardown
HighCVSS 7.0No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97609
28Monitor
netfilter: cttimeout: prevent UAF during module unload
HighCVSS 7.0No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97611
31Monitor
net: openvswitch: fix use-after-free of the flow table mask array
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97612
31Monitor
net: mpls: clear inner_protocol when the last label is popped
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97875
32Monitor
DNS rebinding vulnerability in rojo serve HTTP API
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
rojo-rbx · rojoSep 25, 2026
CVE-2026-97903
31Monitor
exit: hold a reference to thread_pid across proc_flush_pid
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97910
31Monitor
ASoC: sprd: validate compress buffer sizes against fixed allocations
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97911
31Monitor
accel: ethosu: Ensure SRAM region size matches job
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97926
28Monitor
ufs: validate cylinder group metadata before caching it
HighCVSS 7.0No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97931
28Monitor
ALSA: us122l: Prevent write upgrades for read mappings
HighCVSS 7.0No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97937
31Monitor
ftrace: fork: Initialize function graph state before copy_exec_state()
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97940
31Monitor
ipv6: fix fib6 walker UAF on seq stop
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97941
31Monitor
mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race
HighCVSS 7.8Proof of conceptEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97947
0Monitor
x86/amd_node: Fix potential NULL pointer dereference
No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97953
28Monitor
net: stmmac: fix TX descriptor availability check for TSO traffic
HighCVSS 7.0No exploitEPSS 0%
- Pre-auth
linux · linuxSep 25, 2026
CVE-2026-97957
35Monitor
net: hinic: fix mailbox segment buffer overflow
HighCVSS 8.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97971
31Monitor
nstree: check listing permission before taking a namespace reference
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97990
30Monitor
vdpa_sim_net: check TX pull result before RX copy
HighCVSS 7.5No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-97991
31Monitor
vdpa_sim_blk: reject out-of-range sector starts
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-98002
31Monitor
iommu/amd: Fix ineffective error check in nested domain allocation
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-98017
31Monitor
net/sched: defer qdisc freeing after failed creation
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-98023
31Monitor
vxlan: reject dynamic fdb entries that reference a nexthop id
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-98027
28Monitor
net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size
HighCVSS 7.0No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-98029
28Monitor
eth: nfp: bound the ntuple rule dump by the caller's buffer size
HighCVSS 7.0No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-98030
28Monitor
net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size
HighCVSS 7.0No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-98041
28Monitor
bpf: Don't predict JMP32 pointer vs zero comparisons
HighCVSS 7.0No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-98050
30Monitor
mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Race condition
linux · linux kernelSep 25, 2026
CVE-2026-98052
31Monitor
net: bcmasp: clear txcb->last before writing each descriptor
HighCVSS 7.8No exploitEPSS 0%
linux · linux kernelSep 25, 2026
CVE-2026-98056
30Monitor
nvme: remove stale namespaces by NSID range during scan
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
linux · linuxSep 25, 2026
CVE-2026-98069
32Monitor
net/rds: acquire the fastpath locks in rds_conn_shutdown()
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 25, 2026
CVE-2026-98070
32Monitor
net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
linux · linuxSep 25, 2026
CVE-2026-98073
31Monitor
net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().
