By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 71 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2026-97163Proof of concept	Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29lomart · up · CWE-22 Pre-auth Path traversal	Critical10.0	—	0.4%	Sep 26, 2026
29Monitor	CVE-2026-72668No exploit	Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalationelastic · kibana · CWE-441	High7.3	—	0.2%	Sep 26, 2026
34Monitor	CVE-2026-100740Proof of concept	D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds writed-link · dir-895l · CWE-119 Memory safety	High8.6	—	0.6%	Sep 26, 2026
35Monitor	CVE-2026-100722No exploit	vm2 before 3.12.2 Host Process Termination via Construct Trappatriksimek · vm2 · CWE-248 Pre-auth	High8.9	—	0.3%	Sep 26, 2026
34Monitor	CVE-2025-71423No exploit	Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosureedgelesssys · contrast · CWE-532 Info leak	High8.5	—	0.2%	Sep 27, 2026
34Monitor	CVE-2025-71425No exploit	Contrast before 1.8.1 Information Disclosure via Loggingedgelesssys · contrast · CWE-532 Info leak	High8.5	—	0.1%	Sep 27, 2026
28Monitor	CVE-2025-71426No exploit	Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recoveryedgelesssys · contrast · CWE-285 Pre-auth Broken access control (IDOR)	High7.1	—	0.1%	Sep 27, 2026
38Monitor	CVE-2026-100721Proof of concept	vm2 before 3.12.2 Authorization Bypass via Custom Resolverpatriksimek · vm2 · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.5	—	0.5%	Sep 27, 2026
33Monitor	CVE-2026-100725No exploit	http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStoragehttp4k · http4k · CWE-200 Pre-auth Info leak	High8.3	—	0.2%	Sep 27, 2026
34Monitor	CVE-2026-100833Proof of concept	Contrast before 1.23.1 Image Substitution via Policy Generationedgelesssys · contrast · CWE-20	High8.6	—	0.2%	Sep 27, 2026
32Monitor	CVE-2026-100834No exploit	http4k before 6.48.0.0 Digest Authentication Replay Protection Bypasshttp4k · http4k · CWE-294 Pre-auth Auth bypass	High8.2	—	0.3%	Sep 27, 2026
36Monitor	CVE-2026-100835Proof of concept	Contrast before 1.16.0 Remote Attestation Relay Attackedgelesssys · contrast · CWE-295 Pre-auth Weak crypto	Critical9.1	—	0.2%	Sep 27, 2026
25Monitor	CVE-2026-100837No exploit	Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matchingedgelesssys · contrast · CWE-1289 Pre-auth	Medium6.3	—	0.2%	Sep 27, 2026
34Monitor	CVE-2026-100838No exploit	Contrast before 1.19.1 CopyFile Policy Symlink Subversionedgelesssys · contrast · CWE-59 Pre-auth	High8.6	—	0.2%	Sep 27, 2026
33Monitor	CVE-2026-100839No exploit	Contrast before 1.18.0 AML Injection Remote Code Executionedgelesssys · contrast · CWE-94 RCE	High8.4	—	0.1%	Sep 27, 2026
34Monitor	CVE-2026-100840No exploit	MONAI through 1.6.0 Remote Code Execution via bundle configurationproject-monai · monai · CWE-95 RCE	High8.5	—	0.3%	Sep 27, 2026
34Monitor	CVE-2026-100841No exploit	MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cacheproject-monai · monai · CWE-502 RCE Deserialization	High8.5	—	0.1%	Sep 27, 2026
29Monitor	CVE-2026-100842No exploit	MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chainsproject-monai · monai · CWE-95 RCE	High7.3	—	0.1%	Sep 27, 2026
28Monitor	CVE-2026-96896No exploit	Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_requestunknown · malcure malware shield — removal, repair, monitor · CWE-862 RCE Broken access control (IDOR)	High7.2	—	0.3%	Sep 27, 2026
34Monitor	CVE-2026-100843No exploit	MONAI before 1.6.0 Remote Code Execution via algo_from_pickleproject-monai · monai · CWE-502 RCE Deserialization	High8.5	—	0.3%	Sep 27, 2026
34Monitor	CVE-2026-100844No exploit	MONAI before 1.6.0 OS Command Injection via dataset_name_or_idproject-monai · monai · CWE-78 RCE Local privilege escalation Command injection	High8.6	—	0.9%	Sep 27, 2026
34Monitor	CVE-2026-100845No exploit	MONAI before 1.6.0 Remote Code Execution via NumpyReaderproject-monai · monai · CWE-502 RCE Deserialization	High8.5	—	0.2%	Sep 27, 2026
35Monitor	CVE-2026-100846No exploit	MONAI before 1.5.2 Remote Code Execution via Pickle Deserializationproject-monai · monai · CWE-502 RCE Deserialization	High8.8	—	0.3%	Sep 27, 2026
34Monitor	CVE-2026-100847No exploit	AzuraCast before 0.23.8 DQL Injection via sortOrderazuracast · azuracast · CWE-89 Pre-auth SQL injection	High8.7	—	0.3%	Sep 27, 2026
