By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 79 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
31Monitor	CVE-2026-47552No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass an authorizatinvidia · geforce · CWE-862 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47553No exploit	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an nvidia · geforce · CWE-787 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-47554No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signaturenvidia · geforce · CWE-347 Weak crypto	High7.1	—	0.0%	Sep 30, 2026
31Monitor	CVE-2026-47556No exploit	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an nvidia · geforce · CWE-190 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47558No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free onvidia · geforce · CWE-415 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47559No exploit	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could access memory belonginnvidia · geforce · CWE-862 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47560No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a use-after-frenvidia · geforce · CWE-416 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47561No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validatnvidia · geforce · CWE-787 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47563No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a NULL pointer dereference.nvidia · geforce · CWE-476 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47569No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a type confusion via a handlenvidia · geforce · CWE-843 Local privilege escalation	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47570No exploit	NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from nvidia · geforce · CWE-427 Local privilege escalation	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47571No exploit	NVIDIA GPU Display Driver for Windows contains a vulnerability in kernel-mode escape handling where an attacker with local access could bypanvidia · geforce · CWE-863 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47572No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause type confusion.nvidia · geforce · CWE-843 Local privilege escalation	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47573No exploit	NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-bounds write.nvidia · geforce · CWE-787 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47574No exploit	NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker could cause incorrect resource transfer between spheresnvidia · virtual gpu manager · CWE-669 Local privilege escalation	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47575No exploit	NVIDIA GPU Display Driver for Windows contains a vulnerability in the display driver DIAG escape handler where a local unprivileged attackernvidia · geforce · CWE-787 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
30Monitor	CVE-2026-47576No exploit	NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module through which an attacker might initiate an out-of-boundnvidia · geforce · CWE-125 Memory safety	High7.7	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47577No exploit	NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an incorrect comparison.nvidia · geforce · CWE-190 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47578No exploit	NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect buffer sinvidia · geforce · CWE-131 Local privilege escalation	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47579No exploit	The NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode driver through which a user might trigger a use-after-nvidia · geforce · CWE-416 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
29Monitor	CVE-2026-47580No exploit	NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization isnvidia · geforce · CWE-862 Broken access control (IDOR)	High7.3	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-47582No exploit	NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an out-of-bounds write.nvidia · geforce · CWE-787 Local privilege escalation Memory safety	High7.0	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47583No exploit	NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause type confusion.nvidia · geforce · CWE-843 Local privilege escalation	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47585No exploit	NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an integer underflow.nvidia · geforce · CWE-191 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47587No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free.nvidia · rtx, quadro, nvs · CWE-416 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47588No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free condition by issuing a nvidia · rtx, quadro, nvs · CWE-416 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47589No exploit	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by nvidia · geforce · CWE-416 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47590No exploit	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by nvidia · geforce · CWE-416 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47591No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memonvidia · geforce · CWE-863 Local privilege escalation Broken access control (IDOR)	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47592No exploit	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an nvidia · geforce · CWE-125 