By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 74 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
35Monitor	CVE-2026-100790No exploit	Use-after-free in the XSLT componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100791No exploit	Use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.3%	Sep 29, 2026
28Monitor	CVE-2026-100792No exploit	JIT miscompilation in the JavaScript: WebAssembly componentmozilla · firefox · CWE-843 Pre-auth	High7.1	—	0.2%	Sep 29, 2026
38Monitor	CVE-2026-100794No exploit	Sandbox escape due to incorrect boundary conditions in the Internationalization componentmozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-100796No exploit	Use-after-free in the JavaScript: WebAssembly componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100797No exploit	Privilege escalation due to use-after-free in the Graphics: WebRender componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
32Monitor	CVE-2026-100798No exploit	Cryptography misuse in Storage: Quota Manager componentmozilla · firefox · CWE-325 Pre-auth	High8.1	—	0.1%	Sep 29, 2026
38Monitor	CVE-2026-100800No exploit	Sandbox escape due to use-after-free in the Disability Access APIs componentmozilla · firefox · CWE-416 Pre-auth Memory safety	Critical9.6	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100801No exploit	Privilege escalation in the DLL Services componentmozilla · firefox · CWE-269 Pre-auth	High8.8	—	0.2%	Sep 29, 2026
32Monitor	CVE-2026-100803No exploit	Same-origin policy bypass in the WebExtensions componentmozilla · firefox · CWE-346 Pre-auth	High8.1	—	0.1%	Sep 29, 2026
38Monitor	CVE-2026-100804No exploit	Sandbox escape due to use-after-free in the Preferences: Backend componentmozilla · firefox · CWE-416 Pre-auth Memory safety	Critical9.6	—	0.2%	Sep 29, 2026
30Monitor	CVE-2026-100805No exploit	Race condition, use-after-free in the Audio/Video componentmozilla · firefox · CWE-362 Pre-auth Race condition	High7.5	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100807No exploit	Privilege escalation in the DOM: Service Workers componentmozilla · firefox · CWE-269 Pre-auth	High8.8	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100808No exploit	Mitigation bypass in the DOM: Service Workers componentmozilla · firefox · CWE-693 Pre-auth	High8.8	—	0.2%	Sep 29, 2026
32Monitor	CVE-2026-100809No exploit	Same-origin policy bypass in the DevTools componentmozilla · firefox · CWE-346 Pre-auth	High8.1	—	0.1%	Sep 29, 2026
39Monitor	CVE-2026-100810No exploit	Other issue in the DevTools componentmozilla · firefox · CWE-200 Pre-auth Info leak	Critical9.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-100811No exploit	Sandbox escape due to use-after-free in the DOM: Core & HTML componentmozilla · firefox · CWE-416 Pre-auth Memory safety	Critical9.6	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100813No exploit	Invalid pointer in the JavaScript Engine: JIT componentmozilla · firefox · CWE-763 Pre-auth	High8.8	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100814No exploit	Incorrect boundary conditions in the JavaScript Engine: JIT componentmozilla · firefox · CWE-119 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100815No exploit	Use-after-free in the CSS Parsing and Computation componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
32Monitor	CVE-2026-100816No exploit	Site isolation issue in the DOM: Networking componentmozilla · firefox · CWE-346 Pre-auth	High8.1	—	0.1%	Sep 29, 2026
38Monitor	CVE-2026-100818No exploit	Sandbox escape due to use-after-free in the Widget: Gtk componentmozilla · firefox · CWE-416 Pre-auth Memory safety	Critical9.6	—	0.2%	Sep 29, 2026
38Monitor	CVE-2026-100819No exploit	Sandbox escape due to incorrect boundary conditions in the XPCOM componentmozilla · firefox · CWE-119 Pre-auth Memory safety	Critical9.6	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100820No exploit	Privilege escalation in the Address Bar componentmozilla · firefox · CWE-269 Pre-auth	High8.8	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100824No exploit	Privilege escalation in the Places componentmozilla · firefox · CWE-269 Pre-auth	High8.8	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100825No exploit	Use-after-free in the JavaScript Engine: JIT componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
