By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 75 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
33Monitor	CVE-2026-102709No exploit	In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports derefereclipse foundation · threadx · CWE-200 Info leak	High8.4	—	0.1%	Sep 29, 2026
34Monitor	CVE-2026-102710No exploit	In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a user-mode, memory-protececlipse foundation · eclipse-threadx/threadx · CWE-269 Local privilege escalation	High8.5	—	0.0%	Sep 29, 2026
33Monitor	CVE-2026-102713No exploit	Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stalleclipse foundation · netx duo · CWE-125 Pre-auth Memory safety	High8.3	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-102714No exploit	ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option waeclipse foundation · netx duo · CWE-125 Pre-auth Memory safety	High7.1	—	0.1%	Sep 29, 2026
28Monitor	CVE-2026-102715No exploit	mDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packeteclipse foundation · eclipse-threadx/netxduo · CWE-697 Pre-auth	High7.1	—	0.3%	Sep 29, 2026
34Monitor	CVE-2026-102716No exploit	A malformed Session header permanently orphans one packet-pool block per RTSP requesteclipse foundation · eclipse-threadx/netxduo · CWE-401 Pre-auth Denial of service	High8.7	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-102718Proof of concept	Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER lengtheclipse foundation · netx duo · CWE-125 Pre-auth Memory safety	High8.7	—	0.3%	Sep 29, 2026
28Monitor	CVE-2026-102723No exploit	NULL Pointer Dereference on MSRP Attribute Table Exhaustioneclipse foundation · netx duo · CWE-476 Pre-auth Memory safety	High7.1	—	0.1%	Sep 29, 2026
28Monitor	CVE-2026-102724No exploit	NULL pointer dereference when evicting the last MSRP attribute in a participant's listeclipse foundation · netx duo · CWE-476 Pre-auth Memory safety	High7.1	—	0.1%	Sep 29, 2026
28Monitor	CVE-2026-102725No exploit	Out-of-bounds Read from Unvalidated MSRP Attribute List Lengtheclipse foundation · netx duo · CWE-125 Pre-auth Memory safety	High7.1	—	0.1%	Sep 29, 2026
28Monitor	CVE-2026-102726No exploit	Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Readeclipse foundation · netx duo · CWE-125 Pre-auth Memory safety	High7.1	—	0.1%	Sep 29, 2026
34Monitor	CVE-2026-102730No exploit	Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelXeclipse foundation · eclipse-threadx/levelx(nand driver) · CWE-787 Memory safety	High8.6	—	0.1%	Sep 29, 2026
34Monitor	CVE-2026-102757No exploit	An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode,eclipse foundation · threadx · CWE-125 Local privilege escalation Memory safety	High8.5	—	0.1%	Sep 29, 2026
30Monitor	CVE-2026-102758No exploit	The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data.eclipse foundation · netx duo · CWE-126 Pre-auth Denial of service	High7.5	—	0.1%	Sep 29, 2026
33Monitor	CVE-2026-102760No exploit	When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP.eclipse foundation · netx duo · CWE-416 Pre-auth Memory safety	High8.3	—	0.2%	Sep 29, 2026
37Monitor	CVE-2026-102761No exploit	NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the leclipse foundation · netx duo · CWE-787 Pre-auth Memory safety	Critical9.3	—	0.2%	Sep 29, 2026
32Monitor	CVE-2026-102762No exploit	The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message.eclipse foundation · netx duo · CWE-401 Pre-auth Denial of service	High8.2	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-102808No exploit	PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stresspx4 · px4-autopilot · CWE-476 Pre-auth Memory safety	High7.1	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-102809No exploit	PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Commandpx4 · px4-autopilot · CWE-789 Pre-auth	High7.1	—	0.4%	Sep 29, 2026
34Monitor	CVE-2026-102810No exploit	Marmite through 0.4.2 Path Traversal via Development Serverrochacbruno · marmite · CWE-22 Pre-auth Path traversal	High8.7	—	0.3%	Sep 29, 2026
34Monitor	CVE-2026-102811No exploit	Marmite through 0.4.2 Unauthenticated API Access via Development Serverrochacbruno · marmite · CWE-306 Pre-auth Auth bypass Path traversal	High8.7	—	0.6%	Sep 29, 2026
23Monitor	CVE-2026-12345Proof of concept	Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directorypython software foundation · cpython · CWE-59 Local privilege escalation Race condition	Medium5.9	—	0.3%	Sep 29, 2026
31Monitor	CVE-2026-84414No exploit	IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []ibm · i · CWE-732	High7.8	—	0.0%	Sep 29, 2026
35Monitor	CVE-2026-84421No exploit	DataStage on Cloud Pak for Data has several vulnerabilitiesibm · datastage on cloud pak for data · CWE-22 RCE Path traversal	High8.8	—	0.5%	Sep 29, 2026
28Monitor	CVE-2026-84422No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilities.ibm · guardium data protection · CWE-78 RCE Command injection	High7.2	—	0.6%	Sep 29, 2026