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47593No exploit	NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an unprivileged user can cause an out-of-boundnvidia · geforce · CWE-121 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47594No exploit	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by nvidia · geforce · CWE-416 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47595No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memonvidia · geforce · CWE-281 Local privilege escalation	High7.8	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-47596No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memonvidia · geforce · CWE-281	High7.0	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47597No exploit	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module Resource Server where an unprivilenvidia · geforce · CWE-416 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-47598No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module event delivery path where an unprivileged locanvidia · geforce · CWE-416 Local privilege escalation Memory safety	High7.0	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47599No exploit	NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module where an unprivileged local user could cause invidia · geforce · CWE-281 Local privilege escalation	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47600No exploit	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an error-handling path could operatenvidia · geforce · CWE-908 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
31Monitor	CVE-2026-47601No exploit	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module DMA-BUF import path where an unprinvidia · geforce · CWE-787 Local privilege escalation Memory safety	High7.8	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-47602No exploit	NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user can cause the driver tnvidia · geforce · CWE-119 Memory safety	High7.1	—	0.1%	Sep 30, 2026
82Now	CVE-2026-102489Weaponized	Undisclosed RCE in Zammad v6.3 and higherzammad · zammad · CWE-384 pre-auth RCE	Critical9.4	KEV	49.9%	Sep 30, 2026
70This week	CVE-2026-102490Weaponized	Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM packagezammad · zammad · CWE-269 Pre-auth	Critical9.4	KEV	10.9%	Sep 30, 2026
36Monitor	CVE-2026-19445Proof of concept	Use-after-free of a server-side SSLContext when sni_callback switches contextspython software foundation · cpython · CWE-416 Pre-auth Memory safety	Critical9.2	—	0.5%	Sep 30, 2026
30Monitor	CVE-2026-19553Proof of concept	SSLContext.wrap_bio() missing validation of server_hostname parameterpython software foundation · cpython · CWE-297 Pre-auth Weak crypto	High7.6	—	0.5%	Sep 30, 2026
33Monitor	CVE-2026-46711No exploit	Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private networksoft-machine-io · security · CWE-306 Auth bypass	High8.3	—	0.2%	Sep 30, 2026
36Monitor	CVE-2026-55176No exploit	Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer tokensoft-machine-io · security · CWE-863 Auth bypass Broken access control (IDOR)	Critical9.0	—	0.2%	Sep 30, 2026
30Monitor	CVE-2026-55177No exploit	CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guarddfpc-coe · cloudtak · CWE-918 SSRF	High7.6	—	0.3%	Sep 30, 2026
37Monitor	CVE-2026-55181No exploit	Tugtainer: OIDC login remains accessible when OIDC_ENABLED is falsequenary · tugtainer · CWE-284 Pre-auth Broken access control (IDOR)	Critical9.4	—	0.5%	Sep 30, 2026
39Monitor	CVE-2026-55494Proof of concept	Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unsetquenary · tugtainer · CWE-284 Pre-auth Auth bypass Broken access control (IDOR)	Critical9.8	—	0.6%	Sep 30, 2026
36Monitor	CVE-2026-62308No exploit	Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpointquenary · tugtainer · CWE-918 SSRF	Critical9.1	—	0.3%	Sep 30, 2026
36Monitor	CVE-2026-75969No exploit	PTZOptics Missing Authentication in Firmware Uploadptzoptics · move 4k 12x · CWE-306 Pre-auth Auth bypass	Critical9.1	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-100510No exploit	WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerabilityboldgrid · post and page builder by boldgrid · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
39Monitor	CVE-2026-100512No exploit	WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerabilityhook & filter · nested pages · CWE-502 Pre-auth Deserialization	Critical9.8	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-102376No exploit	WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerabilitywpmu dev · branda · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
35Monitor	CVE-2026-102377No exploit	WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability10web · photo gallery by 10web · CWE-502 Deserialization	High8.8	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-102391No exploit	WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerabilityjetmonsters · jetformbuilder · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-102392No exploit	WordPress Extra Product Options For WooCommerce \| Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerabilitythemehigh · extra product options for woocommerce \| custom product addons and fields · CWE-502 Deserialization	High7.2	—	0.2%	Sep 30, 2026
4Monitor	CVE-2026-103437Proof of concept	ReadingLists imported metadata permits JavaScript URL XSSthe wikimedia foundation · mediawiki readinglists extension · CWE-80 XSS	Low1.1	—	0.3%	Sep 30, 2026
4Monitor	CVE-2026-103440Proof of concept	pagetriagelist discloses suppressed reviewer usernamesthe wikimedia foundation · mediawiki pagetriage extension · CWE-202	Low1.2	—	0.2%	Sep 30, 2026