HighCVSS 7.8No exploitEPSS 0%
linux · linuxSep 25, 2026
CVE-2026-98083
28Monitor
btrfs: fix transaction use-after-free in raid stripe insertion
HighCVSS 7.0No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98093
31Monitor
ASoC: fsl_micfil: balance mclk enable/disable
HighCVSS 7.8No exploitEPSS 0%
linux · linux kernelSep 25, 2026
CVE-2026-98096
29Monitor
ipv6: sr: restore network header before routing and forwarding
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98107
31Monitor
Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98108
30Monitor
Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98110
28Monitor
Bluetooth: btintel: bound firmware ID by TLV length
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98111
28Monitor
Bluetooth: btintel: validate version TLV value lengths
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98112
31Monitor
ksmbd: fix listener task lifetime on netdev events
HighCVSS 7.8No exploitEPSS 0%
- Race condition
linux · linux kernelSep 25, 2026
CVE-2026-98115
35Monitor
ksmbd: safely drain sessions during logoff
HighCVSS 8.8No exploitEPSS 0%
- Race condition
linux · linux kernelSep 25, 2026
CVE-2026-98116
31Monitor
ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98117
31Monitor
cachefiles: Fix potential UAF/KASAN warning
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98118
28Monitor
netfs: Fix readahead synchronisation issues by loading all folios upfront
HighCVSS 7.1No exploitEPSS 0%
- Race condition
linux · linux kernelSep 25, 2026
CVE-2026-98122
31Monitor
vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98130
32Monitor
sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Race condition
linux · linux kernelSep 25, 2026
CVE-2026-98136
28Monitor
ntfs: bound $AttrDef table walk to the loaded table size
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98143
31Monitor
accel: ethosu: Don't read the U65 rounding mode as a storage mode
HighCVSS 7.8No exploitEPSS 0%
linux · linux kernelSep 25, 2026
CVE-2026-98149
31Monitor
bpf: Fix percpu map update indexing with sparse CPU IDs
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98150
28Monitor
bpf: Fix BPF_F_CPU validation for sparse CPU IDs
HighCVSS 7.0No exploitEPSS 0%
linux · linux kernelSep 25, 2026
CVE-2026-98154
28Monitor
nvme-rdma: fix -EIO cleanup order in queue_rq
HighCVSS 7.0No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98155
28Monitor
accel/qaic: Address potential out-of-bounds read in resp_worker()
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-98156
31Monitor
drm/virtio: use the DMA API for resource backing on Xen
HighCVSS 7.8No exploitEPSS 0%
linux · linux kernelSep 25, 2026
CVE-2026-96812
35Monitor
Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
google · gvisorSep 25, 2026
CVE-2026-39353
36Monitor
InvoicePlane: Remote Code Execution via Writable Templates Directory
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
invoiceplane · invoiceplaneSep 25, 2026
CVE-2026-42322
36Monitor
Piwigo: Authenticated RCE via File Upload in Logo Upload Feature
CriticalCVSS 9.1Proof of conceptEPSS 1%
- RCE
- File upload
piwigo · piwigoSep 25, 2026
CVE-2026-42323
28Monitor
Piwigo: SQL Injection in Batch Manager
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
piwigo · piwigoSep 25, 2026
CVE-2026-42324
28Monitor
Piwigo: Second-Order SQL Injection
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
piwigo · piwigoSep 25, 2026
CVE-2026-44642
32Monitor
Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)
HighCVSS 8.1No exploitEPSS 1%
- Pre-auth
- SQL injection
piwigo · piwigoSep 25, 2026
CVE-2026-49850
30Monitor
InvoicePlane: Missing CSRF Protection on State-Changing delete Actions
HighCVSS 7.5No exploitEPSS 0%
- Path traversal
- CSRF
invoiceplane · invoiceplaneSep 25, 2026
CVE-2026-50547
30Monitor
InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier
HighCVSS 7.5No exploitEPSS 0%
- Path traversal
invoiceplane · invoiceplaneSep 25, 2026
CVE-2025-51457
35Monitor
D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpo
HighCVSS 8.8No exploitEPSS 1%
- RCE
- Command injection
Sep 25, 2026
CVE-2026-56723
28Monitor
Zammad: Missing authorization on ticket attachment download
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
zammad · zammadSep 25, 2026
CVE-2026-56724
28Monitor
Zammad: Incorrect implementation of permission checks in the knowledge base module
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
zammad · zammadSep 25, 2026
CVE-2026-51772
26Monitor
A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance.
MediumCVSS 6.5Proof of conceptEPSS 0%
- SSRF
Sep 25, 2026
CVE-2026-51773
32Monitor
An issue in the VMware datastore driver of OpenStack glance_store.
