By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 73 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
32Monitor	CVE-2026-102275No exploit	PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionpyjwt project · pyjwt · CWE-345 Pre-auth	High8.2	—	0.1%	Sep 28, 2026
30Monitor	CVE-2026-102276No exploit	brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionjuliangruber · brace-expansion · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Sep 28, 2026
30Monitor	CVE-2026-102278No exploit	brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionjuliangruber · brace-expansion · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Sep 28, 2026
31Monitor	CVE-2026-16513No exploit	Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel writezephyrproject · zephyr · CWE-787 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 28, 2026
31Monitor	CVE-2026-18413No exploit	Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validationzephyrproject · zephyr · CWE-787 Memory safety	High7.8	—	0.1%	Sep 28, 2026
31Monitor	CVE-2026-18414No exploit	Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validationzephyrproject · zephyr · CWE-787 Memory safety	High7.8	—	0.1%	Sep 28, 2026
28Monitor	CVE-2026-18415No exploit	Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frameszephyrproject · zephyr · CWE-787 Memory safety	High7.1	—	0.0%	Sep 28, 2026
29Monitor	CVE-2026-84895No exploit	In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSefacebook · proxygen · CWE-416 Pre-auth Memory safety	High7.3	—	0.1%	Sep 28, 2026
30Monitor	CVE-2026-91096No exploit	In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases beforfacebook · proxygen · CWE-416 Pre-auth Memory safety	High7.5	—	0.2%	Sep 28, 2026
34Monitor	CVE-2024-42002No exploit	Unsafe use of eval() method in ros2 topic hz toolopen source robotics foundation · robot operating system 2 (ros 2) · CWE-94 RCE	High8.6	—	0.1%	Sep 28, 2026
28Monitor	CVE-2024-58386No exploit	ZoneMinder 1.37.x Path Traversal via files viewzoneminder · zoneminder · CWE-22 Path traversal	High7.1	—	0.3%	Sep 28, 2026
28Monitor	CVE-2026-101091No exploit	SiYuan before v3.8.4 SQL Injection via Block Query Embedsiyuan-note · siyuan · CWE-89 Pre-auth Auth bypass SQL injection	High7.1	—	0.3%	Sep 28, 2026
30Monitor	CVE-2026-102281No exploit	Nest: Remote process termination via a deeply nested microservice message patternnestjs · nest · CWE-248 Pre-auth Denial of service	High7.5	—	0.5%	Sep 28, 2026
33Monitor	CVE-2026-102296No exploit	ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Responsezoneminder · zoneminder · CWE-120 Pre-auth Memory safety	High8.3	—	0.4%	Sep 28, 2026
35Monitor	CVE-2026-101260No exploit	Ziroom ZHOME A0101 firstLogin command injectionziroom · zhome a0101 · CWE-74 RCE Command injection	High8.5	—	2.3%	Sep 28, 2026
35Monitor	CVE-2026-101261No exploit	Ziroom ZHOME A0101 firstSetup_wifi command injectionziroom · zhome a0101 · CWE-74 RCE Command injection	High8.5	—	4.2%	Sep 28, 2026
35Monitor	CVE-2026-101262No exploit	Ziroom ZHOME A0101 set_online_client command injectionziroom · zhome a0101 · CWE-74 RCE Command injection	High8.5	—	2.3%	Sep 28, 2026
36Monitor	CVE-2026-102334Proof of concept	Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protectionnginxproxymanager · nginx-proxy-manager · CWE-307 Pre-auth	Critical9.1	—	0.4%	Sep 28, 2026
28Monitor	CVE-2026-102335No exploit	Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_confignginxproxymanager · nginx-proxy-manager · CWE-863 Broken access control (IDOR)	High7.1	—	0.2%	Sep 28, 2026
35Monitor	CVE-2026-101263No exploit	Ziroom ZHOME A0101 set_online_client command injectionziroom · zhome a0101 · CWE-74 RCE Command injection	High8.5	—	2.3%	Sep 29, 2026
35Monitor	CVE-2026-101264No exploit	Ziroom ZHOME A0101 set_passwd command injectionziroom · zhome a0101 · CWE-74 RCE Command injection	High8.5	—	2.3%	Sep 29, 2026
37Monitor	CVE-2026-102361No exploit	mall4j through 4.0 Missing Authentication in Password Update Endpointgz-yami · mall4j · CWE-306 Pre-auth Auth bypass	Critical9.3	—	0.3%	Sep 29, 2026
28Monitor	CVE-2026-102365No exploit	mall4j through 4.0 Missing Authorization in Admin User Address Endpointsgz-yami · mall4j · CWE-862 Broken access control (IDOR)	High7.1	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-102373No exploit	GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parametergestsup · gestsup · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-101354No exploit	FAST FAC1203R MmtAtePrase _tWlanTask stack-based overflowfast · fac1203r · CWE-119 Pre-auth Memory safety	High8.6	—	0.3%	Sep 29, 2026
