By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 69 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
9Monitor	CVE-2026-96874Proof of concept	Stored XSS in Cargo Drilldown tab namesthe wikimedia foundation · mediawiki - cargo extension · CWE-79 XSS	Low2.3	—	0.2%	Sep 25, 2026
33Monitor	CVE-2026-100248No exploit	The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.rattadan · cosmowarp contract · CWE-1025 Pre-auth	High8.4	—	0.4%	Sep 25, 2026
30Monitor	CVE-2026-67237No exploit	RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpointbroadcom · rabbitmq server · CWE-79 Pre-auth XSS	High7.5	—	0.4%	Sep 25, 2026
30Monitor	CVE-2026-67239No exploit	RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UIbroadcom · rabbitmq server · CWE-79 Pre-auth XSS	High7.6	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-67408No exploit	RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Servicebroadcom · rabbitmq server · CWE-400 Denial of service	High7.1	—	0.4%	Sep 25, 2026
32Monitor	CVE-2026-67409No exploit	RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoSbroadcom · rabbitmq server · CWE-252 Pre-auth	High8.2	—	0.4%	Sep 25, 2026
32Monitor	CVE-2026-67410No exploit	RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpointbroadcom · rabbitmq server · CWE-200 Pre-auth Info leak	High8.2	—	0.4%	Sep 25, 2026
28Monitor	CVE-2026-67419No exploit	RabbitMQ: Consecutive topic wildcards cause combinatorial routing workbroadcom · rabbitmq server · CWE-407	High7.1	—	0.3%	Sep 25, 2026
34Monitor	CVE-2026-89032No exploit	BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layerberriai · litellm · CWE-863 Broken access control (IDOR)	High8.7	—	0.2%	Sep 25, 2026
31Monitor	CVE-2026-91837No exploit	Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injectiongnome · networkmanager-iodine · CWE-78 RCE Local privilege escalation Command injection	High7.8	—	0.1%	Sep 25, 2026
28Monitor	CVE-2026-93365No exploit	Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpointbludit · bludit cms · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Sep 25, 2026
35Monitor	CVE-2026-94445No exploit	Malicious user input may lead to RCE in golang.org/x/playgroundgolang.org/x/playground · golang.org/x/playground · CWE-20 pre-auth RCE	High8.8	—	0.3%	Sep 25, 2026
29Monitor	CVE-2026-100419No exploit	gitoxide gix-fs before 0.23.0 Worktree Escape via Symlinkgitoxidelabs · gitoxide · CWE-59	High7.3	—	0.2%	Sep 25, 2026
34Monitor	CVE-2026-56725No exploit	Zammad: Denial of Service via OTRS Import Controllerzammad · zammad · CWE-306 Pre-auth Auth bypass	High8.7	—	0.4%	Sep 25, 2026
31Monitor	CVE-2026-91838No exploit	Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fieldsgnome · networkmanager-sstp · CWE-78 RCE Local privilege escalation Command injection	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-91839No exploit	Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentialsgnome · networkmanager-fortisslvpn · CWE-93 RCE Local privilege escalation	High7.8	—	0.2%	Sep 25, 2026
31Monitor	CVE-2026-91840No exploit	Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn usernamegnome · networkmanager-vpnc · CWE-93 Local privilege escalation	High7.8	—	0.1%	Sep 25, 2026
31Monitor	CVE-2026-91841No exploit	Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injectiongnome · networkmanager-vpnc · CWE-93 RCE Local privilege escalation	High7.8	—	0.1%	Sep 25, 2026
30Monitor	CVE-2026-88003No exploit	InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgradeinvoiceplane · invoiceplane · CWE-863 Broken access control (IDOR)	High7.5	—	0.3%	Sep 25, 2026
28Monitor	CVE-2026-57449No exploit	Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Tokenactualbudget · actual · CWE-200 Info leak	High7.1	—	0.2%	Sep 25, 2026
37Monitor	CVE-2026-48482No exploit	GLPI: RCE via Form importglpi-project · glpi · CWE-22 RCE Path traversal	Critical9.4	—	0.3%	Sep 25, 2026
30Monitor	CVE-2026-53610No exploit	GLPI: Reflected XSS in dashboardsglpi-project · glpi · CWE-79 Pre-auth XSS	High7.5	—	0.3%	Sep 25, 2026
28Monitor	CVE-2026-53626No exploit	GLPI: Arbitrary Document Read via Form Context Authorization Bypassglpi-project · glpi · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Sep 25, 2026
