By publication date

Exploited and new serious CVEs: September 2026

7,965 records · 32 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 8 of 80

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
28Monitor	CVE-2026-74237No exploit	GFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf Clientgfi software · gfi exinda ai · CWE-88	High7.1	—	0.3%	Sep 4, 2026
31Monitor	CVE-2026-85649Proof of concept	(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root uchewkeanho · software-actualizer · CWE-252	High7.9	—	0.2%	Sep 4, 2026
30Monitor	CVE-2026-12483No exploit	LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handlerstellarwp · learndash lms · CWE-434 RCE File upload	High7.5	—	0.6%	Sep 4, 2026
35Monitor	CVE-2026-52691No exploit	Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Moduleapache software foundation · apache griffin hive metastore module · CWE-89 SQL injection	High8.8	—	0.4%	Sep 4, 2026
24Monitor	CVE-2026-77818Proof of concept	Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation Systemyordam information technology consulting, training and electronic systems industry and trade inc. · library information and document automation program · CWE-79 Pre-auth XSS	Medium6.1	—	0.2%	Sep 4, 2026
30Monitor	CVE-2026-19205No exploit	User Enumeration in GastroMenum's GastroMenum Web Panelgastromenum · gastromenum web panel · CWE-204 Pre-auth	High7.5	—	0.4%	Sep 4, 2026
34Monitor	CVE-2026-6958No exploit	Acunetix 25.11.251107123 Local Privilege Escalation via wvsc.exeinvicti security corp. · acunetix · CWE-427 RCE Local privilege escalation	High8.5	—	0.1%	Sep 4, 2026
30Monitor	CVE-2026-81832No exploit	IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsibm · app connect enterprise · CWE-611 XXE	High7.7	—	0.3%	Sep 4, 2026
32Monitor	CVE-2026-82728No exploit	Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoSelixir-mint · mint · CWE-770 Pre-auth Denial of service	High8.2	—	0.5%	Sep 4, 2026
34Monitor	CVE-2026-85606No exploit	firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePathfirecrawl · firecrawl-mcp-server · CWE-22 Pre-auth Path traversal	High8.7	—	0.8%	Sep 4, 2026
34Monitor	CVE-2026-85607No exploit	Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Routerblinkospace · blinko · CWE-639 Broken access control (IDOR)	High8.7	—	0.6%	Sep 4, 2026
34Monitor	CVE-2026-85608No exploit	Douyin_TikTok_Download_API 4.1.2 SSRF via url parameterevil0ctal · douyin_tiktok_download_api · CWE-918 Pre-auth SSRF	High8.7	—	0.4%	Sep 4, 2026
28Monitor	CVE-2026-85618No exploit	ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directivesc4illin · convertx · CWE-22 Path traversal	High7.1	—	0.4%	Sep 4, 2026
30Monitor	CVE-2026-85619No exploit	AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP APIappflowy-io · appflowy-cloud · CWE-863 Broken access control (IDOR)	High7.7	—	0.5%	Sep 4, 2026
36Monitor	CVE-2026-85620No exploit	Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Functioncrystaldba · postgres-mcp · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.2	—	0.5%	Sep 4, 2026
34Monitor	CVE-2026-85623No exploit	goose 1.37.0 Arbitrary Command Execution via Recipe Extensionsaaif-goose · goose · CWE-94 pre-auth RCE	High8.7	—	0.5%	Sep 4, 2026
28Monitor	CVE-2026-85624No exploit	Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceListblinkospace · blinko · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Sep 4, 2026
36Monitor	CVE-2026-85625Proof of concept	sift 17.1.3 Prototype Pollution Remote Code Execution via $wherecrcn · sift.js · CWE-1321 pre-auth RCE Prototype pollution	Critical9.2	—	0.7%	Sep 4, 2026
34Monitor	CVE-2026-85626No exploit	git-mcp-server 2.15.1 Argument Injection via Git Ref Parameterscyanheads · git-mcp-server · CWE-88 Pre-auth	High8.7	—	0.4%	Sep 4, 2026
33Monitor	CVE-2026-85651No exploit	Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replaytriggerdotdev · trigger.dev · CWE-862 Broken access control (IDOR)	High8.4	—	0.4%	Sep 4, 2026
36Monitor	CVE-2026-85660No exploit	cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitutionmladensu · cli-mcp-server · CWE-78 pre-auth RCE Command injection	Critical9.2	—	0.6%	Sep 4, 2026
37Monitor	CVE-2026-85661No exploit	excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio modeharis-musa · excel-mcp-server · CWE-22 Pre-auth Path traversal	Critical9.3	—	0.6%	Sep 4, 2026
37Monitor	CVE-2026-85663No exploit	Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatchaimhubio · aim · CWE-306 pre-auth RCE Auth bypass	Critical9.3	—	0.7%	Sep 4, 2026