4Monitor	CVE-2026-103445Proof of concept	Stored XSS through PageForms #autoedit redirect linksthe wikimedia foundation · mediawiki page_forms extension · CWE-80 XSS	Low1.2	—	0.3%	Sep 30, 2026
29Monitor	CVE-2026-103446Proof of concept	WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragmentsthe wikimedia foundation · mediawiki wikilambda extension · CWE-639 Auth bypass Broken access control (IDOR)	High7.4	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-103471No exploit	restbed through 5.0.0 Denial of Service via Unbounded Header Bufferingcorvusoft · restbed · CWE-770 Pre-auth Denial of service	High8.7	—	0.5%	Sep 30, 2026
34Monitor	CVE-2026-103472No exploit	restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Bufferingcorvusoft · restbed · CWE-770 Pre-auth Denial of service	High8.7	—	0.4%	Sep 30, 2026
36Monitor	CVE-2026-103473No exploit	Deno 2.7.0 through 2.9.7 Command Injection via node:child_processdenoland · deno · CWE-78 pre-auth RCE Command injection	Critical9.2	—	1.4%	Sep 30, 2026
34Monitor	CVE-2026-103474No exploit	yii2-starter-kit through 4.2.0 Unrestricted File Upload RCEyii2-starter-kit · yii2-starter-kit · CWE-434 RCE File upload	High8.7	—	0.3%	Sep 30, 2026
37Monitor	CVE-2026-103475No exploit	yii2-starter-kit through 4.2.0 Debug and Gii Module Exposureyii2-starter-kit · yii2-starter-kit · CWE-489 Pre-auth	Critical9.3	—	0.3%	Sep 30, 2026
31Monitor	CVE-2026-53605No exploit	Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grantpollen-robotics · reachy-mini-os · CWE-250 Local privilege escalation	High7.8	—	0.1%	Sep 30, 2026
34Monitor	CVE-2026-55094No exploit	Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)taskcluster · taskcluster · CWE-20 pre-auth RCE	High8.7	—	0.4%	Sep 30, 2026
40Plan	CVE-2026-55107No exploit	Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)elct9620 · kobako · CWE-94 pre-auth RCE	Critical10.0	—	0.7%	Sep 30, 2026
34Monitor	CVE-2026-55224Proof of concept	MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstallmineadmin · mineadmin · CWE-22 pre-auth RCE Path traversal	High8.7	—	1.3%	Sep 30, 2026
32Monitor	CVE-2026-87004Proof of concept	Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verificationquenary · tugtainer · CWE-347 Pre-auth Weak crypto	High8.1	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-94171No exploit	WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerabilityvillatheme · curcy · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
28Monitor	CVE-2026-97256No exploit	WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerabilitygreg – siteorigin · page builder by siteorigin · CWE-502 Deserialization	High7.2	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-97290No exploit	WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerabilitysayontan sinha · photonic gallery & lightbox for flickr, smugmug & others · CWE-79 Pre-auth XSS	High7.1	—	0.1%	Sep 30, 2026
35Monitor	CVE-2026-97291No exploit	WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerabilitymagazine3 · schema & structured data for wp & amp · CWE-502 Deserialization	High8.8	—	0.2%	Sep 30, 2026
28Monitor	CVE-2026-101879No exploit	OpenClaw Windows Node before 2026.7.1-3 Missing Authorizationopenclaw · openclaw windows node · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-101880No exploit	OpenClaw Windows Node before 2026.7.1 Authorization Bypassopenclaw · openclaw windows node · CWE-863 RCE Broken access control (IDOR)	High8.7	—	0.6%	Sep 30, 2026
28Monitor	CVE-2026-101881No exploit	OpenClaw Windows Node before 2026.7.1 Denial of Serviceopenclaw · openclaw windows node · CWE-770 Denial of service	High7.1	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-101882No exploit	OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.setopenclaw · openclaw windows node · CWE-184 RCE	High8.7	—	0.6%	Sep 30, 2026
30Monitor	CVE-2026-101884No exploit	OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Overrideopenclaw · openclaw windows node · CWE-184 RCE	High7.7	—	0.4%	Sep 30, 2026
34Monitor	CVE-2026-101885No exploit	ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_pathzeroclaw-labs · zeroclaw · CWE-22 Path traversal	High8.5	—	0.2%	Sep 30, 2026
32Monitor	CVE-2026-102990No exploit	basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)patrickjuchli · basic-ftp · CWE-1333 Pre-auth Denial of service	High8.2	—	0.3%	Sep 30, 2026
36Monitor	CVE-2026-102992No exploit	piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / envpiscinajs · piscina · CWE-1321 pre-auth RCE Prototype pollution	Critical9.2	—	0.5%	Sep 30, 2026
34Monitor	CVE-2026-102993No exploit	pypdf: Possible large memory usage when retrieving Roman page labelspy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-102994No exploit	pypdf: Possible long runtimes/large memory usage when parsing indirect objectspy-pdf · pypdf · CWE-400 Pre-auth Denial of service	High8.7	—	0.3%	Sep 30, 2026
8Monitor	CVE-2026-103387No exploit	garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exceptiongarycourt · uri-js · CWE-248 Pre-auth	Low2.1	—	0.3%	Sep 30, 2026
36Monitor	CVE-2026-103547No exploit	In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP chopenbsd · openbsd · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.2	—	0.3%	Sep 30, 2026
34Monitor	CVE-2023-54402No exploit	iDocView SSRF via /doc/upload Endpoint Hardcoded Tokenidocview · idocview · CWE-918 Pre-auth Auth bypass SSRF	High8.7	—	0.4%	Sep 30, 2026
34Monitor	CVE-2023-54403No exploit	Yonyou U8 CRM Arbitrary File Read via getemaildata.phpyonyou · u8 crm · CWE-22 Pre-auth Auth bypass Path traversal	High8.7	—	0.4%	Sep 30, 2026