29Monitor	CVE-2026-101860No exploit	RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges managementraspap · raspap-webgui · CWE-266	High7.4	—	0.4%	Sep 29, 2026
30Monitor	CVE-2026-101878No exploit	Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncationbitwarden · bitwarden server · CWE-303 Auth bypass	High7.7	—	0.2%	Sep 29, 2026
38Monitor	CVE-2026-102240No exploit	Netcore NAP930 Network Tools CGI network_tools eval os command injectionnetcore · nap930 · CWE-77 pre-auth RCE Command injection	Critical9.3	—	2.0%	Sep 29, 2026
28Monitor	CVE-2026-96326No exploit	HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Fieldhtplugins · ht contact form – drag & drop form builder for wordpress · CWE-79 Pre-auth XSS	High7.2	—	0.1%	Sep 29, 2026
28Monitor	CVE-2026-97685No exploit	LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operationslimesurvey · limesurvey · CWE-639 Broken access control (IDOR)	High7.1	—	0.3%	Sep 29, 2026
28Monitor	CVE-2026-102247No exploit	FastAdmin Database Management database.php unnecessary privilegesCWE-250	High7.1	—	0.3%	Sep 29, 2026
36Monitor	CVE-2026-102422Proof of concept	shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` tokenCWE-78 pre-auth RCE Command injection	Critical9.2	—	0.4%	Sep 29, 2026
28Monitor	CVE-2026-97024No exploit	Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etcred hat · red hat enterprise linux 10 · CWE-61 Pre-auth Path traversal	High7.1	—	0.4%	Sep 29, 2026
8Monitor	CVE-2026-102261Proof of concept	owen2345 Camaleon CMS Media Crop media_controller.rb crop authorizationowen2345 · camaleon cms · CWE-285 Broken access control (IDOR)	Low2.1	—	0.2%	Sep 29, 2026
30Monitor	CVE-2026-86158No exploit	Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhereprogress software · progress® telerik® fiddler® everywhere · CWE-306 Auth bypass	High7.7	—	0.0%	Sep 29, 2026
34Monitor	CVE-2026-101169No exploit	In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafteoctopus deploy · octopus server · CWE-502 RCE Deserialization	High8.7	—	0.3%	Sep 29, 2026
39Monitor	CVE-2026-84154No exploit	Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026xdassault systèmes · geovia geospatial data manager · CWE-94 RCE	Critical9.9	—	0.3%	Sep 29, 2026
39Monitor	CVE-2026-91012No exploit	Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalationapache · karaf · CWE-22 Pre-auth Path traversal	Critical9.8	—	0.6%	Sep 29, 2026
39Monitor	CVE-2026-91048No exploit	Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-createapache · karaf · CWE-862 pre-auth RCE Broken access control (IDOR)	Critical9.8	—	0.5%	Sep 29, 2026
35Monitor	CVE-2026-92142No exploit	Apache Karaf: Authorization bypass in JMX MBean lifecycle operationsapache · karaf · CWE-862 Broken access control (IDOR)	High8.8	—	0.6%	Sep 29, 2026
37Monitor	CVE-2026-96428No exploit	Flowring Agentflow 4.0 - SQL Injectionflowring technology corp · agentflow 4.0 · CWE-89 pre-auth RCE SQL injection	Critical9.3	—	0.3%	Sep 29, 2026
37Monitor	CVE-2026-96429No exploit	Flowring Agentflow 4.0 - SQL Injectionflowring technology corp · agentflow 4.0 · CWE-89 pre-auth RCE SQL injection	Critical9.3	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-96430No exploit	Flowring Agentflow 4.0 - Exposed Dangerous Method or Functionflowring technology corp · agentflow 4.0 · CWE-749 RCE	High8.7	—	0.2%	Sep 29, 2026
37Monitor	CVE-2026-96431No exploit	Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Typeflowring technology corp · agentflow 4.0 · CWE-434 RCE File upload	Critical9.3	—	0.3%	Sep 29, 2026
28Monitor	CVE-2026-96440No exploit	Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）flowring technology corp · agentflow 4.0 · CWE-22 Path traversal	High7.1	—	0.2%	Sep 29, 2026
36Monitor	CVE-2026-15390No exploit	Out-of-bounds write in Das U-Bootdenx software engineering · das u-boot · CWE-459 pre-auth RCE	Critical9.0	—	0.1%	Sep 29, 2026
28Monitor	CVE-2026-19547No exploit	Local Privilege Escalation in Ghostscript for Windowsartifex software inc. · ghostscript · CWE-426 RCE Local privilege escalation	High7.0	—	0.1%	Sep 29, 2026
32Monitor	CVE-2026-76718No exploit	HPE OneView - Cross-site scripting vulnerabilityhewlett packard enterprise · hpe oneview · CWE-79 Pre-auth XSS	High8.2	—	0.1%	Sep 29, 2026
32Monitor	CVE-2026-76719No exploit	HPE OneView - Cross-site scripting vulnerabilityhewlett packard enterprise · hpe oneview · CWE-79 Pre-auth XSS	High8.2	—	0.1%	Sep 29, 2026