28Monitor	CVE-2026-100848No exploit	AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URLazuracast · azuracast · CWE-918 SSRF	High7.1	—	0.2%	Sep 27, 2026
28Monitor	CVE-2026-100849No exploit	AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPsazuracast · azuracast · CWE-918 SSRF	High7.1	—	0.2%	Sep 27, 2026
28Monitor	CVE-2026-100851No exploit	AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profileazuracast · azuracast · CWE-200 Broken access control (IDOR) Info leak	High7.2	—	0.2%	Sep 27, 2026
35Monitor	CVE-2026-100852No exploit	AzuraCast before 0.23.8 Command Injection via Streamer Usernameazuracast · azuracast · CWE-78 RCE Command injection	High8.7	—	4.6%	Sep 27, 2026
32Monitor	CVE-2026-100853No exploit	AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypassazuracast · azuracast · CWE-862 Pre-auth Broken access control (IDOR)	High8.2	—	0.3%	Sep 27, 2026
28Monitor	CVE-2026-100855No exploit	AzuraCast before 0.23.6 Missing Permission Check via /playazuracast · azuracast · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Sep 27, 2026
34Monitor	CVE-2026-100856No exploit	AzuraCast before 0.23.6 Code Injection via Remote Relay Passwordazuracast · azuracast · CWE-94 RCE	High8.7	—	0.4%	Sep 27, 2026
34Monitor	CVE-2026-100857No exploit	AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolationazuracast · azuracast · CWE-94 RCE	High8.6	—	0.4%	Sep 27, 2026
30Monitor	CVE-2026-100858No exploit	heym before 0.0.109 Server-Side Request Forgery via Workflow Nodesheymrun · heym · CWE-918 SSRF	High7.6	—	0.3%	Sep 27, 2026
28Monitor	CVE-2026-100859No exploit	Heym before 0.0.106 Credential Exfiltration via URL Overrideheymrun · heym · CWE-918 SSRF	High7.1	—	0.2%	Sep 27, 2026
34Monitor	CVE-2026-100864No exploit	heym before 0.0.91 Remote Code Execution via Expression Engineheymrun · heym · CWE-94 RCE	High8.7	—	0.8%	Sep 27, 2026
34Monitor	CVE-2026-100865No exploit	Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escapeheymrun · heym · CWE-94 RCE	High8.7	—	0.3%	Sep 27, 2026
30Monitor	CVE-2026-81655No exploit	Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fieldsunknown · ad inserter · CWE-94 RCE XSS	High7.5	—	0.2%	Sep 27, 2026
35Monitor	CVE-2026-86609No exploit	Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscriptionunknown · download manager · CWE-79 Pre-auth XSS	High8.8	—	0.2%	Sep 27, 2026
40Plan	CVE-2026-100741No exploit	Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServerprogressive robot ltd · hmailserver · CWE-95 pre-auth RCE	Critical9.8	—	1.7%	Sep 27, 2026
33Monitor	CVE-2026-89102No exploit	OCSP stapling v2 multi accepts non-CA chain certificates as issuerswolfssl · wolfssl · CWE-295 Pre-auth Weak crypto	High8.3	—	0.1%	Sep 27, 2026
33Monitor	CVE-2026-89136No exploit	Client accepts unsolicited RawPublicKey server certificate typewolfssl · wolfssl · CWE-287 Pre-auth Auth bypass	High8.3	—	0.3%	Sep 27, 2026
33Monitor	CVE-2026-93302No exploit	Trusted peer certificate match ignores public key, allowing forged CA cloneswolfssl · wolfssl · CWE-295 Pre-auth Auth bypass Weak crypto	High8.3	—	0.2%	Sep 27, 2026
28Monitor	CVE-2026-97164No exploit	Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0svenbluege · event gallery · CWE-22 Path traversal	High7.0	—	0.3%	Sep 27, 2026
21Monitor	CVE-2026-100868No exploit	Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridgepenpot · penpot · CWE-1327 Pre-auth Auth bypass	Medium5.3	—	0.5%	Sep 27, 2026
32Monitor	CVE-2026-100869No exploit	Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop APIsylius · sylius · CWE-863 Pre-auth Broken access control (IDOR)	High8.2	—	0.2%	Sep 27, 2026
34Monitor	CVE-2026-100870No exploit	Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Headersylius · sylius · CWE-640 Pre-auth	High8.7	—	0.3%	Sep 27, 2026
34Monitor	CVE-2026-100871No exploit	Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authenticationsylius · sylius · CWE-287 Auth bypass	High8.7	—	0.3%	Sep 27, 2026
34Monitor	CVE-2026-100872No exploit	Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwritesylius · sylius · CWE-345 Pre-auth	High8.7	—	0.2%	Sep 27, 2026
91Now	CVE-2026-88772Weaponized	Memory overflow vulnerability leading to Remote Code Execution or Denial of Servicecitrix · netscaler application delivery controller · CWE-119 pre-auth RCE Memory safety	Critical9.5	KEV	76.5%	Sep 27, 2026