38Monitor	CVE-2026-100828No exploit	Mitigation bypass in the Bookmarks & History componentmozilla · firefox · CWE-693 Pre-auth	Critical9.6	—	0.2%	Sep 29, 2026
38Monitor	CVE-2026-100829No exploit	Mitigation bypass in the DOM: Security componentmozilla · firefox · CWE-693 Pre-auth	Critical9.6	—	0.2%	Sep 29, 2026
32Monitor	CVE-2026-100830No exploit	Mitigation bypass in the DOM: Navigation componentmozilla · firefox · CWE-346 Pre-auth	High8.1	—	0.1%	Sep 29, 2026
35Monitor	CVE-2026-100831No exploit	Use-after-free in the DOM: UI Events & Focus Handling componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-100832No exploit	Use-after-free in the Graphics: Canvas2D componentmozilla · firefox · CWE-416 Pre-auth Memory safety	High8.8	—	0.2%	Sep 29, 2026
31Monitor	CVE-2026-102437No exploit	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonixesengine · deepseek-reasonix · CWE-78 RCE Command injection	High7.8	—	1.0%	Sep 29, 2026
31Monitor	CVE-2026-73598No exploit	Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Resdell · policy manager for secure connect gateway · CWE-732 Local privilege escalation	High7.8	—	0.0%	Sep 29, 2026
37Monitor	CVE-2026-7192No exploit	Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipmentshenzhen dbit network equipment · t-cpe301k 4g mini wifi router · CWE-121 Pre-auth Memory safety	Critical9.3	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-7193No exploit	Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipmentshenzhen dbit network equipment · t-cpe301k 4g mini wifi router · CWE-798 Hard-coded credentials	High8.6	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-82804No exploit	Apache DolphinScheduler: Command Injection in the Alert Script Pluginapache software foundation · apache dolphinscheduler · CWE-78 RCE Command injection	High8.8	—	0.5%	Sep 29, 2026
37Monitor	CVE-2026-82973No exploit	Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailboxpsyb0t · docker-mailbox · CWE-93 Pre-auth	Critical9.4	—	0.4%	Sep 29, 2026
34Monitor	CVE-2026-102360No exploit	lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memorydmonad · lib0 · CWE-125 Pre-auth Memory safety	High8.6	—	0.4%	Sep 29, 2026
34Monitor	CVE-2026-102521No exploit	lib0 `readFromDataView` out-of-bounds readdmonad · lib0 · CWE-125 Pre-auth Memory safety	High8.6	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-4034No exploit	TIBCO Administrator Injection Vulnerabilitytibco · administrator · CWE-74	High8.7	—	0.2%	Sep 29, 2026
30Monitor	CVE-2026-86450No exploit	Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portalparla auto automotive trading limited company · detawix mobile web portal · CWE-201 Pre-auth	High7.5	—	0.2%	Sep 29, 2026
32Monitor	CVE-2026-97395No exploit	Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage apache software foundation · apache polaris · CWE-862 Broken access control (IDOR)	High8.1	—	0.2%	Sep 29, 2026
34Monitor	CVE-2015-20122No exploit	Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jspyonyou · a6 oa · CWE-89 Pre-auth SQL injection	High8.7	—	0.4%	Sep 29, 2026
34Monitor	CVE-2026-102566No exploit	CTranslate2 before 4.8.1 Heap Buffer Overflow via model.binopennmt · ctranslate2 · CWE-787 RCE Memory safety	High8.5	—	0.1%	Sep 29, 2026
28Monitor	CVE-2026-102569No exploit	ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parametermacwarrior · clipbucket-v5 · CWE-89 SQL injection	High7.0	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-102570No exploit	ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parametermacwarrior · clipbucket-v5 · CWE-89 SQL injection	High7.0	—	0.2%	Sep 29, 2026
37Monitor	CVE-2026-22094No exploit	Weak root password in EVbee DC 80evbee · dc 80 · CWE-1391 Pre-auth	Critical9.3	—	0.2%	Sep 29, 2026
38Monitor	CVE-2026-49243No exploit	Webmin: Reflected XSS in the Configuration modulewebmin · webmin · CWE-79 Pre-auth XSS	Critical9.6	—	0.2%	Sep 29, 2026
30Monitor	CVE-2026-63209No exploit	Integer Overflow or Wraparound and Out-of-bounds Write in compressklauspost · compress · CWE-190 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Sep 29, 2026