34Monitor	CVE-2026-7395No exploit	Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to hitachi energy · asset suite · CWE-306 Pre-auth Auth bypass	High8.5	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-84739No exploit	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabgitlab · gitlab · CWE-79 RCE XSS	High8.7	—	0.3%	Sep 29, 2026
36Monitor	CVE-2026-8065Proof of concept	An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticathitachi energy · rtu500 series cmu firmware · CWE-306 Pre-auth Auth bypass	Critical9.1	—	0.4%	Sep 29, 2026
36Monitor	CVE-2026-8066No exploit	A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticatedhitachi energy · rtu500 series cmu firmware · CWE-23 Pre-auth Path traversal	Critical9.1	—	0.7%	Sep 29, 2026
35Monitor	CVE-2026-95387No exploit	Heap-based Buffer Overflow in Wiresharkwireshark · wireshark · CWE-122 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
32Monitor	CVE-2026-95389No exploit	Heap-based Buffer Overflow in Wiresharkwireshark · wireshark · CWE-122 Pre-auth Memory safety	High8.1	—	0.3%	Sep 29, 2026
31Monitor	CVE-2026-96419No exploit	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wiresharkwireshark · wireshark · CWE-22 Path traversal	High7.8	—	0.1%	Sep 29, 2026
28Monitor	CVE-2026-96423No exploit	Heap-based Buffer Overflow in Wiresharkwireshark · wireshark · CWE-122 Memory safety	High7.1	—	0.1%	Sep 29, 2026
35Monitor	CVE-2026-95509No exploit	Out-of-bounds read vulnerability in string formatting impacts Qt for MCUsqt · qt for mcus · CWE-125 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
30Monitor	CVE-2026-102495No exploit	Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includesapache · xmlschema · CWE-674 Pre-auth Denial of service	High7.5	—	0.5%	Sep 29, 2026
30Monitor	CVE-2026-102496No exploit	Apache XMLSchema: Denial of service through deeply nested schema structuresapache · xmlschema · CWE-674 Pre-auth Denial of service	High7.5	—	0.5%	Sep 29, 2026
30Monitor	CVE-2026-102497No exploit	Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walkerapache · xmlschema · CWE-674 Pre-auth Denial of service	High7.5	—	0.5%	Sep 29, 2026
27Monitor	CVE-2026-41875Proof of concept	Cross-Site Request Forgery in admin panel of Quick.Cartopensolution · quick.cart · CWE-352 Pre-auth CSRF	Medium6.9	—	0.1%	Sep 29, 2026
35Monitor	CVE-2026-73594No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains an Improper Certificate Valdell · policy manager for secure connect gateway · CWE-295 Pre-auth Weak crypto	High8.8	—	0.0%	Sep 29, 2026
39Monitor	CVE-2026-73595No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without dell · policy manager for secure connect gateway · CWE-494 Pre-auth	Critical9.8	—	0.1%	Sep 29, 2026
32Monitor	CVE-2026-73597No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability.dell · policy manager for secure connect gateway · CWE-352 Pre-auth CSRF	High8.1	—	0.1%	Sep 29, 2026
37Monitor	CVE-2026-85520Proof of concept	Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop modulemypresta · google merchant center feed · CWE-73 pre-auth RCE Path traversal	Critical9.3	—	0.9%	Sep 29, 2026
35Monitor	CVE-2026-87748No exploit	Privilege Escalation via Account Takeover in Interprobe's Qorela DCinterprobe information technologies inc. · qorela dc · CWE-862 Broken access control (IDOR)	High8.8	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-95520No exploit	Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packagesred hat · red hat enterprise linux 10 · CWE-787 Memory safety	High7.1	—	0.1%	Sep 29, 2026
32Monitor	CVE-2026-100756No exploit	Incorrect boundary conditions in the Audio/Video: Playback componentmozilla · firefox · CWE-119 Pre-auth Memory safety	High8.1	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100757No exploit	Use-after-free in the Widget componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-100758No exploit	Sandbox escape in the DOM: Navigation componentmozilla · firefox · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.6	—	0.3%	Sep 29, 2026
32Monitor	CVE-2026-100759No exploit	Uninitialized memory in the Storage: Quota Manager componentmozilla · firefox · CWE-457 Pre-auth	High8.1	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-100760No exploit	Sandbox escape in the Security: Process Sandboxing componentmozilla · firefox · CWE-693 Pre-auth	Critical9.6	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100761No exploit	Privilege escalation due to use-after-free in the Graphics: WebGPU componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