29Monitor	CVE-2026-101032No exploit	navi through 2.24.0 OS Command Injection via Cheatsheet Variablesdenisidoro · navi · CWE-78 RCE Local privilege escalation Command injection	High7.3	—	0.1%	Sep 27, 2026
29Monitor	CVE-2026-101042No exploit	Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identityparse-community · parse-server · CWE-287 Auth bypass	High7.4	—	0.2%	Sep 27, 2026
33Monitor	CVE-2026-101049No exploit	Heym before 0.0.53 Slack Webhook Signature Verification Bypassheymrun · heym · CWE-287 Pre-auth Auth bypass	High8.3	—	0.3%	Sep 27, 2026
33Monitor	CVE-2026-101050No exploit	Heym before 0.0.53 Authentication Bypass via Telegram Webhookheymrun · heym · CWE-287 Pre-auth Auth bypass	High8.3	—	0.3%	Sep 27, 2026
93Now	CVE-2026-88771Weaponized	A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commandscitrix · netscaler application delivery controller · CWE-20 pre-auth RCE	Critical9.5	KEV	81.8%	Sep 27, 2026
60This week	CVE-2026-88773Weaponized	HTTP Request Smugglingcitrix · netscaler application delivery controller · CWE-444 Pre-auth	Critical9.3	—	3.0%	Sep 27, 2026
28Monitor	CVE-2026-88774Proof of concept	Feature policy bypass due to improper HTTP URL based expression usagecitrix · netscaler application delivery controller · CWE-20 Pre-auth	High7.0	—	0.3%	Sep 27, 2026
35Monitor	CVE-2026-88775Proof of concept	Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Servicecitrix · netscaler application delivery controller · CWE-120 Pre-auth Memory safety	High8.8	—	0.7%	Sep 27, 2026
35Monitor	CVE-2026-88776Proof of concept	Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Servicecitrix · netscaler application delivery controller · CWE-119 Pre-auth Memory safety	High8.8	—	0.8%	Sep 27, 2026
35Monitor	CVE-2026-88777Proof of concept	Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Servicecitrix · netscaler application delivery controller · CWE-119 Pre-auth Memory safety	High8.8	—	0.7%	Sep 27, 2026
35Monitor	CVE-2026-88778Proof of concept	TCP Initial Sequence Number (ISN) predictioncitrix · netscaler application delivery controller · CWE-342 Pre-auth	High8.8	—	0.6%	Sep 27, 2026
33Monitor	CVE-2026-101043No exploit	pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settingspnpm · pnpm · CWE-201 Pre-auth	High8.3	—	0.2%	Sep 27, 2026
28Monitor	CVE-2026-101044No exploit	pacquet before 12.0.0-alpha.5 Path Traversal via lockfile aliaspnpm · pnpm · CWE-22 Pre-auth Path traversal	High7.1	—	0.2%	Sep 27, 2026
35Monitor	CVE-2026-101045No exploit	Fleet Homebrew Cask OS Command Injection via Metadatafleetdm · fleet · CWE-78 RCE Command injection	High8.9	—	0.7%	Sep 27, 2026
21Monitor	CVE-2026-101048No exploit	Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scopecloudreve · cloudreve · CWE-863 SSRF Broken access control (IDOR)	Medium5.3	—	0.2%	Sep 27, 2026
28Monitor	CVE-2026-101058No exploit	python-utcp before 1.1.12 SSRF via Remote HTTP Manualuniversal-tool-calling-protocol · python-utcp · CWE-918 Pre-auth SSRF	High7.1	—	0.1%	Sep 27, 2026
28Monitor	CVE-2026-101059No exploit	utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypassuniversal-tool-calling-protocol · python-utcp · CWE-918 Pre-auth SSRF	High7.1	—	0.2%	Sep 27, 2026
33Monitor	CVE-2026-101060No exploit	python-utcp before 1.1.4 SSRF via unvalidated HTTP redirectsuniversal-tool-calling-protocol · python-utcp · CWE-918 Pre-auth SSRF	High8.4	—	0.2%	Sep 27, 2026
34Monitor	CVE-2026-101062No exploit	Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registrationobot-platform · obot · CWE-863 Pre-auth Auth bypass Broken access control (IDOR)	High8.7	—	0.3%	Sep 27, 2026
33Monitor	CVE-2026-101064No exploit	Obot before v0.23.0 Server-Side Request Forgery via MCPobot-platform · obot · CWE-918 SSRF	High8.3	—	0.2%	Sep 27, 2026
37Monitor	CVE-2026-101065No exploit	Obot Quickstart Docker Deployment Unauthenticated Admin Accessobot-platform · obot · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.4%	Sep 27, 2026
37Monitor	CVE-2026-101084No exploit	obot before v0.21.1 Authorization Bypass via /mcp-connectobot-platform · obot · CWE-639 Broken access control (IDOR)	Critical9.3	—	0.3%	Sep 27, 2026
28Monitor	CVE-2026-101085No exploit	Nezha before 2.3.8 Denial of Service via Alert Rulenezhahq · nezha · CWE-197	High7.1	—	0.3%	Sep 27, 2026
28Monitor	CVE-2026-101086No exploit	Nezha Dashboard before 2.3.5 Task Type Validation Bypassnezhahq · nezha · CWE-269 RCE	High7.1	—	0.3%	Sep 27, 2026