36Monitor	CVE-2026-84436No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilities.ibm · guardium data protection · CWE-78 RCE Command injection	Critical9.1	—	0.6%	Sep 29, 2026
35Monitor	CVE-2026-84440No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilities.ibm · guardium data protection · CWE-78 RCE Command injection	High8.8	—	0.7%	Sep 29, 2026
32Monitor	CVE-2026-84842No exploit	IBM Guardium Data Protection is affected by multiple vulnerabilities.ibm · guardium data protection · CWE-22 Path traversal	High8.1	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-94954No exploit	A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030.CWE-121 Memory safety	High8.8	—	0.3%	Sep 29, 2026
33Monitor	CVE-2026-95274No exploit	Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-116 pre-auth RCE	High8.3	—	0.3%	Sep 29, 2026
33Monitor	CVE-2026-95276No exploit	Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer procegoogle · chrome · CWE-20 pre-auth RCE	High8.3	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-95277No exploit	Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
33Monitor	CVE-2026-95278No exploit	Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer processgoogle · chrome · CWE-862 Broken access control (IDOR)	High8.4	—	0.2%	Sep 29, 2026
30Monitor	CVE-2026-95280No exploit	Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-362 pre-auth RCE Race condition	High7.5	—	0.2%	Sep 29, 2026
38Monitor	CVE-2026-95281No exploit	Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside tgoogle · chrome · CWE-122 pre-auth RCE Memory safety	Critical9.6	—	0.5%	Sep 29, 2026
35Monitor	CVE-2026-95282No exploit	Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vigoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-95283No exploit	Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary codgoogle · chrome · CWE-122 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-95284No exploit	Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside tgoogle · chrome · CWE-122 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 29, 2026
33Monitor	CVE-2026-95285No exploit	Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the rengoogle · chrome · CWE-862 Broken access control (IDOR)	High8.4	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-95286No exploit	Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vigoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.3%	Sep 29, 2026
21Monitor	CVE-2026-95291No exploit	UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar google · chrome · CWE-451 Pre-auth	Medium5.4	—	0.2%	Sep 29, 2026
31Monitor	CVE-2026-95298No exploit	Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside thegoogle · chrome · CWE-416 RCE Memory safety	High7.8	—	0.1%	Sep 29, 2026
38Monitor	CVE-2026-95299No exploit	Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
32Monitor	CVE-2026-95301No exploit	Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer procegoogle · chrome · CWE-862 Pre-auth Broken access control (IDOR)	High8.1	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-95304No exploit	Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox viagoogle · chrome · CWE-787 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-95306No exploit	Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-95310No exploit	Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox vgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 29, 2026
38Monitor	CVE-2026-95311No exploit	Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentiagoogle · chrome · CWE-590 pre-auth RCE	Critical9.6	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-95313No exploit	Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outsidegoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 29, 2026
32Monitor	CVE-2026-95314No exploit	Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process togoogle · chrome · CWE-863 Pre-auth Broken access control (IDOR)	High8.1	—	0.2%	Sep 29, 2026
31Monitor	CVE-2026-95315No exploit	Use after free in Aura in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sagoogle · chrome · CWE-416 RCE Memory safety	High7.8	—	0.1%	Sep 29, 2026
38Monitor	CVE-2026-95318No exploit	Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside thegoogle · chrome · CWE-122 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
33Monitor	CVE-2026-95319No exploit	Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.2%	Sep 29, 2026
33Monitor	CVE-2026-95322No exploit	Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer google · chrome · CWE-787 pre-auth RCE Memory safety	High8.3	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-95325No exploit	Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
33Monitor	CVE-2026-95326No exploit	Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass sygoogle · chrome · CWE-459	High8.4	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-95329No exploit	Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrargoogle · chrome · CWE-787 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 29, 2026