34Monitor	CVE-2024-58387No exploit	Inspur HCM Cloud Arbitrary File Read via file/download Endpointinspur · haiyue hcm cloud · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Sep 30, 2026
36Monitor	CVE-2026-101276No exploit	iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees sesnet · iperf3 · CWE-416 Pre-auth Memory safety	Critical9.2	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-102089No exploit	Kiteworks Email Protection Gateway path traversalaccellion · kiteworks · CWE-22 RCE Path traversal	High7.2	—	1.5%	Sep 30, 2026
30Monitor	CVE-2026-102091No exploit	Kiteworks Secure Data Forms server-side request forgeryaccellion · kiteworks · CWE-918 Pre-auth SSRF	High7.5	—	0.3%	Sep 30, 2026
34Monitor	CVE-2026-102092No exploit	Kiteworks Core stored XSSaccellion · kiteworks · CWE-79 XSS	High8.7	—	0.3%	Sep 30, 2026
28Monitor	CVE-2026-102093No exploit	Kiteworks Core improper privilege managementaccellion · kiteworks · CWE-269	High7.2	—	1.0%	Sep 30, 2026
28Monitor	CVE-2026-102094No exploit	Kiteworks Email Protection Gateway unsafe reflectionaccellion · kiteworks · CWE-470	High7.2	—	1.4%	Sep 30, 2026
36Monitor	CVE-2026-102095No exploit	Kiteworks Email Protection Gateway server-side request forgeryaccellion · kiteworks · CWE-918 Pre-auth SSRF	Critical9.1	—	0.4%	Sep 30, 2026
29Monitor	CVE-2026-102096No exploit	Kiteworks Core OS command injectionaccellion · kiteworks · CWE-78 RCE Command injection	High7.2	—	3.3%	Sep 30, 2026
29Monitor	CVE-2026-102097No exploit	Kiteworks Email Protection Gateway remote code executionaccellion · kiteworks · CWE-22 RCE Path traversal	High7.2	—	2.1%	Sep 30, 2026
28Monitor	CVE-2026-102098No exploit	Kiteworks Core SQL Injectionaccellion · kiteworks · CWE-89 SQL injection	High7.2	—	0.9%	Sep 30, 2026

CVE-2026-47552
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass an authorizati
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
nvidia · geforceSep 30, 2026
CVE-2026-47553
31Monitor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47554
28Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where improper verification of cryptographic signature
HighCVSS 7.1No exploitEPSS 0%
- Weak crypto
nvidia · geforceSep 30, 2026
CVE-2026-47556
31Monitor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47558
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a double-free o
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47559
31Monitor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could access memory belongin
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
nvidia · geforceSep 30, 2026
CVE-2026-47560
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause a use-after-fre
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47561
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where the size of an ioctl input buffer is not validat
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47563
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a NULL pointer dereference.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47569
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause a type confusion via a handle
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
nvidia · geforceSep 30, 2026
CVE-2026-47570
31Monitor
NVIDIA GPU Display Driver for Windows contains a vulnerability in the CUDA driver where an attacker could cause a library to be loaded from
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
nvidia · geforceSep 30, 2026
CVE-2026-47571
31Monitor
NVIDIA GPU Display Driver for Windows contains a vulnerability in kernel-mode escape handling where an attacker with local access could bypa
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
nvidia · geforceSep 30, 2026
CVE-2026-47572
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause type confusion.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
nvidia · geforceSep 30, 2026
CVE-2026-47573
31Monitor
NVIDIA NVAPI for Windows contains a vulnerability where an attacker could cause an out-of-bounds write.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47574
31Monitor
NVIDIA vGPU Virtual GPU Manager for Linux contains a vulnerability where an attacker could cause incorrect resource transfer between spheres
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
nvidia · virtual gpu managerSep 30, 2026
CVE-2026-47575
31Monitor
NVIDIA GPU Display Driver for Windows contains a vulnerability in the display driver DIAG escape handler where a local unprivileged attacker
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47576
30Monitor
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module through which an attacker might initiate an out-of-bound
HighCVSS 7.7No exploitEPSS 0%
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47577
31Monitor
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an incorrect comparison.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47578
31Monitor
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an attacker could cause an incorrect buffer si
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
nvidia · geforceSep 30, 2026
CVE-2026-47579
31Monitor
The NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode driver through which a user might trigger a use-after-
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47580
29Monitor
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization is
HighCVSS 7.3No exploitEPSS 0%
- Broken access control (IDOR)
nvidia · geforceSep 30, 2026
CVE-2026-47582
28Monitor
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an out-of-bounds write.