37Monitor	CVE-2026-101090No exploit	Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_urinezhahq · nezha · CWE-601 Pre-auth Open redirect	Critical9.3	—	0.4%	Sep 27, 2026
30Monitor	CVE-2026-96280No exploit	Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systemsred hat · red hat enterprise linux 10 · CWE-197 Pre-auth	High7.5	—	0.6%	Sep 27, 2026
35Monitor	CVE-2026-100896No exploit	TOTOLINK N150RT Web Management formWlSiteSurvey system os command injectiontotolink · n150rt · CWE-77 RCE Command injection	High8.6	—	1.8%	Sep 27, 2026
22Monitor	CVE-2026-100885Proof of concept	Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorizationkrayin · laravel-crm · CWE-285 Pre-auth Broken access control (IDOR)	Medium5.5	—	1.4%	Sep 27, 2026
37Monitor	CVE-2026-100886Proof of concept	Seetong T8108/T8108P/T8116/T8232 Debug Service improper authenticationseetong · t8108 · CWE-287 Pre-auth Auth bypass	Critical9.3	—	1.1%	Sep 27, 2026
30Monitor	CVE-2026-100908No exploit	Eyeplus p2pcam HTTP stack-based overflowCWE-119 Pre-auth Memory safety	High7.7	—	0.4%	Sep 28, 2026
38Monitor	CVE-2026-101001No exploit	Netcore NBR200V2 Web Management network_tools eval os command injectionnetcore · nbr200v2 · CWE-77 pre-auth RCE Command injection	Critical9.3	—	2.6%	Sep 28, 2026
35Monitor	CVE-2026-101002No exploit	Netcore NBR200V2 Tools Ping network_tools system os command injectionnetcore · nbr200v2 · CWE-77 RCE Command injection	High8.6	—	1.6%	Sep 28, 2026
35Monitor	CVE-2026-101007No exploit	aaPanel BaoTa Database Backup database.py InputSql os command injectionaapanel · baota · CWE-77 RCE Command injection	High8.5	—	2.1%	Sep 28, 2026
35Monitor	CVE-2026-101008No exploit	aaPanel BaoTa File Merge files.py merge_split_file command injectionaapanel · baota · CWE-74 RCE Command injection	High8.5	—	2.3%	Sep 28, 2026
29Monitor	CVE-2026-82375No exploit	Apache Roller: Server-side request forgery via entry trackback and enclosure URLsapache software foundation · apache roller · CWE-918 SSRF	High7.4	—	0.2%	Sep 28, 2026
32Monitor	CVE-2026-82380No exploit	Apache Roller: CSRF protection bypass via self-generated salt validationapache software foundation · apache roller · CWE-352 Pre-auth CSRF	High8.1	—	0.2%	Sep 28, 2026
32Monitor	CVE-2026-82383No exploit	Apache Roller: Anonymous setup action allows frontpage configuration tamperingapache software foundation · apache roller · CWE-306 Pre-auth Auth bypass	High8.2	—	0.4%	Sep 28, 2026
22Monitor	CVE-2026-100903Proof of concept	ООО НПО Ритм GEOritm REST API obj-groups missing authenticationооо нпо ритм · georitm · CWE-287 Pre-auth Auth bypass	Medium5.5	—	0.5%	Sep 28, 2026
37Monitor	CVE-2026-101000No exploit	Netcore NBR100V2 ACL unauthenticated.json uci.apply authorizationnetcore · nbr100v2 · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.3	—	0.5%	Sep 28, 2026
35Monitor	CVE-2026-85134No exploit	Arbitrary File Upload Leading to Remote Command Execution in Bimser's eBA Plusbimser solution software trade inc. · eba plus document and workflow management system · CWE-434 RCE File upload	High8.8	—	0.2%	Sep 28, 2026
34Monitor	CVE-2026-101038No exploit	FAST FAC1200R MmtAtePrase stack-based overflowfast · fac1200r · CWE-119 Memory safety	High8.6	—	0.4%	Sep 28, 2026
37Monitor	CVE-2026-101039No exploit	FAST FAC1900R devdiscover Service copy_msg_element stack-based overflowfast · fac1900r · CWE-119 Pre-auth Memory safety	Critical9.3	—	0.7%	Sep 28, 2026
34Monitor	CVE-2026-100750No exploit	Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomlaregularlabs · modules anywhere · CWE-918 SSRF	High8.5	—	0.1%	Sep 28, 2026
30Monitor	CVE-2026-100751No exploit	Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0regularlabs · tabs & accordions · CWE-79 XSS	High7.5	—	0.1%	Sep 28, 2026
35Monitor	CVE-2026-101009No exploit	aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injectionaapanel · baota · CWE-77 RCE Command injection	High8.5	—	1.7%	Sep 28, 2026
30Monitor	CVE-2026-82348No exploit	Apache Roller: Cross-weblog resource tampering via unscoped authoring lookupsapache software foundation · apache roller · CWE-639 Broken access control (IDOR)	High7.7	—	0.3%	Sep 28, 2026
30Monitor	CVE-2026-82376No exploit	Apache Roller: XML external entity processing in trackback response parserapache software foundation · apache roller · CWE-611 XXE	High7.7	—	0.2%	Sep 28, 2026