38Monitor	CVE-2026-100762No exploit	Sandbox escape due to use-after-free in the DOM: Content Processes componentmozilla · firefox · CWE-416 Pre-auth Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
36Monitor	CVE-2026-100763No exploit	Incorrect boundary conditions in the Graphics: WebGPU componentmozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.1	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100764No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU componentmozilla · firefox · CWE-119 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100765No exploit	Use-after-free in the JavaScript: WebAssembly componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100767No exploit	Use-after-free in the Networking: Cache componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100768No exploit	Use-after-free in the Graphics: WebGPU componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100769No exploit	Use-after-free in the JavaScript: WebAssembly componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-100770No exploit	Sandbox escape due to use-after-free in the DOM: Content Processes componentmozilla · firefox · CWE-416 Pre-auth Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
32Monitor	CVE-2026-100771No exploit	Undefined behavior in the DOM: Streams componentmozilla · firefox · CWE-758 Pre-auth	High8.1	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100772No exploit	Use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100773No exploit	Use-after-free in the Storage: IndexedDB componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100774No exploit	Use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-100775No exploit	Sandbox escape in the Graphics componentmozilla · firefox · CWE-693 Pre-auth	Critical9.6	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100776No exploit	Use-after-free in the JavaScript: WebAssembly componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100777No exploit	Use-after-free in the Graphics: Canvas2D componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-100778No exploit	Sandbox escape due to use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 Pre-auth Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100779No exploit	Use-after-free in the XSLT componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100780No exploit	Use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-100781No exploit	Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender componentmozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100782No exploit	Privilege escalation due to incorrect boundary conditions in the Graphics componentmozilla · firefox · CWE-119 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100784No exploit	Use-after-free in the Layout: Text and Fonts componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100785No exploit	Use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-100786No exploit	Sandbox escape due to use-after-free in the Graphics componentmozilla · firefox · CWE-416 Pre-auth Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-100787No exploit	Sandbox escape in the XUL componentmozilla · firefox · CWE-20 Pre-auth	Critical9.6	—	0.3%	Sep 29, 2026
39Monitor	CVE-2026-100788No exploit	Invalid pointer in the JavaScript: WebAssembly componentmozilla · firefox · CWE-824 Pre-auth Memory safety	Critical9.8	—	0.4%	Sep 29, 2026
35Monitor	CVE-2026-100789No exploit	Use-after-free in the Graphics: Canvas2D componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026

CVE-2026-102275
32Monitor
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
pyjwt project · pyjwtSep 28, 2026
CVE-2026-102276
30Monitor
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
juliangruber · brace-expansionSep 28, 2026
CVE-2026-102278
30Monitor
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
juliangruber · brace-expansionSep 28, 2026
CVE-2026-16513
31Monitor
Missing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
zephyrproject · zephyrSep 28, 2026
CVE-2026-18413
31Monitor
Out-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
zephyrproject · zephyrSep 28, 2026
CVE-2026-18414
31Monitor
Out-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
zephyrproject · zephyrSep 28, 2026
CVE-2026-18415
28Monitor
Out-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
zephyrproject · zephyrSep 28, 2026
CVE-2026-84895
29Monitor
In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSe
HighCVSS 7.3No exploitEPSS 0%
- Pre-auth
- Memory safety
facebook · proxygenSep 28, 2026
CVE-2026-91096
30Monitor
In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases befor