31Monitor	CVE-2026-65102No exploit	NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAnvidia · deepstream · CWE-190 Memory safety	High7.8	—	0.1%	Sep 29, 2026
34Monitor	CVE-2026-68911No exploit	Nicotine+: Decompression of peer messages can exhaust available memorynicotine-plus · nicotine-plus · CWE-409 Pre-auth	High8.7	—	0.3%	Sep 29, 2026
34Monitor	CVE-2026-86035No exploit	Weblate: Mercurial argument injection via repository filenames allows authenticated command executionweblateorg · weblate · CWE-78 RCE Command injection	High8.5	—	0.4%	Sep 29, 2026
37Monitor	CVE-2023-54400No exploit	Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpBynamefumasoft · fumeng cloud · CWE-89 Pre-auth SQL injection	Critical9.3	—	0.5%	Sep 29, 2026
28Monitor	CVE-2026-100288No exploit	Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access devolutions · server · CWE-312	High7.2	—	0.0%	Sep 29, 2026
33Monitor	CVE-2026-100308No exploit	GluonTS arbitrary command execution during model deserializationaws · gluonts · CWE-470 RCE Deserialization Local privilege escalation	High8.4	—	0.1%	Sep 29, 2026
30Monitor	CVE-2026-102600No exploit	Socket.IO: Prototype Pollution via Unsafe Client Session Lookupsocketio · socket.io · CWE-20 Pre-auth Prototype pollution Denial of service	High7.5	—	0.3%	Sep 29, 2026
31Monitor	CVE-2026-19743No exploit	Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clientsteamviewer · full client · CWE-22 Path traversal Local privilege escalation	High7.8	—	0.1%	Sep 29, 2026
30Monitor	CVE-2026-54873No exploit	QUIC STREAM Fragment Metadata DoSopenssl · openssl · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Sep 29, 2026
30Monitor	CVE-2026-72897No exploit	Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshakeopenssl · openssl · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.3%	Sep 29, 2026
39Monitor	CVE-2026-77177No exploit	Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because promCWE-94 pre-auth RCE	Critical9.8	—	0.5%	Sep 29, 2026
32Monitor	CVE-2026-84782No exploit	DTLS Retransmits Handshake Messages From a Stale Buffer Offsetopenssl · openssl · CWE-125 Pre-auth Memory safety	High8.2	—	0.9%	Sep 29, 2026
30Monitor	CVE-2026-84783No exploit	Use-After-Free in X.509 Extension Cache Under Concurrent Useopenssl · openssl · CWE-416 Pre-auth Memory safety Denial of service	High7.5	—	0.2%	Sep 29, 2026
30Monitor	CVE-2026-84784No exploit	QUIC: Unbounded RETIRE_CONNECTION_ID Backlogopenssl · openssl · CWE-770 Pre-auth Denial of service	High7.5	—	0.6%	Sep 29, 2026
31Monitor	CVE-2026-92368No exploit	Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Executionteamviewer · full client · CWE-122 RCE Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 29, 2026
29Monitor	CVE-2026-92369No exploit	Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalationteamviewer · full client · CWE-367 Local privilege escalation Race condition	High7.3	—	0.0%	Sep 29, 2026
35Monitor	CVE-2026-92370No exploit	Remote Session Access Control Bypass Leading to Remote Code Executionteamviewer · full client · CWE-284 pre-auth RCE Broken access control (IDOR)	High8.8	—	0.4%	Sep 29, 2026
28Monitor	CVE-2026-92371No exploit	Local Privilege Escalation via Improper Link Resolution in Cloud Session Recordingteamviewer · full client · CWE-59 Local privilege escalation Race condition	High7.0	—	0.1%	Sep 29, 2026
30Monitor	CVE-2026-97687No exploit	urllib3: HTTPS proxy TLS configuration may be ignored or overriddenpython · urllib3 · CWE-295 Pre-auth Weak crypto	High7.6	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-97689No exploit	urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memorypython · urllib3 · CWE-770 Pre-auth Denial of service	High8.9	—	0.3%	Sep 29, 2026
35Monitor	CVE-2022-51019No exploit	Akaunting before 2.1.31 OS Command Injection via app aliasakaunting · akaunting · CWE-78 RCE Command injection	High8.7	—	1.7%	Sep 29, 2026
36Monitor	CVE-2026-100240No exploit	TemplateSandbox does not check read permissions for the page being previewedwikimedia foundation · mediawiki - templatesandbox extension · CWE-862 Pre-auth Broken access control (IDOR)	Critical9.1	—	0.2%	Sep 29, 2026