39Monitor	CVE-2026-82377No exploit	Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlersapache software foundation · apache roller · CWE-862 Broken access control (IDOR)	Critical9.9	—	0.4%	Sep 28, 2026
36Monitor	CVE-2026-82378No exploit	Apache Roller: OAuth authorization endpoint trusts request-supplied identityapache software foundation · apache roller · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.0	—	0.4%	Sep 28, 2026
30Monitor	CVE-2026-82379No exploit	Apache Roller: WSSE digest authentication headers can be replayedapache software foundation · apache roller · CWE-294 Pre-auth Auth bypass	High7.7	—	0.3%	Sep 28, 2026
39Monitor	CVE-2026-82384Proof of concept	Apache Roller: Unauthenticated deserialization in the XML-RPC endpointapache software foundation · apache roller · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	0.9%	Sep 28, 2026

CVE-2026-97163
40Plan
Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29
CriticalCVSS 10.0Proof of conceptEPSS 0%
- Pre-auth
- Path traversal
lomart · upSep 26, 2026
CVE-2026-72668
29Monitor
Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation
HighCVSS 7.3No exploitEPSS 0%
elastic · kibanaSep 26, 2026
CVE-2026-100740
34Monitor
D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write
HighCVSS 8.6Proof of conceptEPSS 0%
- Memory safety
d-link · dir-895lSep 26, 2026
CVE-2026-100722
35Monitor
vm2 before 3.12.2 Host Process Termination via Construct Trap
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
patriksimek · vm2Sep 26, 2026
CVE-2025-71423
34Monitor
Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure
HighCVSS 8.5No exploitEPSS 0%
- Info leak
edgelesssys · contrastSep 27, 2026
CVE-2025-71425
34Monitor
Contrast before 1.8.1 Information Disclosure via Logging
HighCVSS 8.5No exploitEPSS 0%
- Info leak
edgelesssys · contrastSep 27, 2026
CVE-2025-71426
28Monitor
Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recovery
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
edgelesssys · contrastSep 27, 2026
CVE-2026-100721
38Monitor
vm2 before 3.12.2 Authorization Bypass via Custom Resolver
CriticalCVSS 9.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
patriksimek · vm2Sep 27, 2026
CVE-2026-100725
33Monitor
http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Info leak
http4k · http4kSep 27, 2026
CVE-2026-100833
34Monitor
Contrast before 1.23.1 Image Substitution via Policy Generation
HighCVSS 8.6Proof of conceptEPSS 0%
edgelesssys · contrastSep 27, 2026
CVE-2026-100834
32Monitor
http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
http4k · http4kSep 27, 2026
CVE-2026-100835
36Monitor
Contrast before 1.16.0 Remote Attestation Relay Attack
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
edgelesssys · contrastSep 27, 2026
CVE-2026-100837
25Monitor
Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching
MediumCVSS 6.3No exploitEPSS 0%
- Pre-auth
edgelesssys · contrastSep 27, 2026
CVE-2026-100838
34Monitor
Contrast before 1.19.1 CopyFile Policy Symlink Subversion
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
edgelesssys · contrastSep 27, 2026
CVE-2026-100839
33Monitor
Contrast before 1.18.0 AML Injection Remote Code Execution
HighCVSS 8.4No exploitEPSS 0%
- RCE
edgelesssys · contrastSep 27, 2026
CVE-2026-100840
34Monitor
MONAI through 1.6.0 Remote Code Execution via bundle configuration
HighCVSS 8.5No exploitEPSS 0%
- RCE
project-monai · monaiSep 27, 2026
CVE-2026-100841
34Monitor
MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Deserialization
project-monai · monaiSep 27, 2026
CVE-2026-100842
29Monitor
MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains
HighCVSS 7.3No exploitEPSS 0%
- RCE
project-monai · monaiSep 27, 2026
CVE-2026-96896
28Monitor
Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
unknown · malcure malware shield — removal, repair, monitorSep 27, 2026
CVE-2026-100843
34Monitor
MONAI before 1.6.0 Remote Code Execution via algo_from_pickle
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Deserialization
project-monai · monaiSep 27, 2026
CVE-2026-100844
34Monitor
MONAI before 1.6.0 OS Command Injection via dataset_name_or_id
HighCVSS 8.6No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
project-monai · monaiSep 27, 2026
CVE-2026-100845
34Monitor
MONAI before 1.6.0 Remote Code Execution via NumpyReader