34Monitor	CVE-2026-55214No exploit	GLPI: Stored XSS in suppliersglpi-project · glpi · CWE-116 XSS	High8.5	—	0.2%	Sep 25, 2026
28Monitor	CVE-2026-84465No exploit	Zammad: S/MIME signature verification allows forged sender impersonationzammad · zammad · CWE-290 Pre-auth Auth bypass	High7.1	—	0.1%	Sep 25, 2026
34Monitor	CVE-2026-97060No exploit	X-SpringBoot through 6.0 Authorization Bypass via User Managementyzcheng90 · x-springboot · CWE-639 Broken access control (IDOR)	High8.6	—	0.3%	Sep 25, 2026
37Monitor	CVE-2026-97063No exploit	X-SpringBoot through 6.0 Authentication Bypass via Login Codeyzcheng90 · x-springboot · CWE-287 Pre-auth Auth bypass	Critical9.3	—	0.2%	Sep 25, 2026
37Monitor	CVE-2026-97064No exploit	X-SpringBoot through 6.0 Authentication Bypass via Static Master Codeyzcheng90 · x-springboot · CWE-1392 Pre-auth Auth bypass Hard-coded credentials	Critical9.3	—	0.3%	Sep 25, 2026
32Monitor	CVE-2026-100208No exploit	Microsoft Office Outlook Remote Code Execution Vulnerabilitymicrosoft · 365 apps · CWE-122 pre-auth RCE Memory safety	High8.1	—	0.4%	Sep 25, 2026
29Monitor	CVE-2026-100310No exploit	GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIXgnu · libextractor · CWE-426 RCE Local privilege escalation	High7.3	—	0.1%	Sep 25, 2026
33Monitor	CVE-2026-100368No exploit	CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappersalastairlundy · cliinvoke.specializations · CWE-78 RCE Command injection	High8.4	—	0.5%	Sep 25, 2026
34Monitor	CVE-2026-100372No exploit	ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.phpmacwarrior · clipbucket-v5 · CWE-22 RCE Path traversal	High8.6	—	1.1%	Sep 25, 2026
30Monitor	CVE-2026-5267No exploit	Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCSciena · navigator ncs · CWE-306 Pre-auth Auth bypass	High7.5	—	0.3%	Sep 25, 2026
27Monitor	CVE-2026-96875Proof of concept	Reflected XSS in Cargo Drilldown hierarchy filtersthe wikimedia foundation · mediawiki - cargo extension · CWE-79 Pre-auth XSS	Medium6.9	—	0.3%	Sep 25, 2026
27Monitor	CVE-2026-96876Proof of concept	Anonymous reflected XSS in CargoExport invalid-alias errorsthe wikimedia foundation · mediawiki - cargo extension · CWE-79 Pre-auth XSS	Medium6.9	—	0.3%	Sep 25, 2026
27Monitor	CVE-2026-96877Proof of concept	Reflected XSS through Cargo Drilldown full-text searchthe wikimedia foundation · mediawiki - cargo extension · CWE-79 Pre-auth XSS	Medium6.9	—	0.3%	Sep 25, 2026
27Monitor	CVE-2026-96878Proof of concept	Cargo Exhibit field alias allows stored XSSthe wikimedia foundation · mediawiki - cargo extension · CWE-79 Pre-auth XSS	Medium6.9	—	0.3%	Sep 25, 2026
33Monitor	CVE-2026-100369No exploit	CliInvoke: Argument Injection in Extensibility Runner Factoryalastairlundy · cliinvoke · CWE-88	High8.4	—	0.3%	Sep 25, 2026
21Monitor	CVE-2026-100380Proof of concept	Reflected XSS in Wikibase Special:SetLabel language validationwikimedia foundation · mediawiki - wikibase extension · CWE-79 Pre-auth XSS	Medium5.3	—	0.4%	Sep 25, 2026
28Monitor	CVE-2026-100387No exploit	pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserializationpgpointcloud · pointcloud · CWE-125 Deserialization Memory safety	High7.2	—	0.3%	Sep 25, 2026
36Monitor	CVE-2026-100389No exploit	GestSup before 3.2.62 Remote Code Execution via IMAP Attachmentgestsup · gestsup · CWE-434 pre-auth RCE File upload	Critical9.2	—	0.5%	Sep 25, 2026
36Monitor	CVE-2026-100390No exploit	Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6tobychui · zoraxy · CWE-290 Pre-auth Auth bypass	Critical9.1	—	0.2%	Sep 25, 2026
35Monitor	CVE-2026-100391No exploit	MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validationmhdzumair · mediaflow-proxy · CWE-918 Pre-auth SSRF	High8.8	—	0.3%	Sep 25, 2026
30Monitor	CVE-2026-10758No exploit	Esri Lerc has a security vulnerabilityesri · lerc · CWE-190 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Sep 25, 2026
30Monitor	CVE-2026-57443No exploit	SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digestsissdandavis · scbe-aethermoore · CWE-306 Pre-auth Auth bypass	High7.5	—	0.7%	Sep 25, 2026
30Monitor	CVE-2026-91765No exploit	SOAP: Unbounded Recursion in Server-Side cleanup_xml_nodephp · php · CWE-674 Pre-auth Denial of service	High7.5	—	0.3%	Sep 25, 2026