38Monitor	CVE-2026-95331No exploit	Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outsidegoogle · chrome · CWE-787 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
32Monitor	CVE-2026-95333No exploit	Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox vigoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.1	—	0.3%	Sep 29, 2026
33Monitor	CVE-2026-95334No exploit	Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the rendegoogle · chrome · CWE-706 pre-auth RCE	High8.3	—	0.3%	Sep 29, 2026
33Monitor	CVE-2026-95335No exploit	Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentiagoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-95338No exploit	Use after free in PDFium in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via google · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Sep 29, 2026
38Monitor	CVE-2026-95339No exploit	Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 29, 2026
33Monitor	CVE-2026-95341No exploit	Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer procgoogle · chrome · CWE-20 pre-auth RCE	High8.3	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-95343No exploit	Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vigoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 29, 2026
32Monitor	CVE-2026-95344No exploit	Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site isgoogle · chrome · CWE-367 Pre-auth Race condition	High8.0	—	0.1%	Sep 29, 2026
35Monitor	CVE-2026-95345No exploit	Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via agoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.3%	Sep 29, 2026
38Monitor	CVE-2026-95347No exploit	Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the google · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.3%	Sep 29, 2026
33Monitor	CVE-2026-95348No exploit	Use after free in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to pogoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.2%	Sep 29, 2026
38Monitor	CVE-2026-95349No exploit	Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary cogoogle · chrome · CWE-122 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 29, 2026
38Monitor	CVE-2026-95350No exploit	Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside tgoogle · chrome · CWE-122 pre-auth RCE Memory safety	Critical9.6	—	0.5%	Sep 29, 2026
33Monitor	CVE-2026-95351No exploit	Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to executgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-95353No exploit	Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vigoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Sep 29, 2026
33Monitor	CVE-2026-95354No exploit	Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.2%	Sep 29, 2026
33Monitor	CVE-2026-95355No exploit	Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker who had compromised the regoogle · chrome · CWE-863 pre-auth RCE Broken access control (IDOR)	High8.3	—	0.2%	Sep 29, 2026
38Monitor	CVE-2026-95356No exploit	Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentiallgoogle · chrome · CWE-416 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 29, 2026
38Monitor	CVE-2026-95357No exploit	Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary google · chrome · CWE-787 pre-auth RCE Memory safety	Critical9.6	—	0.4%	Sep 29, 2026
35Monitor	CVE-2026-95362No exploit	Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bygoogle · chrome · CWE-352 Pre-auth CSRF	High8.8	—	0.1%	Sep 29, 2026
35Monitor	CVE-2026-95365No exploit	Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside tgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.3%	Sep 29, 2026
35Monitor	CVE-2026-95369No exploit	Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code google · chrome · CWE-841 pre-auth RCE	High8.8	—	0.2%	Sep 29, 2026
33Monitor	CVE-2026-95372No exploit	Use after free in Chromecast in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to pgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.3	—	0.2%	Sep 29, 2026
35Monitor	CVE-2026-95373No exploit	Use after free in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to execute arbitrgoogle · chrome · CWE-416 pre-auth RCE Memory safety	High8.8	—	0.2%	Sep 29, 2026
32Monitor	CVE-2026-95376No exploit	Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineerigoogle · chrome · CWE-610 Pre-auth	High8.0	—	0.1%	Sep 29, 2026
35Monitor	CVE-2026-95380No exploit	Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute google · chrome · CWE-843 pre-auth RCE	High8.8	—	0.2%	Sep 29, 2026
33Monitor	CVE-2026-95381No exploit	Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer progoogle · chrome · CWE-20 pre-auth RCE	High8.3	—	0.2%	Sep 29, 2026
30Monitor	CVE-2026-102823No exploit	russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never openedeugeny · russh · CWE-20 Pre-auth	High7.5	—	0.3%	Sep 29, 2026