30Monitor	CVE-2026-100241No exploit	Private change tags exposed to anonymous users via revision-tags-change eventswikimedia foundation · mediawiki - eventbus extension · CWE-200 Pre-auth Info leak	High7.5	—	0.3%	Sep 29, 2026
30Monitor	CVE-2026-100242No exploit	DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)wikimedia foundation · mediawiki - datatransfer extension · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Sep 29, 2026
30Monitor	CVE-2026-100244No exploit	CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)wikimedia foundation · mediawiki - centralauth extension · CWE-200 Pre-auth Info leak	High7.5	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-101127No exploit	Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4balbooa · forms · CWE-79 Pre-auth XSS	High8.6	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-102424No exploit	Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4balbooa · forms · CWE-22 Pre-auth Path traversal	High8.9	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-102425Proof of concept	Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4balbooa · forms · CWE-94 pre-auth RCE	Critical9.5	—	0.5%	Sep 29, 2026
34Monitor	CVE-2026-102556No exploit	Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusiongnome · libsoup · CWE-843 Pre-auth	High8.6	—	0.4%	Sep 29, 2026
34Monitor	CVE-2026-102557No exploit	Libsoup: libsoup: heap buffer overflow during websocket message reassemblygnome · libsoup · CWE-125 Pre-auth Memory safety	High8.6	—	0.4%	Sep 29, 2026
32Monitor	CVE-2026-102633No exploit	libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloclibexpat · libexpat · CWE-190 Pre-auth Memory safety	High8.2	—	0.3%	Sep 29, 2026
34Monitor	CVE-2026-102634No exploit	SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_roomsgl-project · sglang · CWE-694 Pre-auth	High8.7	—	0.5%	Sep 29, 2026
29Monitor	CVE-2026-102675No exploit	Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabledelectronjs · electron · CWE-346 Pre-auth	High7.4	—	0.2%	Sep 29, 2026
39Monitor	CVE-2026-102676No exploit	Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictionselectronjs · electron · CWE-269 Pre-auth	Critical9.8	—	0.4%	Sep 29, 2026
34Monitor	CVE-2026-102697Proof of concept	Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorizationollama · ollama · CWE-863 Broken access control (IDOR)	High8.5	—	0.1%	Sep 29, 2026
30Monitor	CVE-2026-102796No exploit	Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameterswikimedia foundation · mediawiki - userpageviewtracker extension · CWE-89 Pre-auth SQL injection	High7.5	—	0.3%	Sep 29, 2026
27Monitor	CVE-2026-90907Proof of concept	Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3joomla · joomla! · CWE-639 Pre-auth Broken access control (IDOR)	Medium6.9	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-90913No exploit	Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3joomla · joomla! · CWE-284 Broken access control (IDOR)	High7.0	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-90915No exploit	Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3joomla · joomla! · CWE-22 Path traversal	High7.0	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-92222No exploit	Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3joomla · joomla! · CWE-918 SSRF	High8.9	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-92226No exploit	Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3joomla · joomla! · CWE-284 Broken access control (IDOR)	High7.0	—	0.2%	Sep 29, 2026
32Monitor	CVE-2026-92227No exploit	Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3joomla · joomla! · CWE-287 Pre-auth Auth bypass	High8.2	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-92231No exploit	Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3joomla · joomla! · CWE-79 XSS	High7.1	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-92232No exploit	Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3joomla · joomla! · CWE-79 XSS	High7.1	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-102242No exploit	Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databasesgoogle · mcp toolbox for databases · CWE-22 Path traversal	High8.6	—	0.3%	Sep 29, 2026