21Monitor	CVE-2026-100381Proof of concept	UploadWizard Flickr collection and set titles allow DOM XSSwikimedia foundation · mediawiki - uploadwizard extension · CWE-79 Pre-auth XSS	Medium5.3	—	0.4%	Sep 25, 2026
40Plan	CVE-2026-100382Proof of concept	Unauthenticated remote code execution through wikitext in ExternalDatawikimedia foundation · mediawiki - externaldata extension · CWE-78 pre-auth RCE Command injection	Critical10.0	—	1.2%	Sep 25, 2026
33Monitor	CVE-2026-100501No exploit	Flame through 2.4.0 Brute-Force Attack via Login Endpointpawelmalak · flame · CWE-307 Pre-auth	High8.3	—	0.2%	Sep 25, 2026
34Monitor	CVE-2026-71483No exploit	Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter Viewhorilla · horilla-hr · CWE-79 Pre-auth XSS	High8.5	—	0.3%	Sep 25, 2026
35Monitor	CVE-2026-96795No exploit	Horilla: Authenticated RCE in Horilla List-View Exporthorilla · horilla-hr · CWE-94 RCE	High8.8	—	0.3%	Sep 25, 2026
29Monitor	CVE-2026-100504No exploit	Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128nsa · ghidra · CWE-787 Memory safety	High7.3	—	0.1%	Sep 26, 2026
34Monitor	CVE-2026-100520Proof of concept	Laranode before 1.2.1 Path Traversal in File Manager Upload Endpointcrivion · laranode · CWE-22 Path traversal	High8.7	—	1.1%	Sep 26, 2026
29Monitor	CVE-2026-100529No exploit	OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transferopenclaw · openclaw · CWE-863 Broken access control (IDOR)	High7.4	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100530No exploit	OpenClaw before 2026.8.1 Exec Approval Directory Bindingopenclaw · openclaw · CWE-863 Broken access control (IDOR)	High8.5	—	0.1%	Sep 26, 2026
28Monitor	CVE-2026-100531No exploit	openclaw Slack before 2026.8.1 Authorization Bypassopenclaw · slack · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Sep 26, 2026
28Monitor	CVE-2026-100532No exploit	openclaw WhatsApp before 2026.8.1 Authentication Bypassopenclaw · whatsapp · CWE-862 Auth bypass Broken access control (IDOR)	High7.2	—	0.2%	Sep 26, 2026
30Monitor	CVE-2026-100535No exploit	OpenClaw before 2026.8.1 Privilege Escalation via Session Memoryopenclaw · openclaw · CWE-863 Broken access control (IDOR)	High7.7	—	0.2%	Sep 26, 2026
28Monitor	CVE-2026-100536No exploit	OpenClaw before 2026.8.1 Path Traversal via Structured Attachmentsopenclaw · openclaw · CWE-22 Path traversal	High7.1	—	0.4%	Sep 26, 2026
28Monitor	CVE-2026-100538No exploit	OpenClaw before 2026.8.1 Local File Read via Outbound Attachmentsopenclaw · openclaw · CWE-863 Broken access control (IDOR)	High7.1	—	0.2%	Sep 26, 2026
30Monitor	CVE-2026-100540No exploit	OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Accountopenclaw · feishu · CWE-863 Auth bypass Broken access control (IDOR)	High7.6	—	0.2%	Sep 26, 2026
30Monitor	CVE-2026-100541No exploit	OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Foldingopenclaw · matrix · CWE-178	High7.7	—	0.3%	Sep 26, 2026
30Monitor	CVE-2026-100543No exploit	OpenClaw before 2026.8.1 Information Disclosure via Configuration Hashopenclaw · openclaw · CWE-200 Info leak	High7.7	—	0.3%	Sep 26, 2026
34Monitor	CVE-2026-100544No exploit	openclaw voice-call before 2026.8.1 Authorization Bypassopenclaw · voice-call · CWE-862 Broken access control (IDOR)	High8.7	—	0.2%	Sep 26, 2026
36Monitor	CVE-2026-100551No exploit	OpenClaw iOS Control UI TLS Pin Enforcement Bypassopenclaw · openclaw · CWE-295 Pre-auth Weak crypto	Critical9.0	—	0.1%	Sep 26, 2026
34Monitor	CVE-2026-100552No exploit	OpenClaw before 2026.8.1 Policy Bypass via Native Toolsopenclaw · openclaw · CWE-863 Broken access control (IDOR)	High8.7	—	0.2%	Sep 26, 2026
28Monitor	CVE-2026-16591No exploit	WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fieldsunknown · wp directory kit · CWE-79 XSS	High7.2	—	0.2%	Sep 26, 2026
40Plan	CVE-2026-18143Proof of concept	Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handleraddify · request a quote for woocommerce · CWE-434 Pre-auth File upload	Critical9.8	—	2.1%	Sep 26, 2026
28Monitor	CVE-2026-100555No exploit	OpenClaw before 2026.8.1 DNS Rebinding via attachment deliveryopenclaw · openclaw · CWE-918 SSRF	High7.1	—	0.1%	Sep 26, 2026