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47583
31Monitor
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause type confusion.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
nvidia · geforceSep 30, 2026
CVE-2026-47585
31Monitor
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an integer underflow.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47587
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free.
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · rtx, quadro, nvsSep 30, 2026
CVE-2026-47588
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free condition by issuing a
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · rtx, quadro, nvsSep 30, 2026
CVE-2026-47589
31Monitor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47590
31Monitor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47591
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memo
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Broken access control (IDOR)
nvidia · geforceSep 30, 2026
CVE-2026-47592
31Monitor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47593
31Monitor
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer where an unprivileged user can cause an out-of-bound
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47594
31Monitor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47595
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memo
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
nvidia · geforceSep 30, 2026
CVE-2026-47596
28Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memo
HighCVSS 7.0No exploitEPSS 0%
nvidia · geforceSep 30, 2026
CVE-2026-47597
31Monitor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module Resource Server where an unprivile
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47598
28Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module event delivery path where an unprivileged loca
HighCVSS 7.0No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47599
31Monitor
NVIDIA GPU Display Driver for Linux contains a vulnerability in the open-source kernel module where an unprivileged local user could cause i
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
nvidia · geforceSep 30, 2026
CVE-2026-47600
31Monitor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an error-handling path could operate
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47601
31Monitor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the open-source kernel module DMA-BUF import path where an unpri
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-47602
28Monitor
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user can cause the driver t
HighCVSS 7.1No exploitEPSS 0%
- Memory safety
nvidia · geforceSep 30, 2026
CVE-2026-102489
82Now
Undisclosed RCE in Zammad v6.3 and higher
CriticalCVSS 9.4KEVWeaponizedEPSS 49%
- pre-auth RCE
zammad · zammadSep 30, 2026
CVE-2026-102490
70This week
Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package
CriticalCVSS 9.4KEVWeaponizedEPSS 10%
- Pre-auth
zammad · zammadSep 30, 2026
CVE-2026-19445
36Monitor
Use-after-free of a server-side SSLContext when sni_callback switches contexts
CriticalCVSS 9.2Proof of conceptEPSS 0%
- Pre-auth
- Memory safety
python software foundation · cpythonSep 30, 2026
CVE-2026-19553
30Monitor
SSLContext.wrap_bio() missing validation of server_hostname parameter
HighCVSS 7.6Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
python software foundation · cpythonSep 30, 2026
CVE-2026-46711
33Monitor
Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly private network
HighCVSS 8.3No exploitEPSS 0%
- Auth bypass
soft-machine-io · securitySep 30, 2026
CVE-2026-55176
36Monitor
Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token
CriticalCVSS 9.0No exploitEPSS 0%
- Auth bypass
- Broken access control (IDOR)
soft-machine-io · securitySep 30, 2026
CVE-2026-55177
30Monitor
CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard
HighCVSS 7.6No exploitEPSS 0%
- SSRF
dfpc-coe · cloudtakSep 30, 2026
CVE-2026-55181
37Monitor
Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false
CriticalCVSS 9.4No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
quenary · tugtainerSep 30, 2026
CVE-2026-55494