32Monitor	CVE-2026-102555No exploit	Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decodinggnome · libsoup · CWE-125 Pre-auth Memory safety	High8.2	—	0.4%	Sep 29, 2026
34Monitor	CVE-2026-102558No exploit	Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growthgnome · libsoup · CWE-125 Pre-auth Memory safety	High8.6	—	0.5%	Sep 29, 2026
34Monitor	CVE-2026-102559No exploit	Libsoup: libsoup: heap buffer overflow during websocket client-frame maskinggnome · libsoup · CWE-125 Pre-auth Memory safety	High8.6	—	0.6%	Sep 29, 2026
39Monitor	CVE-2026-102560No exploit	Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growthgnome · libsoup · CWE-125 Pre-auth Memory safety	Critical9.8	—	0.6%	Sep 29, 2026
28Monitor	CVE-2026-102639No exploit	MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserializationmobilitydb · mobilitydb · CWE-195 Deserialization	High7.1	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-102677No exploit	Electron: Sandboxed preload code cache can be poisoned by a compromised rendererelectronjs · electron · CWE-20 Local privilege escalation	High8.8	—	0.0%	Sep 29, 2026

CVE-2026-100790
35Monitor
Use-after-free in the XSLT component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100791
35Monitor
Use-after-free in the DOM: Core & HTML component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100792
28Monitor
JIT miscompilation in the JavaScript: WebAssembly component
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100794
38Monitor
Sandbox escape due to incorrect boundary conditions in the Internationalization component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100796
35Monitor
Use-after-free in the JavaScript: WebAssembly component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100797
35Monitor
Privilege escalation due to use-after-free in the Graphics: WebRender component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100798
32Monitor
Cryptography misuse in Storage: Quota Manager component
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100800
38Monitor
Sandbox escape due to use-after-free in the Disability Access APIs component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100801
35Monitor
Privilege escalation in the DLL Services component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100803
32Monitor
Same-origin policy bypass in the WebExtensions component
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100804
38Monitor
Sandbox escape due to use-after-free in the Preferences: Backend component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100805
30Monitor
Race condition, use-after-free in the Audio/Video component
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Race condition
mozilla · firefoxSep 29, 2026
CVE-2026-100807
35Monitor
Privilege escalation in the DOM: Service Workers component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100808
35Monitor
Mitigation bypass in the DOM: Service Workers component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100809
32Monitor
Same-origin policy bypass in the DevTools component
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100810
39Monitor
Other issue in the DevTools component
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Info leak
mozilla · firefoxSep 29, 2026
CVE-2026-100811
38Monitor
Sandbox escape due to use-after-free in the DOM: Core & HTML component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100813
35Monitor
Invalid pointer in the JavaScript Engine: JIT component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100814
35Monitor
Incorrect boundary conditions in the JavaScript Engine: JIT component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100815
35Monitor
Use-after-free in the CSS Parsing and Computation component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100816
32Monitor
Site isolation issue in the DOM: Networking component
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100818
38Monitor
Sandbox escape due to use-after-free in the Widget: Gtk component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100819
38Monitor