34Monitor	CVE-2026-100557No exploit	OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatchopenclaw · openclaw · CWE-863 Broken access control (IDOR)	High8.7	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100558No exploit	OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgradeopenclaw · openclaw · CWE-400 Pre-auth Denial of service	High8.7	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100559No exploit	OpenClaw before 2026.8.1 Command Injection via Escaped Newlinesopenclaw · openclaw · CWE-78 RCE Command injection	High8.6	—	0.2%	Sep 26, 2026
30Monitor	CVE-2026-100560No exploit	OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypassopenclaw · openclaw · CWE-863 Pre-auth Broken access control (IDOR)	High7.7	—	0.5%	Sep 26, 2026
34Monitor	CVE-2026-100561No exploit	OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapperopenclaw · openclaw · CWE-88 Auth bypass	High8.6	—	0.2%	Sep 26, 2026
35Monitor	CVE-2026-96524No exploit	MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRFunknown · mcp server for wordpress · CWE-352 Pre-auth CSRF	High8.8	—	0.1%	Sep 26, 2026
30Monitor	CVE-2026-96532No exploit	Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Updateunknown · testimonials widget · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	0.2%	Sep 26, 2026
35Monitor	CVE-2026-100567No exploit	OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostnameopenclaw · openclaw · CWE-918 Pre-auth SSRF	High8.9	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100568No exploit	OpenClaw before 2026.8.1 Unauthorized Command Job Accessopenclaw · openclaw · CWE-200 Info leak	High8.7	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100570No exploit	OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGSopenclaw · openclaw · CWE-88 RCE	High8.5	—	0.1%	Sep 26, 2026
32Monitor	CVE-2026-100574No exploit	OpenClaw before 2026.8.1 SSRF via Trusted-Host DNSopenclaw · openclaw · CWE-918 Pre-auth SSRF	High8.2	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100575No exploit	OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DMopenclaw · slack · CWE-862 Auth bypass Broken access control (IDOR)	High8.7	—	0.2%	Sep 26, 2026
28Monitor	CVE-2026-100578No exploit	OpenClaw before 2026.7.1 Authorization Bypass via chat.sendopenclaw · openclaw · CWE-269	High7.2	—	0.2%	Sep 26, 2026
28Monitor	CVE-2026-100579No exploit	OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requesteropenclaw · openclaw · CWE-639 Auth bypass Broken access control (IDOR)	High7.2	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100580No exploit	OpenClaw before 2026.7.1 Remote Code Execution via cron toolopenclaw · openclaw · CWE-178 RCE	High8.7	—	0.3%	Sep 26, 2026
28Monitor	CVE-2026-100582No exploit	OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypassopenclaw · msteams · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100585No exploit	OpenClaw before 2026.7.1 Authentication Bypass via MCP Channelopenclaw · openclaw · CWE-862 Auth bypass Broken access control (IDOR)	High8.6	—	0.1%	Sep 26, 2026
34Monitor	CVE-2026-100586No exploit	OpenClaw Codex before 2026.7.1 Authorization Bypass via Bindopenclaw · openclaw · CWE-269	High8.7	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100587No exploit	OpenClaw before 2026.7.1 Authorization Bypass via Codex Installopenclaw · openclaw · CWE-862 Broken access control (IDOR)	High8.7	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100588No exploit	OpenClaw before 2026.7.1 Authentication Bypass via node.invokeopenclaw · openclaw · CWE-863 Auth bypass Broken access control (IDOR)	High8.7	—	0.3%	Sep 26, 2026
34Monitor	CVE-2026-100589No exploit	OpenClaw before 2026.7.1 Sandbox Bypass via Browser Nodeopenclaw · openclaw · CWE-863 Broken access control (IDOR)	High8.7	—	0.3%	Sep 26, 2026
28Monitor	CVE-2026-100594No exploit	OpenClaw before 2026.7.1 Authorization Bypass via trajectory exportopenclaw · openclaw · CWE-200 Info leak	High7.1	—	0.2%	Sep 26, 2026
28Monitor	CVE-2026-100595No exploit	OpenClaw before 2026.7.1 Authorization Bypass via diagnosticsopenclaw · openclaw · CWE-200 Info leak	High7.1	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100596No exploit	OpenClaw before 2026.7.1 Authorization Bypass via MCP Configurationopenclaw · openclaw · CWE-862 Broken access control (IDOR)	High8.7	—	0.2%	Sep 26, 2026