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
facebook · proxygenSep 28, 2026
CVE-2024-42002
34Monitor
Unsafe use of eval() method in ros2 topic hz tool
HighCVSS 8.6No exploitEPSS 0%
- RCE
open source robotics foundation · robot operating system 2 (ros 2)Sep 28, 2026
CVE-2024-58386
28Monitor
ZoneMinder 1.37.x Path Traversal via files view
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
zoneminder · zoneminderSep 28, 2026
CVE-2026-101091
28Monitor
SiYuan before v3.8.4 SQL Injection via Block Query Embed
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
- SQL injection
siyuan-note · siyuanSep 28, 2026
CVE-2026-102281
30Monitor
Nest: Remote process termination via a deeply nested microservice message pattern
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
nestjs · nestSep 28, 2026
CVE-2026-102296
33Monitor
ZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Memory safety
zoneminder · zoneminderSep 28, 2026
CVE-2026-101260
35Monitor
Ziroom ZHOME A0101 firstLogin command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
ziroom · zhome a0101Sep 28, 2026
CVE-2026-101261
35Monitor
Ziroom ZHOME A0101 firstSetup_wifi command injection
HighCVSS 8.5No exploitEPSS 4%
- RCE
- Command injection
ziroom · zhome a0101Sep 28, 2026
CVE-2026-101262
35Monitor
Ziroom ZHOME A0101 set_online_client command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
ziroom · zhome a0101Sep 28, 2026
CVE-2026-102334
36Monitor
Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
nginxproxymanager · nginx-proxy-managerSep 28, 2026
CVE-2026-102335
28Monitor
Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
nginxproxymanager · nginx-proxy-managerSep 28, 2026
CVE-2026-101263
35Monitor
Ziroom ZHOME A0101 set_online_client command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
ziroom · zhome a0101Sep 29, 2026
CVE-2026-101264
35Monitor
Ziroom ZHOME A0101 set_passwd command injection
HighCVSS 8.5No exploitEPSS 2%
- RCE
- Command injection
ziroom · zhome a0101Sep 29, 2026
CVE-2026-102361
37Monitor
mall4j through 4.0 Missing Authentication in Password Update Endpoint
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
gz-yami · mall4jSep 29, 2026
CVE-2026-102365
28Monitor
mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
gz-yami · mall4jSep 29, 2026
CVE-2026-102373
28Monitor
GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
gestsup · gestsupSep 29, 2026
CVE-2026-101354
34Monitor
FAST FAC1203R MmtAtePrase _tWlanTask stack-based overflow
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Memory safety
fast · fac1203rSep 29, 2026
CVE-2026-101860
29Monitor
RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management
HighCVSS 7.4No exploitEPSS 0%
raspap · raspap-webguiSep 29, 2026
CVE-2026-101878
30Monitor
Bitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation
HighCVSS 7.7No exploitEPSS 0%
- Auth bypass
bitwarden · bitwarden serverSep 29, 2026
CVE-2026-102240
38Monitor
Netcore NAP930 Network Tools CGI network_tools eval os command injection
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
netcore · nap930Sep 29, 2026
CVE-2026-96326
28Monitor
HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field
HighCVSS 7.2No exploitEPSS 0%
- Pre-auth
- XSS
htplugins · ht contact form – drag & drop form builder for wordpressSep 29, 2026
CVE-2026-97685
28Monitor
LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
limesurvey · limesurveySep 29, 2026
CVE-2026-102247
28Monitor
FastAdmin Database Management database.php unnecessary privileges
HighCVSS 7.1No exploitEPSS 0%
Sep 29, 2026
CVE-2026-102422
36Monitor
shell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token
CriticalCVSS 9.2Proof of conceptEPSS 0%
- pre-auth RCE
- Command injection
Sep 29, 2026
CVE-2026-97024
28Monitor
Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
red hat · red hat enterprise linux 10Sep 29, 2026
CVE-2026-102261
8Monitor
owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization
LowCVSS 2.1Proof of conceptEPSS 0%
- Broken access control (IDOR)
owen2345 · camaleon cmsSep 29, 2026
CVE-2026-86158
30Monitor
Missing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere
HighCVSS 7.7No exploitEPSS 0%
- Auth bypass
progress software · progress® telerik® fiddler® everywhereSep 29, 2026
CVE-2026-101169
34Monitor
In affected versions of Octopus Server, an authenticated user with permissions to edit an Environment or Project can set specifically crafte
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Deserialization
octopus deploy · octopus serverSep 29, 2026