Sandbox escape due to incorrect boundary conditions in the XPCOM component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100820
35Monitor
Privilege escalation in the Address Bar component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100824
35Monitor
Privilege escalation in the Places component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100825
35Monitor
Use-after-free in the JavaScript Engine: JIT component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100828
38Monitor
Mitigation bypass in the Bookmarks & History component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100829
38Monitor
Mitigation bypass in the DOM: Security component
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100830
32Monitor
Mitigation bypass in the DOM: Navigation component
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
mozilla · firefoxSep 29, 2026
CVE-2026-100831
35Monitor
Use-after-free in the DOM: UI Events & Focus Handling component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-100832
35Monitor
Use-after-free in the Graphics: Canvas2D component
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- Memory safety
mozilla · firefoxSep 29, 2026
CVE-2026-102437
31Monitor
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix
HighCVSS 7.8No exploitEPSS 1%
- RCE
- Command injection
esengine · deepseek-reasonixSep 29, 2026
CVE-2026-73598
31Monitor
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Permission Assignment for Critical Res
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
dell · policy manager for secure connect gatewaySep 29, 2026
CVE-2026-7192
37Monitor
Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
shenzhen dbit network equipment · t-cpe301k 4g mini wifi routerSep 29, 2026
CVE-2026-7193
34Monitor
Multiple vulnerabilities in the T-CPE301K 4G Mini WiFi Router from Shenzhen Dbit Network Equipment
HighCVSS 8.6No exploitEPSS 0%
- Hard-coded credentials
shenzhen dbit network equipment · t-cpe301k 4g mini wifi routerSep 29, 2026
CVE-2026-82804
35Monitor
Apache DolphinScheduler: Command Injection in the Alert Script Plugin
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
apache software foundation · apache dolphinschedulerSep 29, 2026
CVE-2026-82973
37Monitor
Improper Neutralization of CRLF Sequences ('CRLF Injection') in docker-mailbox
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
psyb0t · docker-mailboxSep 29, 2026
CVE-2026-102360
34Monitor
lib0 `readUint8Array` performs an unbounded read past the end of the decoder’s view, disclosing adjacent process memory
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Memory safety
dmonad · lib0Sep 29, 2026
CVE-2026-102521
34Monitor
lib0 `readFromDataView` out-of-bounds read
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Memory safety
dmonad · lib0Sep 29, 2026
CVE-2026-4034
34Monitor
TIBCO Administrator Injection Vulnerability
HighCVSS 8.7No exploitEPSS 0%
tibco · administratorSep 29, 2026
CVE-2026-86450
30Monitor
Sensitive Data Exposure in Parla Auto's DetaWix Mobile Web Portal
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
parla auto automotive trading limited company · detawix mobile web portalSep 29, 2026
CVE-2026-97395
32Monitor
Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
apache software foundation · apache polarisSep 29, 2026
CVE-2015-20122
34Monitor
Seeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SQL injection
yonyou · a6 oaSep 29, 2026
CVE-2026-102566
34Monitor
CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Memory safety
opennmt · ctranslate2Sep 29, 2026
CVE-2026-102569
28Monitor
ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter
HighCVSS 7.0No exploitEPSS 0%
- SQL injection
macwarrior · clipbucket-v5Sep 29, 2026
CVE-2026-102570
28Monitor
ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter
HighCVSS 7.0No exploitEPSS 0%
- SQL injection
macwarrior · clipbucket-v5Sep 29, 2026
CVE-2026-22094
37Monitor
Weak root password in EVbee DC 80
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
evbee · dc 80Sep 29, 2026
CVE-2026-49243
38Monitor
Webmin: Reflected XSS in the Configuration module
CriticalCVSS 9.6No exploitEPSS 0%
- Pre-auth
- XSS
webmin · webminSep 29, 2026
CVE-2026-63209
30Monitor