39Monitor
Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
- Auth bypass
- Broken access control (IDOR)
quenary · tugtainerSep 30, 2026
CVE-2026-62308
36Monitor
Tugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint
CriticalCVSS 9.1No exploitEPSS 0%
- SSRF
quenary · tugtainerSep 30, 2026
CVE-2026-75969
36Monitor
PTZOptics Missing Authentication in Firmware Upload
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
ptzoptics · move 4k 12xSep 30, 2026
CVE-2026-100510
28Monitor
WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
boldgrid · post and page builder by boldgridSep 30, 2026
CVE-2026-100512
39Monitor
WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Deserialization
hook & filter · nested pagesSep 30, 2026
CVE-2026-102376
28Monitor
WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
wpmu dev · brandaSep 30, 2026
CVE-2026-102377
35Monitor
WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
10web · photo gallery by 10webSep 30, 2026
CVE-2026-102391
28Monitor
WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
jetmonsters · jetformbuilderSep 30, 2026
CVE-2026-102392
28Monitor
WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
themehigh · extra product options for woocommerce | custom product addons and fieldsSep 30, 2026
CVE-2026-103437
4Monitor
ReadingLists imported metadata permits JavaScript URL XSS
LowCVSS 1.1Proof of conceptEPSS 0%
- XSS
the wikimedia foundation · mediawiki readinglists extensionSep 30, 2026
CVE-2026-103440
4Monitor
pagetriagelist discloses suppressed reviewer usernames
LowCVSS 1.2Proof of conceptEPSS 0%
the wikimedia foundation · mediawiki pagetriage extensionSep 30, 2026
CVE-2026-103445
4Monitor
Stored XSS through PageForms #autoedit redirect links
LowCVSS 1.2Proof of conceptEPSS 0%
- XSS
the wikimedia foundation · mediawiki page_forms extensionSep 30, 2026
CVE-2026-103446
29Monitor
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
HighCVSS 7.4Proof of conceptEPSS 0%
- Auth bypass
- Broken access control (IDOR)
the wikimedia foundation · mediawiki wikilambda extensionSep 30, 2026
CVE-2026-103471
34Monitor
restbed through 5.0.0 Denial of Service via Unbounded Header Buffering
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
corvusoft · restbedSep 30, 2026
CVE-2026-103472
34Monitor
restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
corvusoft · restbedSep 30, 2026
CVE-2026-103473
36Monitor
Deno 2.7.0 through 2.9.7 Command Injection via node:child_process
CriticalCVSS 9.2No exploitEPSS 1%
- pre-auth RCE
- Command injection
denoland · denoSep 30, 2026
CVE-2026-103474
34Monitor
yii2-starter-kit through 4.2.0 Unrestricted File Upload RCE
HighCVSS 8.7No exploitEPSS 0%
- RCE
- File upload
yii2-starter-kit · yii2-starter-kitSep 30, 2026
CVE-2026-103475
37Monitor
yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
yii2-starter-kit · yii2-starter-kitSep 30, 2026
CVE-2026-53605
31Monitor
Reachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant
HighCVSS 7.8No exploitEPSS 0%
- Local privilege escalation
pollen-robotics · reachy-mini-osSep 30, 2026
CVE-2026-55094
34Monitor
Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
taskcluster · taskclusterSep 30, 2026
CVE-2026-55107
40Plan
Kobako Vulnerable to Sandbox Escape: guest eval reaches host RCE via method_missing → public_send (any bound Service)
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
elct9620 · kobakoSep 30, 2026
CVE-2026-55224
34Monitor
MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
HighCVSS 8.7Proof of conceptEPSS 1%
- pre-auth RCE
- Path traversal
mineadmin · mineadminSep 30, 2026
CVE-2026-87004
32Monitor
Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verification
HighCVSS 8.1Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
quenary · tugtainerSep 30, 2026
CVE-2026-94171
28Monitor
WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
villatheme · curcySep 30, 2026
CVE-2026-97256
28Monitor
WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability
HighCVSS 7.2No exploitEPSS 0%
- Deserialization
greg – siteorigin · page builder by siteoriginSep 30, 2026
CVE-2026-97290
28Monitor
WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- XSS
sayontan sinha · photonic gallery & lightbox for flickr, smugmug & othersSep 30, 2026