CVE-2026-84154
39Monitor
Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
dassault systèmes · geovia geospatial data managerSep 29, 2026
CVE-2026-91012
39Monitor
Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Path traversal
apache · karafSep 29, 2026
CVE-2026-91048
39Monitor
Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
apache · karafSep 29, 2026
CVE-2026-92142
35Monitor
Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
apache · karafSep 29, 2026
CVE-2026-96428
37Monitor
Flowring Agentflow 4.0 - SQL Injection
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- SQL injection
flowring technology corp · agentflow 4.0Sep 29, 2026
CVE-2026-96429
37Monitor
Flowring Agentflow 4.0 - SQL Injection
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- SQL injection
flowring technology corp · agentflow 4.0Sep 29, 2026
CVE-2026-96430
34Monitor
Flowring Agentflow 4.0 - Exposed Dangerous Method or Function
HighCVSS 8.7No exploitEPSS 0%
- RCE
flowring technology corp · agentflow 4.0Sep 29, 2026
CVE-2026-96431
37Monitor
Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type
CriticalCVSS 9.3No exploitEPSS 0%
- RCE
- File upload
flowring technology corp · agentflow 4.0Sep 29, 2026
CVE-2026-96440
28Monitor
Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
flowring technology corp · agentflow 4.0Sep 29, 2026
CVE-2026-15390
36Monitor
Out-of-bounds write in Das U-Boot
CriticalCVSS 9.0No exploitEPSS 0%
- pre-auth RCE
denx software engineering · das u-bootSep 29, 2026
CVE-2026-19547
28Monitor
Local Privilege Escalation in Ghostscript for Windows
HighCVSS 7.0No exploitEPSS 0%
- RCE
- Local privilege escalation
artifex software inc. · ghostscriptSep 29, 2026
CVE-2026-76718
32Monitor
HPE OneView - Cross-site scripting vulnerability
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- XSS
hewlett packard enterprise · hpe oneviewSep 29, 2026
CVE-2026-76719
32Monitor
HPE OneView - Cross-site scripting vulnerability
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- XSS
hewlett packard enterprise · hpe oneviewSep 29, 2026
CVE-2026-7395
34Monitor
Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to
HighCVSS 8.5No exploitEPSS 0%
- Pre-auth
- Auth bypass
hitachi energy · asset suiteSep 29, 2026
CVE-2026-84739
34Monitor
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
gitlab · gitlabSep 29, 2026
CVE-2026-8065
36Monitor
An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticat
CriticalCVSS 9.1Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
hitachi energy · rtu500 series cmu firmwareSep 29, 2026
CVE-2026-8066
36Monitor
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Path traversal
hitachi energy · rtu500 series cmu firmwareSep 29, 2026
CVE-2026-95387
35Monitor
Heap-based Buffer Overflow in Wireshark
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
wireshark · wiresharkSep 29, 2026
CVE-2026-95389
32Monitor
Heap-based Buffer Overflow in Wireshark
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Memory safety
wireshark · wiresharkSep 29, 2026
CVE-2026-96419
31Monitor
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark
HighCVSS 7.8No exploitEPSS 0%
- Path traversal
wireshark · wiresharkSep 29, 2026
CVE-2026-96423
28Monitor
Heap-based Buffer Overflow in Wireshark
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
wireshark · wiresharkSep 29, 2026
CVE-2026-95509
35Monitor
Out-of-bounds read vulnerability in string formatting impacts Qt for MCUs
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
qt · qt for mcusSep 29, 2026
CVE-2026-102495
30Monitor
Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · xmlschemaSep 29, 2026
CVE-2026-102496
30Monitor
Apache XMLSchema: Denial of service through deeply nested schema structures
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · xmlschemaSep 29, 2026
CVE-2026-102497
30Monitor
Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
apache · xmlschemaSep 29, 2026
CVE-2026-41875
27Monitor
Cross-Site Request Forgery in admin panel of Quick.Cart
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- CSRF
opensolution · quick.cartSep 29, 2026
CVE-2026-73594
35Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains an Improper Certificate Val
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Weak crypto
dell · policy manager for secure connect gatewaySep 29, 2026
CVE-2026-73595
39Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
dell · policy manager for secure connect gatewaySep 29, 2026
CVE-2026-73597
32Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability.