Integer Overflow or Wraparound and Out-of-bounds Write in compress
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
klauspost · compressSep 29, 2026
CVE-2026-65102
31Monitor
NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YA
HighCVSS 7.8No exploitEPSS 0%
- Memory safety
nvidia · deepstreamSep 29, 2026
CVE-2026-68911
34Monitor
Nicotine+: Decompression of peer messages can exhaust available memory
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
nicotine-plus · nicotine-plusSep 29, 2026
CVE-2026-86035
34Monitor
Weblate: Mercurial argument injection via repository filenames allows authenticated command execution
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Command injection
weblateorg · weblateSep 29, 2026
CVE-2023-54400
37Monitor
Fumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- SQL injection
fumasoft · fumeng cloudSep 29, 2026
CVE-2026-100288
28Monitor
Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access
HighCVSS 7.2No exploitEPSS 0%
devolutions · serverSep 29, 2026
CVE-2026-100308
33Monitor
GluonTS arbitrary command execution during model deserialization
HighCVSS 8.4No exploitEPSS 0%
- RCE
- Deserialization
- Local privilege escalation
aws · gluontsSep 29, 2026
CVE-2026-102600
30Monitor
Socket.IO: Prototype Pollution via Unsafe Client Session Lookup
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Prototype pollution
- Denial of service
socketio · socket.ioSep 29, 2026
CVE-2026-19743
31Monitor
Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients
HighCVSS 7.8No exploitEPSS 0%
- Path traversal
- Local privilege escalation
teamviewer · full clientSep 29, 2026
CVE-2026-54873
30Monitor
QUIC STREAM Fragment Metadata DoS
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
openssl · opensslSep 29, 2026
CVE-2026-72897
30Monitor
Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
openssl · opensslSep 29, 2026
CVE-2026-77177
39Monitor
Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prom
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 29, 2026
CVE-2026-84782
32Monitor
DTLS Retransmits Handshake Messages From a Stale Buffer Offset
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
openssl · opensslSep 29, 2026
CVE-2026-84783
30Monitor
Use-After-Free in X.509 Extension Cache Under Concurrent Use
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
openssl · opensslSep 29, 2026
CVE-2026-84784
30Monitor
QUIC: Unbounded RETIRE_CONNECTION_ID Backlog
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
openssl · opensslSep 29, 2026
CVE-2026-92368
31Monitor
Heap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Local privilege escalation
- Memory safety
teamviewer · full clientSep 29, 2026
CVE-2026-92369
29Monitor
Time-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation
HighCVSS 7.3No exploitEPSS 0%
- Local privilege escalation
- Race condition
teamviewer · full clientSep 29, 2026
CVE-2026-92370
35Monitor
Remote Session Access Control Bypass Leading to Remote Code Execution
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
teamviewer · full clientSep 29, 2026
CVE-2026-92371
28Monitor
Local Privilege Escalation via Improper Link Resolution in Cloud Session Recording
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
- Race condition
teamviewer · full clientSep 29, 2026
CVE-2026-97687
30Monitor
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
HighCVSS 7.6No exploitEPSS 0%
- Pre-auth
- Weak crypto
python · urllib3Sep 29, 2026
CVE-2026-97689
35Monitor
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- Denial of service
python · urllib3Sep 29, 2026
CVE-2022-51019
35Monitor
Akaunting before 2.1.31 OS Command Injection via app alias
HighCVSS 8.7No exploitEPSS 1%
- RCE
- Command injection
akaunting · akauntingSep 29, 2026
CVE-2026-100240
36Monitor
TemplateSandbox does not check read permissions for the page being previewed
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
wikimedia foundation · mediawiki - templatesandbox extensionSep 29, 2026
CVE-2026-100241
30Monitor
Private change tags exposed to anonymous users via revision-tags-change events
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
wikimedia foundation · mediawiki - eventbus extensionSep 29, 2026