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Deserialization
project-monai · monaiSep 27, 2026
CVE-2026-100846
35Monitor
MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Deserialization
project-monai · monaiSep 27, 2026
CVE-2026-100847
34Monitor
AzuraCast before 0.23.8 DQL Injection via sortOrder
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SQL injection
azuracast · azuracastSep 27, 2026
CVE-2026-100848
28Monitor
AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL
HighCVSS 7.1No exploitEPSS 0%
- SSRF
azuracast · azuracastSep 27, 2026
CVE-2026-100849
28Monitor
AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs
HighCVSS 7.1No exploitEPSS 0%
- SSRF
azuracast · azuracastSep 27, 2026
CVE-2026-100851
28Monitor
AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile
HighCVSS 7.2No exploitEPSS 0%
- Broken access control (IDOR)
- Info leak
azuracast · azuracastSep 27, 2026
CVE-2026-100852
35Monitor
AzuraCast before 0.23.8 Command Injection via Streamer Username
HighCVSS 8.7No exploitEPSS 4%
- RCE
- Command injection
azuracast · azuracastSep 27, 2026
CVE-2026-100853
32Monitor
AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
azuracast · azuracastSep 27, 2026
CVE-2026-100855
28Monitor
AzuraCast before 0.23.6 Missing Permission Check via /play
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
azuracast · azuracastSep 27, 2026
CVE-2026-100856
34Monitor
AzuraCast before 0.23.6 Code Injection via Remote Relay Password
HighCVSS 8.7No exploitEPSS 0%
- RCE
azuracast · azuracastSep 27, 2026
CVE-2026-100857
34Monitor
AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation
HighCVSS 8.6No exploitEPSS 0%
- RCE
azuracast · azuracastSep 27, 2026
CVE-2026-100858
30Monitor
heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes
HighCVSS 7.6No exploitEPSS 0%
- SSRF
heymrun · heymSep 27, 2026
CVE-2026-100859
28Monitor
Heym before 0.0.106 Credential Exfiltration via URL Override
HighCVSS 7.1No exploitEPSS 0%
- SSRF
heymrun · heymSep 27, 2026
CVE-2026-100864
34Monitor
heym before 0.0.91 Remote Code Execution via Expression Engine
HighCVSS 8.7No exploitEPSS 0%
- RCE
heymrun · heymSep 27, 2026
CVE-2026-100865
34Monitor
Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escape
HighCVSS 8.7No exploitEPSS 0%
- RCE
heymrun · heymSep 27, 2026
CVE-2026-81655
30Monitor
Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields
HighCVSS 7.5No exploitEPSS 0%
- RCE
- XSS
unknown · ad inserterSep 27, 2026
CVE-2026-86609
35Monitor
Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- XSS
unknown · download managerSep 27, 2026
CVE-2026-100741
40Plan
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
progressive robot ltd · hmailserverSep 27, 2026
CVE-2026-89102
33Monitor
OCSP stapling v2 multi accepts non-CA chain certificates as issuers
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Weak crypto
wolfssl · wolfsslSep 27, 2026
CVE-2026-89136
33Monitor
Client accepts unsolicited RawPublicKey server certificate type
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
wolfssl · wolfsslSep 27, 2026
CVE-2026-93302
33Monitor
Trusted peer certificate match ignores public key, allowing forged CA clones
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Weak crypto
wolfssl · wolfsslSep 27, 2026
CVE-2026-97164
28Monitor
Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0
HighCVSS 7.0No exploitEPSS 0%
- Path traversal
svenbluege · event gallerySep 27, 2026
CVE-2026-100868
21Monitor
Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge
MediumCVSS 5.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
penpot · penpotSep 27, 2026
CVE-2026-100869
32Monitor
Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
sylius · syliusSep 27, 2026
CVE-2026-100870
34Monitor
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
sylius · syliusSep 27, 2026
CVE-2026-100871
34Monitor
Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication
HighCVSS 8.7No exploitEPSS 0%
- Auth bypass
sylius · syliusSep 27, 2026
CVE-2026-100872
34Monitor
Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
sylius · syliusSep 27, 2026
CVE-2026-88772
91Now
Memory overflow vulnerability leading to Remote Code Execution or Denial of Service
CriticalCVSS 9.5KEVWeaponizedEPSS 76%
- pre-auth RCE
- Memory safety
citrix · netscaler application delivery controllerSep 27, 2026
CVE-2026-101032
29Monitor