35Monitor	CVE-2026-100597No exploit	OpenClaw before 2026.7.1 Path Traversal via Filesystem Raceopenclaw · openclaw · CWE-367 Path traversal Race condition	High8.8	—	0.0%	Sep 26, 2026
30Monitor	CVE-2026-100598No exploit	OpenClaw before 2026.7.1 Approval Binding Logic Erroropenclaw · openclaw · CWE-346	High7.5	—	0.1%	Sep 26, 2026
34Monitor	CVE-2026-100599No exploit	OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chromeopenclaw · openclaw · CWE-78 RCE Command injection	High8.7	—	0.3%	Sep 26, 2026
23Monitor	CVE-2026-19708No exploit	File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosureunknown · file manager · CWE-200 Pre-auth Info leak	Medium5.9	—	0.2%	Sep 26, 2026
32Monitor	CVE-2026-84095No exploit	WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Importunknown · wp-review-slider-pro · CWE-79 XSS	High8.0	—	0.2%	Sep 26, 2026
32Monitor	CVE-2026-84096No exploit	WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fieldsunknown · wp-review-slider-pro · CWE-79 XSS	High8.0	—	0.2%	Sep 26, 2026
30Monitor	CVE-2026-85081No exploit	Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypassunknown · file manager · CWE-79 Pre-auth XSS	High7.5	—	0.2%	Sep 26, 2026

CVE-2026-96874
9Monitor
Stored XSS in Cargo Drilldown tab names
LowCVSS 2.3Proof of conceptEPSS 0%
- XSS
the wikimedia foundation · mediawiki - cargo extensionSep 25, 2026
CVE-2026-100248
33Monitor
The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.
HighCVSS 8.4No exploitEPSS 0%
- Pre-auth
rattadan · cosmowarp contractSep 25, 2026
CVE-2026-67237
30Monitor
RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
broadcom · rabbitmq serverSep 25, 2026
CVE-2026-67239
30Monitor
RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- XSS
broadcom · rabbitmq serverSep 25, 2026
CVE-2026-67408
28Monitor
RabbitMQ: Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
broadcom · rabbitmq serverSep 25, 2026
CVE-2026-67409
32Monitor
RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
broadcom · rabbitmq serverSep 25, 2026
CVE-2026-67410
32Monitor
RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Info leak
broadcom · rabbitmq serverSep 25, 2026
CVE-2026-67419
28Monitor
RabbitMQ: Consecutive topic wildcards cause combinatorial routing work
HighCVSS 7.1No exploitEPSS 0%
broadcom · rabbitmq serverSep 25, 2026
CVE-2026-89032
34Monitor
BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
berriai · litellmSep 25, 2026
CVE-2026-91837
31Monitor
Networkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injection
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
gnome · networkmanager-iodineSep 25, 2026
CVE-2026-93365
28Monitor
Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
bludit · bludit cmsSep 25, 2026
CVE-2026-94445
35Monitor
Malicious user input may lead to RCE in golang.org/x/playground
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
golang.org/x/playground · golang.org/x/playgroundSep 25, 2026
CVE-2026-100419
29Monitor
gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink
HighCVSS 7.3No exploitEPSS 0%
gitoxidelabs · gitoxideSep 25, 2026
CVE-2026-56725
34Monitor
Zammad: Denial of Service via OTRS Import Controller
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
zammad · zammadSep 25, 2026
CVE-2026-91838
31Monitor
Networkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
gnome · networkmanager-sstpSep 25, 2026
CVE-2026-91839
31Monitor
Networkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
gnome · networkmanager-fortisslvpnSep 25, 2026
CVE-2026-91840
31Monitor
Networkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
gnome · networkmanager-vpncSep 25, 2026
CVE-2026-91841
31Monitor
Networkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
gnome · networkmanager-vpncSep 25, 2026
CVE-2026-88003
30Monitor
InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade
HighCVSS 7.5No exploitEPSS 0%
- Broken access control (IDOR)
invoiceplane · invoiceplaneSep 25, 2026
CVE-2026-57449
28Monitor
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
HighCVSS 7.1No exploitEPSS 0%
- Info leak
actualbudget · actualSep 25, 2026
CVE-2026-48482
37Monitor
GLPI: RCE via Form import
CriticalCVSS 9.4No exploitEPSS 0%
- RCE
- Path traversal