32Monitor	CVE-2026-102826Proof of concept	simple-git allows command execution through unblocked Git configuration includessimple-git project · simple-git · CWE-77 pre-auth RCE Command injection	High8.1	—	0.4%	Sep 29, 2026
39Monitor	CVE-2026-102827Proof of concept	simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)simple-git project · simple-git · CWE-77 pre-auth RCE Command injection	Critical9.8	—	0.5%	Sep 29, 2026
36Monitor	CVE-2026-102828No exploit	simple-git unsafe-operation guard does not block trailer command configurationsimple-git project · simple-git · CWE-78 pre-auth RCE Command injection	Critical9.2	—	0.3%	Sep 29, 2026
36Monitor	CVE-2026-102829No exploit	simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detectionsteveukx · git-js · CWE-78 pre-auth RCE Command injection	Critical9.2	—	0.3%	Sep 29, 2026
32Monitor	CVE-2026-102831No exploit	JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboardjupyterlab · jupyterlab · CWE-79 Pre-auth XSS	High8.1	—	0.2%	Sep 29, 2026
39Monitor	CVE-2024-31026No exploit	An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat iCWE-94 pre-auth RCE	Critical9.8	—	0.7%	Sep 29, 2026
37Monitor	CVE-2026-100291No exploit	Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5anjvision · yssd-rtmp-h5 · CWE-1188 Pre-auth	Critical9.3	—	0.3%	Sep 29, 2026
34Monitor	CVE-2026-100292No exploit	Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5anjvision · yssd-rtmp-h5 · CWE-78 RCE Command injection	High8.7	—	0.2%	Sep 29, 2026
34Monitor	CVE-2026-100293No exploit	Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5anjvision · yssd-rtmp-h5 · CWE-347 Weak crypto	High8.7	—	0.1%	Sep 29, 2026
34Monitor	CVE-2026-100294No exploit	Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5anjvision · yssd-rtmp-h5 · CWE-798 Pre-auth Hard-coded credentials	High8.7	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-100296No exploit	Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5anjvision · yssd-rtmp-h5 · CWE-754	High7.2	—	0.3%	Sep 29, 2026
34Monitor	CVE-2026-100298No exploit	Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5anjvision · yssd-rtmp-h5 · CWE-522 Info leak	High8.7	—	0.2%	Sep 29, 2026
28Monitor	CVE-2026-100299No exploit	Use of Weak Credentials in Anjvision YSSD-RTMP-H5anjvision · yssd-rtmp-h5 · CWE-1391	High7.0	—	0.0%	Sep 29, 2026
35Monitor	CVE-2026-102299No exploit	Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-843 pre-auth RCE	High8.8	—	0.4%	Sep 29, 2026

CVE-2026-102709
33Monitor
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports derefer
HighCVSS 8.4No exploitEPSS 0%
- Info leak
eclipse foundation · threadxSep 29, 2026
CVE-2026-102710
34Monitor
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a user-mode, memory-protec
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
eclipse foundation · eclipse-threadx/threadxSep 29, 2026
CVE-2026-102713
33Monitor
Unbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · netx duoSep 29, 2026
CVE-2026-102714
28Monitor
ICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option wa
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · netx duoSep 29, 2026
CVE-2026-102715
28Monitor
mDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packet
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
eclipse foundation · eclipse-threadx/netxduoSep 29, 2026
CVE-2026-102716
34Monitor
A malformed Session header permanently orphans one packet-pool block per RTSP request
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
eclipse foundation · eclipse-threadx/netxduoSep 29, 2026
CVE-2026-102718
34Monitor
Out-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length
HighCVSS 8.7Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · netx duoSep 29, 2026
CVE-2026-102723
28Monitor
NULL Pointer Dereference on MSRP Attribute Table Exhaustion
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · netx duoSep 29, 2026
CVE-2026-102724
28Monitor
NULL pointer dereference when evicting the last MSRP attribute in a participant's list
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · netx duoSep 29, 2026
CVE-2026-102725
28Monitor
Out-of-bounds Read from Unvalidated MSRP Attribute List Length
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · netx duoSep 29, 2026
CVE-2026-102726
28Monitor
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · netx duoSep 29, 2026
CVE-2026-102730
34Monitor
Out-of-bounds Write via NAND Metadata Parsing at Mount in LevelX
HighCVSS 8.6No exploitEPSS 0%
- Memory safety
eclipse foundation · eclipse-threadx/levelx(nand driver)Sep 29, 2026
CVE-2026-102757
34Monitor
An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged mode,
HighCVSS 8.5No exploitEPSS 0%
- Local privilege escalation
- Memory safety
eclipse foundation · threadxSep 29, 2026
CVE-2026-102758
30Monitor
The `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks out of DER-encoded data.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
eclipse foundation · netx duoSep 29, 2026
CVE-2026-102760
33Monitor
When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP.