HighCVSS 8.1No exploitEPSS 0%
- SSRF
Sep 25, 2026
CVE-2026-52622
30Monitor
An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
Sep 25, 2026
CVE-2026-79153
31Monitor
Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that al
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
Sep 25, 2026
CVE-2026-88421
30Monitor
Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to vie
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
Sep 25, 2026
CVE-2026-95832
37Monitor
Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
CriticalCVSS 9.3No exploitEPSS 0%
- RCE
kovid goyal · kittySep 25, 2026
CVE-2026-100072
31Monitor
ACPI: platform: Use acpi_bus_get_primary_device()
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
linux · linux kernelSep 25, 2026
CVE-2026-100075
39Monitor
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
linux · linux kernelSep 25, 2026
CVE-2026-84884
35Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities.
HighCVSS 8.8No exploitEPSS 0%
ibm · guardium data protectionSep 25, 2026
CVE-2026-85029
35Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities.
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Path traversal
ibm · guardium data protectionSep 25, 2026
CVE-2026-85542
36Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities.
HighCVSS 8.8No exploitEPSS 2%
- RCE
- Command injection
ibm · guardium data protectionSep 25, 2026
CVE-2026-93641
37Monitor
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
zimbra · zimbra collaboration suite (zcs)Sep 25, 2026
CVE-2026-93642
37Monitor
Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
zimbra · zimbra collaboration suite (zcs)Sep 25, 2026
CVE-2026-93643
39Monitor
Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Path traversal
zimbra · zimbra collaboration suite (zcs)Sep 25, 2026
CVE-2026-93647
37Monitor
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- XSS
zimbra · zimbra collaboration suite (zcs)Sep 25, 2026
CVE-2026-93834
35Monitor
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
HighCVSS 8.8Proof of conceptEPSS 0%
- Path traversal
- Memory safety
- Race condition
red hat · red hat enterprise linux 10Sep 25, 2026
CVE-2026-56727
28Monitor
Zammad: PGP signature spoofing via unvalidated verification return
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
zammad · zammadSep 25, 2026
CVE-2026-56731
33Monitor
Zammad: Cross-Site Scripting in Ticket Notifications
HighCVSS 8.4No exploitEPSS 0%
- XSS
zammad · zammadSep 25, 2026
CVE-2026-56733
34Monitor
Zammad: Incorrect Authorization and Improper Privilege Management
HighCVSS 8.7No exploitEPSS 0%
zammad · zammadSep 25, 2026
CVE-2026-61525
35Monitor
Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Path traversal
zammad · zammadSep 25, 2026
CVE-2026-84462
34Monitor
Zammad: AI Agent template sanitizer bypass leads to remote code execution
HighCVSS 8.6No exploitEPSS 0%
- RCE
zammad · zammadSep 25, 2026
CVE-2026-47679
34Monitor
GLPI: arbitrary file deletion
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
glpi-project · glpiSep 25, 2026
CVE-2026-49470
30Monitor
GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force
HighCVSS 7.7No exploitEPSS 0%
glpi-project · glpiSep 25, 2026
CVE-2026-53625
30Monitor
GLPI: Privilege Escalation via authtype API manipulation
HighCVSS 7.5Proof of conceptEPSS 0%
- Broken access control (IDOR)
glpi-project · glpiSep 25, 2026
CVE-2026-53629
28Monitor
GLPI: SQL injection in history tab
HighCVSS 7.1Proof of conceptEPSS 1%
- SQL injection
glpi-project · glpiSep 25, 2026
CVE-2026-84862
28Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities.
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Deserialization
ibm · guardium data protectionSep 25, 2026
CVE-2026-93306
28Monitor
This Power System update is being released to address
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
ibm · power system e1080 (9080-hex) firmwareSep 25, 2026
CVE-2026-84458
36Monitor
Zammad: Account takeover via unverified email matching during SSO auto-link
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
zammad · zammadSep 25, 2026
CVE-2026-84464
28Monitor
Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
- Info leak
zammad · zammadSep 25, 2026
CVE-2026-33639
28Monitor
InvoicePlane permits DDL injection through tax_rate_decimal_places
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
invoiceplane · invoiceplaneSep 25, 2026
CVE-2026-62262
36Monitor
Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SQL injection
piwigo · piwigoSep 25, 2026
CVE-2026-67236
32Monitor
RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- XSS
broadcom · rabbitmq serverSep 25, 2026
CVE-2026-92161
39Monitor
FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
friendsofflarum · oauthSep 25, 2026