glpi-project · glpiSep 25, 2026
CVE-2026-53610
30Monitor
GLPI: Reflected XSS in dashboards
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
glpi-project · glpiSep 25, 2026
CVE-2026-53626
28Monitor
GLPI: Arbitrary Document Read via Form Context Authorization Bypass
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
glpi-project · glpiSep 25, 2026
CVE-2026-55214
34Monitor
GLPI: Stored XSS in suppliers
HighCVSS 8.5No exploitEPSS 0%
- XSS
glpi-project · glpiSep 25, 2026
CVE-2026-84465
28Monitor
Zammad: S/MIME signature verification allows forged sender impersonation
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
zammad · zammadSep 25, 2026
CVE-2026-97060
34Monitor
X-SpringBoot through 6.0 Authorization Bypass via User Management
HighCVSS 8.6No exploitEPSS 0%
- Broken access control (IDOR)
yzcheng90 · x-springbootSep 25, 2026
CVE-2026-97063
37Monitor
X-SpringBoot through 6.0 Authentication Bypass via Login Code
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
yzcheng90 · x-springbootSep 25, 2026
CVE-2026-97064
37Monitor
X-SpringBoot through 6.0 Authentication Bypass via Static Master Code
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Hard-coded credentials
yzcheng90 · x-springbootSep 25, 2026
CVE-2026-100208
32Monitor
Microsoft Office Outlook Remote Code Execution Vulnerability
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Memory safety
microsoft · 365 appsSep 25, 2026
CVE-2026-100310
29Monitor
GNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Local privilege escalation
gnu · libextractorSep 25, 2026
CVE-2026-100368
33Monitor
CliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappers
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Command injection
alastairlundy · cliinvoke.specializationsSep 25, 2026
CVE-2026-100372
34Monitor
ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Path traversal
macwarrior · clipbucket-v5Sep 25, 2026
CVE-2026-5267
30Monitor
Unauthenticated Event Stream Exposure of Session Tokens in Navigator NCS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
ciena · navigator ncsSep 25, 2026
CVE-2026-96875
27Monitor
Reflected XSS in Cargo Drilldown hierarchy filters
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- XSS
the wikimedia foundation · mediawiki - cargo extensionSep 25, 2026
CVE-2026-96876
27Monitor
Anonymous reflected XSS in CargoExport invalid-alias errors
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- XSS
the wikimedia foundation · mediawiki - cargo extensionSep 25, 2026
CVE-2026-96877
27Monitor
Reflected XSS through Cargo Drilldown full-text search
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- XSS
the wikimedia foundation · mediawiki - cargo extensionSep 25, 2026
CVE-2026-96878
27Monitor
Cargo Exhibit field alias allows stored XSS
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- XSS
the wikimedia foundation · mediawiki - cargo extensionSep 25, 2026
CVE-2026-100369
33Monitor
CliInvoke: Argument Injection in Extensibility Runner Factory
HighCVSS 8.4No exploitEPSS 0%
alastairlundy · cliinvokeSep 25, 2026
CVE-2026-100380
21Monitor
Reflected XSS in Wikibase Special:SetLabel language validation
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- XSS
wikimedia foundation · mediawiki - wikibase extensionSep 25, 2026
CVE-2026-100387
28Monitor
pgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
- Memory safety
pgpointcloud · pointcloudSep 25, 2026
CVE-2026-100389
36Monitor
GestSup before 3.2.62 Remote Code Execution via IMAP Attachment
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- File upload
gestsup · gestsupSep 25, 2026
CVE-2026-100390
36Monitor
Zoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv6
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
tobychui · zoraxySep 25, 2026
CVE-2026-100391
35Monitor
MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- SSRF
mhdzumair · mediaflow-proxySep 25, 2026
CVE-2026-10758
30Monitor
Esri Lerc has a security vulnerability
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
esri · lercSep 25, 2026
CVE-2026-57443
30Monitor
SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
issdandavis · scbe-aethermooreSep 25, 2026
CVE-2026-91765
30Monitor
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