navi through 2.24.0 OS Command Injection via Cheatsheet Variables
HighCVSS 7.3No exploitEPSS 0%
- RCE
- Local privilege escalation
- Command injection
denisidoro · naviSep 27, 2026
CVE-2026-101042
29Monitor
Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity
HighCVSS 7.4No exploitEPSS 0%
- Auth bypass
parse-community · parse-serverSep 27, 2026
CVE-2026-101049
33Monitor
Heym before 0.0.53 Slack Webhook Signature Verification Bypass
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
heymrun · heymSep 27, 2026
CVE-2026-101050
33Monitor
Heym before 0.0.53 Authentication Bypass via Telegram Webhook
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
heymrun · heymSep 27, 2026
CVE-2026-88771
93Now
A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands
CriticalCVSS 9.5KEVWeaponizedEPSS 81%
- pre-auth RCE
citrix · netscaler application delivery controllerSep 27, 2026
CVE-2026-88773
60This week
HTTP Request Smuggling
CriticalCVSS 9.3WeaponizedEPSS 3%
- Pre-auth
citrix · netscaler application delivery controllerSep 27, 2026
CVE-2026-88774
28Monitor
Feature policy bypass due to improper HTTP URL based expression usage
HighCVSS 7.0Proof of conceptEPSS 0%
- Pre-auth
citrix · netscaler application delivery controllerSep 27, 2026
CVE-2026-88775
35Monitor
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
citrix · netscaler application delivery controllerSep 27, 2026
CVE-2026-88776
35Monitor
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
citrix · netscaler application delivery controllerSep 27, 2026
CVE-2026-88777
35Monitor
Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
citrix · netscaler application delivery controllerSep 27, 2026
CVE-2026-88778
35Monitor
TCP Initial Sequence Number (ISN) prediction
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
citrix · netscaler application delivery controllerSep 27, 2026
CVE-2026-101043
33Monitor
pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
pnpm · pnpmSep 27, 2026
CVE-2026-101044
28Monitor
pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
pnpm · pnpmSep 27, 2026
CVE-2026-101045
35Monitor
Fleet Homebrew Cask OS Command Injection via Metadata
HighCVSS 8.9No exploitEPSS 0%
- RCE
- Command injection
fleetdm · fleetSep 27, 2026
CVE-2026-101048
21Monitor
Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scope
MediumCVSS 5.3No exploitEPSS 0%
- SSRF
- Broken access control (IDOR)
cloudreve · cloudreveSep 27, 2026
CVE-2026-101058
28Monitor
python-utcp before 1.1.12 SSRF via Remote HTTP Manual
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- SSRF
universal-tool-calling-protocol · python-utcpSep 27, 2026
CVE-2026-101059
28Monitor
utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- SSRF
universal-tool-calling-protocol · python-utcpSep 27, 2026
CVE-2026-101060
33Monitor
python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects
HighCVSS 8.4No exploitEPSS 0%
- Pre-auth
- SSRF
universal-tool-calling-protocol · python-utcpSep 27, 2026
CVE-2026-101062
34Monitor
Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
obot-platform · obotSep 27, 2026
CVE-2026-101064
33Monitor
Obot before v0.23.0 Server-Side Request Forgery via MCP
HighCVSS 8.3No exploitEPSS 0%
- SSRF
obot-platform · obotSep 27, 2026
CVE-2026-101065
37Monitor
Obot Quickstart Docker Deployment Unauthenticated Admin Access
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
obot-platform · obotSep 27, 2026
CVE-2026-101084
37Monitor
obot before v0.21.1 Authorization Bypass via /mcp-connect
CriticalCVSS 9.3No exploitEPSS 0%
- Broken access control (IDOR)
obot-platform · obotSep 27, 2026
CVE-2026-101085
28Monitor
Nezha before 2.3.8 Denial of Service via Alert Rule
HighCVSS 7.1No exploitEPSS 0%
nezhahq · nezhaSep 27, 2026
CVE-2026-101086
28Monitor
Nezha Dashboard before 2.3.5 Task Type Validation Bypass
HighCVSS 7.1No exploitEPSS 0%
- RCE
nezhahq · nezhaSep 27, 2026
CVE-2026-101090
37Monitor
Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Open redirect
nezhahq · nezhaSep 27, 2026
CVE-2026-96280
30Monitor
Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
red hat · red hat enterprise linux 10Sep 27, 2026
CVE-2026-100896
35Monitor
TOTOLINK N150RT Web Management formWlSiteSurvey system os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
totolink · n150rtSep 27, 2026
CVE-2026-100885
22Monitor
Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization
MediumCVSS 5.5Proof of conceptEPSS 1%
- Pre-auth
- Broken access control (IDOR)
krayin · laravel-crmSep 27, 2026
CVE-2026-100886
37Monitor
Seetong T8108/T8108P/T8116/T8232 Debug Service improper authentication
CriticalCVSS 9.3Proof of conceptEPSS 1%
- Pre-auth
- Auth bypass
seetong · t8108Sep 27, 2026
CVE-2026-100908
30Monitor
Eyeplus p2pcam HTTP stack-based overflow
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Memory safety
Sep 28, 2026
CVE-2026-101001
38Monitor
Netcore NBR200V2 Web Management network_tools eval os command injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
netcore · nbr200v2Sep 28, 2026
CVE-2026-101002
35Monitor
Netcore NBR200V2 Tools Ping network_tools system os command injection
HighCVSS 8.6No exploitEPSS 1%
- RCE
- Command injection
netcore · nbr200v2Sep 28, 2026
CVE-2026-101007
35Monitor
aaPanel BaoTa Database Backup database.py InputSql os command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
aapanel · baotaSep 28, 2026
CVE-2026-101008
35Monitor
aaPanel BaoTa File Merge files.py merge_split_file command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
aapanel · baotaSep 28, 2026
CVE-2026-82375
29Monitor
Apache Roller: Server-side request forgery via entry trackback and enclosure URLs
HighCVSS 7.4No exploitEPSS 0%
- SSRF
apache software foundation · apache rollerSep 28, 2026
CVE-2026-82380
32Monitor
Apache Roller: CSRF protection bypass via self-generated salt validation
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- CSRF
apache software foundation · apache rollerSep 28, 2026
CVE-2026-82383
32Monitor
Apache Roller: Anonymous setup action allows frontpage configuration tampering
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache rollerSep 28, 2026
CVE-2026-100903
22Monitor
ООО НПО Ритм GEOritm REST API obj-groups missing authentication
MediumCVSS 5.5Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
ооо нпо ритм · georitmSep 28, 2026
CVE-2026-101000
37Monitor
Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
netcore · nbr100v2Sep 28, 2026
CVE-2026-85134
35Monitor
Arbitrary File Upload Leading to Remote Command Execution in Bimser's eBA Plus
HighCVSS 8.8No exploitEPSS 0%
- RCE
- File upload
bimser solution software trade inc. · eba plus document and workflow management systemSep 28, 2026
CVE-2026-101038
34Monitor
FAST FAC1200R MmtAtePrase stack-based overflow
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
fast · fac1200rSep 28, 2026
CVE-2026-101039
37Monitor
FAST FAC1900R devdiscover Service copy_msg_element stack-based overflow
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
fast · fac1900rSep 28, 2026
CVE-2026-100750
34Monitor
Joomla Extension - regularlabs.com - Arbitrary file read / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla
HighCVSS 8.5No exploitEPSS 0%
- SSRF
regularlabs · modules anywhereSep 28, 2026
CVE-2026-100751
30Monitor
Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0
HighCVSS 7.5No exploitEPSS 0%
- XSS
regularlabs · tabs & accordionsSep 28, 2026
CVE-2026-101009
35Monitor
aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection
HighCVSS 8.5No exploitEPSS 1%
- RCE
- Command injection
aapanel · baotaSep 28, 2026
CVE-2026-82348
30Monitor
Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
apache software foundation · apache rollerSep 28, 2026
CVE-2026-82376
30Monitor
Apache Roller: XML external entity processing in trackback response parser
HighCVSS 7.7No exploitEPSS 0%
- XXE
apache software foundation · apache rollerSep 28, 2026
CVE-2026-82377
39Monitor
Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
CriticalCVSS 9.9No exploitEPSS 0%
- Broken access control (IDOR)
apache software foundation · apache rollerSep 28, 2026
CVE-2026-82378
36Monitor
Apache Roller: OAuth authorization endpoint trusts request-supplied identity
CriticalCVSS 9.0No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
apache software foundation · apache rollerSep 28, 2026
CVE-2026-82379
30Monitor
Apache Roller: WSSE digest authentication headers can be replayed
HighCVSS 7.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
apache software foundation · apache rollerSep 28, 2026
CVE-2026-82384
39Monitor
Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- Deserialization
apache software foundation · apache rollerSep 28, 2026