HighCVSS 8.3No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · netx duoSep 29, 2026
CVE-2026-102761
37Monitor
NetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the l
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Memory safety
eclipse foundation · netx duoSep 29, 2026
CVE-2026-102762
32Monitor
The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message.
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
eclipse foundation · netx duoSep 29, 2026
CVE-2026-102808
28Monitor
PX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
px4 · px4-autopilotSep 29, 2026
CVE-2026-102809
28Monitor
PX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
px4 · px4-autopilotSep 29, 2026
CVE-2026-102810
34Monitor
Marmite through 0.4.2 Path Traversal via Development Server
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
rochacbruno · marmiteSep 29, 2026
CVE-2026-102811
34Monitor
Marmite through 0.4.2 Unauthenticated API Access via Development Server
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Path traversal
rochacbruno · marmiteSep 29, 2026
CVE-2026-12345
23Monitor
Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory
MediumCVSS 5.9Proof of conceptEPSS 0%
- Local privilege escalation
- Race condition
python software foundation · cpythonSep 29, 2026
CVE-2026-84414
31Monitor
IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []
HighCVSS 7.8No exploitEPSS 0%
ibm · iSep 29, 2026
CVE-2026-84421
35Monitor
DataStage on Cloud Pak for Data has several vulnerabilities
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Path traversal
ibm · datastage on cloud pak for dataSep 29, 2026
CVE-2026-84422
28Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities.
HighCVSS 7.2No exploitEPSS 0%
- RCE
- Command injection
ibm · guardium data protectionSep 29, 2026
CVE-2026-84436
36Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities.
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Command injection
ibm · guardium data protectionSep 29, 2026
CVE-2026-84440
35Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities.
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
ibm · guardium data protectionSep 29, 2026
CVE-2026-84842
32Monitor
IBM Guardium Data Protection is affected by multiple vulnerabilities.
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
ibm · guardium data protectionSep 29, 2026
CVE-2026-94954
35Monitor
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030.
HighCVSS 8.8No exploitEPSS 0%
- Memory safety
Sep 29, 2026
CVE-2026-95274
33Monitor
Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proc
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-95276
33Monitor
Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proce
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-95277
38Monitor
Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95278
33Monitor
Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process
HighCVSS 8.4No exploitEPSS 0%
- Broken access control (IDOR)
google · chromeSep 29, 2026
CVE-2026-95280
30Monitor
Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Race condition
google · chromeSep 29, 2026
CVE-2026-95281
38Monitor
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside t
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95282
35Monitor
Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vi
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95283
38Monitor
Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary cod
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95284
38Monitor
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside t
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95285
33Monitor
Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the ren
HighCVSS 8.4No exploitEPSS 0%
- Broken access control (IDOR)
google · chromeSep 29, 2026
CVE-2026-95286
35Monitor
Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vi
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-95291
21Monitor
UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar
MediumCVSS 5.4No exploitEPSS 0%
- Pre-auth
google · chromeSep 29, 2026
CVE-2026-95298
31Monitor
Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95299
38Monitor
Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95301
32Monitor
Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proce
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 29, 2026
CVE-2026-95304
35Monitor
Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95306
35Monitor
Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-95310
38Monitor
Use after free in AdFilter in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox v
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95311
38Monitor
Free of non-heap memory in Fonts in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentia
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-95313
38Monitor
Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95314
32Monitor
Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
google · chromeSep 29, 2026
CVE-2026-95315
31Monitor
Use after free in Aura in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sa
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95318
38Monitor
Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95319
33Monitor
Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to pot
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95322
33Monitor
Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95325
38Monitor
Use after free in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95326
33Monitor
Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass sy
HighCVSS 8.4No exploitEPSS 0%
google · chromeSep 29, 2026
CVE-2026-95329
38Monitor
Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrar
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95331
38Monitor
Out of bounds write in ANGLE in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95333
32Monitor
Use after free in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox vi
HighCVSS 8.1No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95334