php · phpSep 25, 2026
CVE-2026-100381
21Monitor
UploadWizard Flickr collection and set titles allow DOM XSS
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- XSS
wikimedia foundation · mediawiki - uploadwizard extensionSep 25, 2026
CVE-2026-100382
40Plan
Unauthenticated remote code execution through wikitext in ExternalData
CriticalCVSS 10.0Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
wikimedia foundation · mediawiki - externaldata extensionSep 25, 2026
CVE-2026-100501
33Monitor
Flame through 2.4.0 Brute-Force Attack via Login Endpoint
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
pawelmalak · flameSep 25, 2026
CVE-2026-71483
34Monitor
Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View
HighCVSS 8.5No exploitEPSS 0%
- Pre-auth
- XSS
horilla · horilla-hrSep 25, 2026
CVE-2026-96795
35Monitor
Horilla: Authenticated RCE in Horilla List-View Export
HighCVSS 8.8No exploitEPSS 0%
- RCE
horilla · horilla-hrSep 25, 2026
CVE-2026-100504
29Monitor
Ghidra through 12.1.4 Stack-based Buffer Overflow via leftshift128
HighCVSS 7.3No exploitEPSS 0%
- Memory safety
nsa · ghidraSep 26, 2026
CVE-2026-100520
34Monitor
Laranode before 1.2.1 Path Traversal in File Manager Upload Endpoint
HighCVSS 8.7Proof of conceptEPSS 1%
- Path traversal
crivion · laranodeSep 26, 2026
CVE-2026-100529
29Monitor
OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer
HighCVSS 7.4No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100530
34Monitor
OpenClaw before 2026.8.1 Exec Approval Directory Binding
HighCVSS 8.5No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100531
28Monitor
openclaw Slack before 2026.8.1 Authorization Bypass
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · slackSep 26, 2026
CVE-2026-100532
28Monitor
openclaw WhatsApp before 2026.8.1 Authentication Bypass
HighCVSS 7.2No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
openclaw · whatsappSep 26, 2026
CVE-2026-100535
30Monitor
OpenClaw before 2026.8.1 Privilege Escalation via Session Memory
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100536
28Monitor
OpenClaw before 2026.8.1 Path Traversal via Structured Attachments
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
openclaw · openclawSep 26, 2026
CVE-2026-100538
28Monitor
OpenClaw before 2026.8.1 Local File Read via Outbound Attachments
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100540
30Monitor
OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account
HighCVSS 7.6No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
openclaw · feishuSep 26, 2026
CVE-2026-100541
30Monitor
OpenClaw Matrix before 2026.8.1 Authorization Bypass via Case Folding
HighCVSS 7.7No exploitEPSS 0%
openclaw · matrixSep 26, 2026
CVE-2026-100543
30Monitor
OpenClaw before 2026.8.1 Information Disclosure via Configuration Hash
HighCVSS 7.7No exploitEPSS 0%
- Info leak
openclaw · openclawSep 26, 2026
CVE-2026-100544
34Monitor
openclaw voice-call before 2026.8.1 Authorization Bypass
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · voice-callSep 26, 2026
CVE-2026-100551
36Monitor
OpenClaw iOS Control UI TLS Pin Enforcement Bypass
CriticalCVSS 9.0No exploitEPSS 0%
- Pre-auth
- Weak crypto
openclaw · openclawSep 26, 2026
CVE-2026-100552
34Monitor
OpenClaw before 2026.8.1 Policy Bypass via Native Tools
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-16591
28Monitor
WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields
HighCVSS 7.2No exploitEPSS 0%
- XSS
unknown · wp directory kitSep 26, 2026
CVE-2026-18143
40Plan
Request a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler
CriticalCVSS 9.8Proof of conceptEPSS 2%
- Pre-auth
- File upload
addify · request a quote for woocommerceSep 26, 2026
CVE-2026-100555
28Monitor
OpenClaw before 2026.8.1 DNS Rebinding via attachment delivery
HighCVSS 7.1No exploitEPSS 0%
- SSRF
openclaw · openclawSep 26, 2026
CVE-2026-100557
34Monitor
OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100558
34Monitor
OpenClaw before 2026.8.1 Resource Exhaustion via WebSocket Upgrade
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
openclaw · openclawSep 26, 2026
CVE-2026-100559
34Monitor
OpenClaw before 2026.8.1 Command Injection via Escaped Newlines