CVE-2026-100242
30Monitor
DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
wikimedia foundation · mediawiki - datatransfer extensionSep 29, 2026
CVE-2026-100244
30Monitor
CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
wikimedia foundation · mediawiki - centralauth extensionSep 29, 2026
CVE-2026-101127
34Monitor
Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- XSS
balbooa · formsSep 29, 2026
CVE-2026-102424
35Monitor
Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4
HighCVSS 8.9No exploitEPSS 0%
- Pre-auth
- Path traversal
balbooa · formsSep 29, 2026
CVE-2026-102425
38Monitor
Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4
CriticalCVSS 9.5Proof of conceptEPSS 0%
- pre-auth RCE
balbooa · formsSep 29, 2026
CVE-2026-102556
34Monitor
Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
gnome · libsoupSep 29, 2026
CVE-2026-102557
34Monitor
Libsoup: libsoup: heap buffer overflow during websocket message reassembly
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Memory safety
gnome · libsoupSep 29, 2026
CVE-2026-102633
32Monitor
libexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
libexpat · libexpatSep 29, 2026
CVE-2026-102634
34Monitor
SGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
sgl-project · sglangSep 29, 2026
CVE-2026-102675
29Monitor
Electron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
electronjs · electronSep 29, 2026
CVE-2026-102676
39Monitor
Electron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
electronjs · electronSep 29, 2026
CVE-2026-102697
34Monitor
Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
HighCVSS 8.5Proof of conceptEPSS 0%
- Broken access control (IDOR)
ollama · ollamaSep 29, 2026
CVE-2026-102796
30Monitor
Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SQL injection
wikimedia foundation · mediawiki - userpageviewtracker extensionSep 29, 2026
CVE-2026-90907
27Monitor
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
MediumCVSS 6.9Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
joomla · joomla!Sep 29, 2026
CVE-2026-90913
28Monitor
Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
HighCVSS 7.0No exploitEPSS 0%
- Broken access control (IDOR)
joomla · joomla!Sep 29, 2026
CVE-2026-90915
28Monitor
Joomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
HighCVSS 7.0No exploitEPSS 0%
- Path traversal
joomla · joomla!Sep 29, 2026
CVE-2026-92222
35Monitor
Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
HighCVSS 8.9No exploitEPSS 0%
- SSRF
joomla · joomla!Sep 29, 2026
CVE-2026-92226
28Monitor
Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
HighCVSS 7.0No exploitEPSS 0%
- Broken access control (IDOR)
joomla · joomla!Sep 29, 2026
CVE-2026-92227
32Monitor
Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
joomla · joomla!Sep 29, 2026
CVE-2026-92231
28Monitor
Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
HighCVSS 7.1No exploitEPSS 0%
- XSS
joomla · joomla!Sep 29, 2026
CVE-2026-92232
28Monitor
Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
HighCVSS 7.1No exploitEPSS 0%
- XSS
joomla · joomla!Sep 29, 2026
CVE-2026-102242
34Monitor
Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
HighCVSS 8.6No exploitEPSS 0%
- Path traversal
google · mcp toolbox for databasesSep 29, 2026
CVE-2026-102555
32Monitor
Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Memory safety
gnome · libsoupSep 29, 2026
CVE-2026-102558
34Monitor
Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Memory safety
gnome · libsoupSep 29, 2026
CVE-2026-102559
34Monitor
Libsoup: libsoup: heap buffer overflow during websocket client-frame masking
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- Memory safety
gnome · libsoupSep 29, 2026
CVE-2026-102560
39Monitor
Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
gnome · libsoupSep 29, 2026
CVE-2026-102639
28Monitor
MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization
HighCVSS 7.1No exploitEPSS 0%
- Deserialization
mobilitydb · mobilitydbSep 29, 2026
CVE-2026-102677
35Monitor
Electron: Sandboxed preload code cache can be poisoned by a compromised renderer
HighCVSS 8.8No exploitEPSS 0%
- Local privilege escalation
electronjs · electronSep 29, 2026