33Monitor
Incorrect reference resolution in WebProtect in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the rende
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-95335
33Monitor
Use after free in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentia
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95338
35Monitor
Use after free in PDFium in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95339
38Monitor
Use after free in ServiceWorker in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sand
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95341
33Monitor
Improper input validation in Desktop in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proc
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-95343
35Monitor
Use after free in WebAudio in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vi
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95344
32Monitor
Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site is
HighCVSS 8.0No exploitEPSS 0%
- Pre-auth
- Race condition
google · chromeSep 29, 2026
CVE-2026-95345
35Monitor
Use after free in Actor in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95347
38Monitor
Use after free in Updater in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95348
33Monitor
Use after free in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to po
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95349
38Monitor
Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary co
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95350
38Monitor
Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside t
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95351
33Monitor
Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execut
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95353
35Monitor
Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vi
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95354
33Monitor
Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to pot
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95355
33Monitor
Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker who had compromised the re
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
google · chromeSep 29, 2026
CVE-2026-95356
38Monitor
Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentiall
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95357
38Monitor
Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary
CriticalCVSS 9.6No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95362
35Monitor
Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to by
HighCVSS 8.8No exploitEPSS 0%
- Pre-auth
- CSRF
google · chromeSep 29, 2026
CVE-2026-95365
35Monitor
Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside t
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-95369
35Monitor
Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-95372
33Monitor
Use after free in Chromecast in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to p
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95373
35Monitor
Use after free in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to execute arbitr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
- Memory safety
google · chromeSep 29, 2026
CVE-2026-95376
32Monitor
Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineeri
HighCVSS 8.0No exploitEPSS 0%
- Pre-auth
google · chromeSep 29, 2026
CVE-2026-95380
35Monitor
Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-95381
33Monitor
Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer pro
HighCVSS 8.3No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026
CVE-2026-102823
30Monitor
russh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
eugeny · russhSep 29, 2026
CVE-2026-102826
32Monitor
simple-git allows command execution through unblocked Git configuration includes
HighCVSS 8.1Proof of conceptEPSS 0%
- pre-auth RCE
- Command injection
simple-git project · simple-gitSep 29, 2026
CVE-2026-102827
39Monitor
simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- Command injection
simple-git project · simple-gitSep 29, 2026
CVE-2026-102828
36Monitor
simple-git unsafe-operation guard does not block trailer command configuration
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- Command injection
simple-git project · simple-gitSep 29, 2026
CVE-2026-102829
36Monitor
simple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- Command injection
steveukx · git-jsSep 29, 2026
CVE-2026-102831
32Monitor
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
HighCVSS 8.1No exploitEPSS 0%
- Pre-auth
- XSS
jupyterlab · jupyterlabSep 29, 2026
CVE-2024-31026
39Monitor
An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat i
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
Sep 29, 2026
CVE-2026-100291
37Monitor
Initialization of a resource with an insecure default in Anjvision YSSD-RTMP-H5
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
anjvision · yssd-rtmp-h5Sep 29, 2026
CVE-2026-100292
34Monitor
Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Command injection
anjvision · yssd-rtmp-h5Sep 29, 2026
CVE-2026-100293
34Monitor
Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5
HighCVSS 8.7No exploitEPSS 0%
- Weak crypto
anjvision · yssd-rtmp-h5Sep 29, 2026
CVE-2026-100294
34Monitor
Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Hard-coded credentials
anjvision · yssd-rtmp-h5Sep 29, 2026
CVE-2026-100296
28Monitor
Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5
HighCVSS 7.2No exploitEPSS 0%
anjvision · yssd-rtmp-h5Sep 29, 2026
CVE-2026-100298
34Monitor
Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5
HighCVSS 8.7No exploitEPSS 0%
- Info leak
anjvision · yssd-rtmp-h5Sep 29, 2026
CVE-2026-100299
28Monitor
Use of Weak Credentials in Anjvision YSSD-RTMP-H5
HighCVSS 7.0No exploitEPSS 0%
anjvision · yssd-rtmp-h5Sep 29, 2026
CVE-2026-102299
35Monitor
Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
HighCVSS 8.8No exploitEPSS 0%
- pre-auth RCE
google · chromeSep 29, 2026