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Command injection
openclaw · openclawSep 26, 2026
CVE-2026-100560
30Monitor
OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100561
34Monitor
OpenClaw before 2026.8.1 Authentication Bypass via Exec Wrapper
HighCVSS 8.6No exploitEPSS 0%
- Auth bypass
openclaw · openclawSep 26, 2026
CVE-2026-96524
35Monitor
MCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
unknown · mcp server for wordpressSep 26, 2026
CVE-2026-96532
30Monitor
Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
unknown · testimonials widgetSep 26, 2026
CVE-2026-100567
35Monitor
OpenClaw before 2026.8.1 DNS Rebinding via CDP Hostname
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- SSRF
openclaw · openclawSep 26, 2026
CVE-2026-100568
34Monitor
OpenClaw before 2026.8.1 Unauthorized Command Job Access
HighCVSS 8.7No exploitEPSS 0%
- Info leak
openclaw · openclawSep 26, 2026
CVE-2026-100570
34Monitor
OpenClaw before 2026.8.1 Remote Code Execution via CLOUDSDK_PYTHON_ARGS
HighCVSS 8.5No exploitEPSS 0%
- RCE
openclaw · openclawSep 26, 2026
CVE-2026-100574
32Monitor
OpenClaw before 2026.8.1 SSRF via Trusted-Host DNS
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- SSRF
openclaw · openclawSep 26, 2026
CVE-2026-100575
34Monitor
OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM
HighCVSS 8.7No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
openclaw · slackSep 26, 2026
CVE-2026-100578
28Monitor
OpenClaw before 2026.7.1 Authorization Bypass via chat.send
HighCVSS 7.2No exploitEPSS 0%
openclaw · openclawSep 26, 2026
CVE-2026-100579
28Monitor
OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester
HighCVSS 7.2No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100580
34Monitor
OpenClaw before 2026.7.1 Remote Code Execution via cron tool
HighCVSS 8.7No exploitEPSS 0%
- RCE
openclaw · openclawSep 26, 2026
CVE-2026-100582
28Monitor
OpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · msteamsSep 26, 2026
CVE-2026-100585
34Monitor
OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel
HighCVSS 8.6No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100586
34Monitor
OpenClaw Codex before 2026.7.1 Authorization Bypass via Bind
HighCVSS 8.7No exploitEPSS 0%
openclaw · openclawSep 26, 2026
CVE-2026-100587
34Monitor
OpenClaw before 2026.7.1 Authorization Bypass via Codex Install
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100588
34Monitor
OpenClaw before 2026.7.1 Authentication Bypass via node.invoke
HighCVSS 8.7No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100589
34Monitor
OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100594
28Monitor
OpenClaw before 2026.7.1 Authorization Bypass via trajectory export
HighCVSS 7.1No exploitEPSS 0%
- Info leak
openclaw · openclawSep 26, 2026
CVE-2026-100595
28Monitor
OpenClaw before 2026.7.1 Authorization Bypass via diagnostics
HighCVSS 7.1No exploitEPSS 0%
- Info leak
openclaw · openclawSep 26, 2026
CVE-2026-100596
34Monitor
OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · openclawSep 26, 2026
CVE-2026-100597
35Monitor
OpenClaw before 2026.7.1 Path Traversal via Filesystem Race
HighCVSS 8.8No exploitEPSS 0%
- Path traversal
- Race condition
openclaw · openclawSep 26, 2026
CVE-2026-100598
30Monitor
OpenClaw before 2026.7.1 Approval Binding Logic Error
HighCVSS 7.5No exploitEPSS 0%
openclaw · openclawSep 26, 2026
CVE-2026-100599
34Monitor
OpenClaw 2026.5.1 before 2026.7.1 Remote Code Execution via googlemeet.chrome
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Command injection
openclaw · openclawSep 26, 2026
CVE-2026-19708
23Monitor
File Manager 7.2.2 - 8.0.4 - Unauthenticated Database Backup Disclosure
MediumCVSS 5.9No exploitEPSS 0%
- Pre-auth
- Info leak
unknown · file managerSep 26, 2026
CVE-2026-84095
32Monitor
WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import
HighCVSS 8.0No exploitEPSS 0%
- XSS
unknown · wp-review-slider-proSep 26, 2026
CVE-2026-84096
32Monitor
WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields
HighCVSS 8.0No exploitEPSS 0%
- XSS
unknown · wp-review-slider-proSep 26, 2026
CVE-2026-85081
30Monitor
Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- XSS
unknown · file managerSep 26, 2026