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- CSRF
dell · policy manager for secure connect gatewaySep 29, 2026
CVE-2026-85520
37Monitor
Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module
CriticalCVSS 9.3Proof of conceptEPSS 0%
- pre-auth RCE
- Path traversal
mypresta · google merchant center feedSep 29, 2026
CVE-2026-87748
35Monitor
Privilege Escalation via Account Takeover in Interprobe's Qorela DC
HighCVSS 8.8No exploitEPSS 0%
- Broken access control (IDOR)
interprobe information technologies inc. · qorela dcSep 29, 2026
CVE-2026-95520
28Monitor
Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
red hat · red hat enterprise linux 10Sep 29, 2026
CVE-2026-100756
32Monitor
Incorrect boundary conditions in the Audio/Video: Playback component
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100757
35Monitor
Use-after-free in the Widget component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100758
38Monitor
Sandbox escape in the DOM: Navigation component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
mozilla · firefoxSep 29, 2026
CVE-2026-100759
32Monitor
Uninitialized memory in the Storage: Quota Manager component
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100760
38Monitor
Sandbox escape in the Security: Process Sandboxing component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100761
35Monitor
Privilege escalation due to use-after-free in the Graphics: WebGPU component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100762
38Monitor
Sandbox escape due to use-after-free in the DOM: Content Processes component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100763
36Monitor
Incorrect boundary conditions in the Graphics: WebGPU component
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100764
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics: WebGPU component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100765
35Monitor
Use-after-free in the JavaScript: WebAssembly component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100767
35Monitor
Use-after-free in the Networking: Cache component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100768
35Monitor
Use-after-free in the Graphics: WebGPU component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100769
35Monitor
Use-after-free in the JavaScript: WebAssembly component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100770
38Monitor
Sandbox escape due to use-after-free in the DOM: Content Processes component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100771
32Monitor
Undefined behavior in the DOM: Streams component
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100772
35Monitor
Use-after-free in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100773
35Monitor
Use-after-free in the Storage: IndexedDB component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100774
35Monitor
Use-after-free in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100775
38Monitor
Sandbox escape in the Graphics component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100776
35Monitor
Use-after-free in the JavaScript: WebAssembly component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100777
35Monitor
Use-after-free in the Graphics: Canvas2D component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100778
38Monitor
Sandbox escape due to use-after-free in the DOM: Core & HTML component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100779
35Monitor
Use-after-free in the XSLT component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100780
35Monitor
Use-after-free in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100781
38Monitor
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100782
35Monitor
Privilege escalation due to incorrect boundary conditions in the Graphics component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100784
35Monitor
Use-after-free in the Layout: Text and Fonts component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100785
35Monitor
Use-after-free in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100786
38Monitor
Sandbox escape due to use-after-free in the Graphics component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100787
38Monitor
Sandbox escape in the XUL component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100788
39Monitor
Invalid pointer in the JavaScript: WebAssembly component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100789
35Monitor
Use-after-free in the Graphics: Canvas2D component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026