CVE-2026-97291
35Monitor
WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability
HighCVSS 8.8No exploitEPSS 0%
- Deserialization
magazine3 · schema & structured data for wp & ampSep 30, 2026
CVE-2026-101879
28Monitor
OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
openclaw · openclaw windows nodeSep 30, 2026
CVE-2026-101880
34Monitor
OpenClaw Windows Node before 2026.7.1 Authorization Bypass
HighCVSS 8.7No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
openclaw · openclaw windows nodeSep 30, 2026
CVE-2026-101881
28Monitor
OpenClaw Windows Node before 2026.7.1 Denial of Service
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
openclaw · openclaw windows nodeSep 30, 2026
CVE-2026-101882
34Monitor
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set
HighCVSS 8.7No exploitEPSS 0%
- RCE
openclaw · openclaw windows nodeSep 30, 2026
CVE-2026-101884
30Monitor
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override
HighCVSS 7.7No exploitEPSS 0%
- RCE
openclaw · openclaw windows nodeSep 30, 2026
CVE-2026-101885
34Monitor
ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
zeroclaw-labs · zeroclawSep 30, 2026
CVE-2026-102990
32Monitor
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
patrickjuchli · basic-ftpSep 30, 2026
CVE-2026-102992
36Monitor
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- Prototype pollution
piscinajs · piscinaSep 30, 2026
CVE-2026-102993
34Monitor
pypdf: Possible large memory usage when retrieving Roman page labels
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfSep 30, 2026
CVE-2026-102994
34Monitor
pypdf: Possible long runtimes/large memory usage when parsing indirect objects
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
py-pdf · pypdfSep 30, 2026
CVE-2026-103387
8Monitor
garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception
LowCVSS 2.1No exploitEPSS 0%
- Pre-auth
garycourt · uri-jsSep 30, 2026
CVE-2026-103547
36Monitor
In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP ch
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
openbsd · openbsdSep 30, 2026
CVE-2023-54402
34Monitor
iDocView SSRF via /doc/upload Endpoint Hardcoded Token
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- SSRF
idocview · idocviewSep 30, 2026
CVE-2023-54403
34Monitor
Yonyou U8 CRM Arbitrary File Read via getemaildata.php
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Path traversal
yonyou · u8 crmSep 30, 2026
CVE-2024-58387
34Monitor
Inspur HCM Cloud Arbitrary File Read via file/download Endpoint
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
inspur · haiyue hcm cloudSep 30, 2026
CVE-2026-101276
36Monitor
iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's per-test watchdog server_timer_proc() frees s
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Memory safety
esnet · iperf3Sep 30, 2026
CVE-2026-102089
28Monitor
Kiteworks Email Protection Gateway path traversal
HighCVSS 7.2No exploitEPSS 1%
- RCE
- Path traversal
accellion · kiteworksSep 30, 2026
CVE-2026-102091
30Monitor
Kiteworks Secure Data Forms server-side request forgery
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
accellion · kiteworksSep 30, 2026
CVE-2026-102092
34Monitor
Kiteworks Core stored XSS
HighCVSS 8.7No exploitEPSS 0%
- XSS
accellion · kiteworksSep 30, 2026
CVE-2026-102093
28Monitor
Kiteworks Core improper privilege management
HighCVSS 7.2No exploitEPSS 1%
accellion · kiteworksSep 30, 2026
CVE-2026-102094
28Monitor
Kiteworks Email Protection Gateway unsafe reflection
HighCVSS 7.2No exploitEPSS 1%
accellion · kiteworksSep 30, 2026
CVE-2026-102095
36Monitor
Kiteworks Email Protection Gateway server-side request forgery
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- SSRF
accellion · kiteworksSep 30, 2026
CVE-2026-102096
29Monitor
Kiteworks Core OS command injection
HighCVSS 7.2No exploitEPSS 3%
- RCE
- Command injection
accellion · kiteworksSep 30, 2026
CVE-2026-102097
29Monitor
Kiteworks Email Protection Gateway remote code execution
HighCVSS 7.2No exploitEPSS 2%
- RCE
- Path traversal
accellion · kiteworksSep 30, 2026
CVE-2026-102098
28Monitor
Kiteworks Core SQL Injection
HighCVSS 7.2No exploitEPSS 0%
- SQL injection
accellion · kiteworksSep 30, 2026