34Monitor	CVE-2026-85664No exploit	Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustionchroma-core · chroma · CWE-770 Pre-auth Denial of service	High8.7	—	0.6%	Sep 4, 2026
28Monitor	CVE-2026-85665No exploit	Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Pathusebruno · bruno · CWE-22 Pre-auth Path traversal	High7.1	—	0.7%	Sep 4, 2026
34Monitor	CVE-2026-85666No exploit	ogx 1.3.1 Server-Side Request Forgery via MCP tool server_urlogx-ai · ogx · CWE-918 Pre-auth Auth bypass SSRF	High8.7	—	0.7%	Sep 4, 2026
37Monitor	CVE-2026-85667No exploit	xiaobei through 5.5.2 Unauthenticated Webhook Message Injectionteamwiseflow · xiaobei · CWE-306 Pre-auth Auth bypass SSRF	Critical9.3	—	0.6%	Sep 4, 2026
34Monitor	CVE-2026-85668No exploit	Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-registerxorbitsai · inference · CWE-73 Pre-auth Auth bypass Path traversal	High8.7	—	0.6%	Sep 4, 2026
28Monitor	CVE-2026-85669No exploit	potpie through 2.0.0 Missing Ownership Check via code-changes syncpotpie-ai · potpie · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Sep 4, 2026
28Monitor	CVE-2026-85670No exploit	tokenizers BpeBuilder Buffer Overflow via merge tokenhuggingface · tokenizers · CWE-787 Pre-auth Memory safety	High7.1	—	0.4%	Sep 4, 2026
34Monitor	CVE-2026-85671No exploit	QAnything 2.0.0 Unauthenticated Cross-User File Disclosurenetease-youdao · qanything · CWE-306 Pre-auth Auth bypass	High8.7	—	0.6%	Sep 4, 2026
38Monitor	CVE-2026-85672No exploit	zerox 1.1.20 OS Command Injection via Document URL File Extensiongetomni-ai · zerox · CWE-78 pre-auth RCE Command injection	Critical9.3	—	2.5%	Sep 4, 2026
34Monitor	CVE-2026-85673No exploit	LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebindinghiyouga · llamafactory · CWE-918 Pre-auth SSRF	High8.7	—	0.5%	Sep 4, 2026
34Monitor	CVE-2026-85674No exploit	aider 0.86.2 Remote Code Execution via .aider.conf.ymlaider-ai · aider · CWE-94 RCE	High8.5	—	0.2%	Sep 4, 2026
34Monitor	CVE-2026-85675No exploit	OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetchingcamel-ai · owl · CWE-918 Pre-auth SSRF	High8.7	—	0.4%	Sep 4, 2026
35Monitor	CVE-2026-85684No exploit	marker through 2.0.0 Path Traversal via upload filenamedatalab-to · marker · CWE-73 Pre-auth Path traversal	High8.8	—	1.1%	Sep 4, 2026
34Monitor	CVE-2026-85685No exploit	AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skillagentscope-ai · agentscope · CWE-22 Pre-auth Path traversal	High8.7	—	0.5%	Sep 4, 2026
34Monitor	CVE-2026-85686No exploit	ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLsmodelscope · ms-swift · CWE-918 Pre-auth SSRF	High8.7	—	0.4%	Sep 4, 2026
34Monitor	CVE-2026-85687No exploit	surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot serverdatalab-to · surya · CWE-73 Pre-auth Path traversal	High8.7	—	0.5%	Sep 4, 2026
38Monitor	CVE-2026-85688Proof of concept	TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designerten-framework · ten-framework · CWE-306 Pre-auth Auth bypass	Critical9.3	—	2.6%	Sep 4, 2026
28Monitor	CVE-2026-85689No exploit	llmware 0.4.6 SQL Injection via unescaped filter valuesllmware-ai · llmware · CWE-89 SQL injection	High7.1	—	0.4%	Sep 4, 2026
34Monitor	CVE-2026-85690No exploit	Plandex 2.2.1 Path Traversal via ApplyFilesplandex-ai · plandex · CWE-22 Path traversal	High8.5	—	0.2%	Sep 4, 2026
34Monitor	CVE-2026-85691No exploit	MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/urlthe-vibe-company · megaparse · CWE-918 Pre-auth Auth bypass SSRF	High8.7	—	0.5%	Sep 4, 2026
28Monitor	CVE-2026-85692No exploit	Nightingale 9.1.1 SSRF Guard Bypass via IPv6 Encodingccfos · nightingale · CWE-918 SSRF	High7.1	—	0.4%	Sep 4, 2026
28Monitor	CVE-2026-85693No exploit	Chatbot UI Cross-User Private File Content Disclosure via Retrieval APImckaywrigley · chatbot-ui · CWE-639 Broken access control (IDOR)	High7.1	—	0.4%	Sep 4, 2026
36Monitor	CVE-2026-85694No exploit	LaVague 0.2.35 Remote Code Execution via eval extractionlavague-ai · lavague · CWE-94 pre-auth RCE	Critical9.2	—	0.9%	Sep 4, 2026
37Monitor	CVE-2026-85695No exploit	FastChat Unauthenticated Worker Registration SSRF and Model Spoofinglm-sys · fastchat · CWE-306 Pre-auth Auth bypass SSRF	Critical9.3	—	0.7%	Sep 4, 2026
38Monitor	CVE-2026-85696No exploit	SadTalker OS Command Injection via Audio Filenameopentalker · sadtalker · CWE-78 pre-auth RCE Command injection	Critical9.3	—	2.5%	Sep 4, 2026
28Monitor	CVE-2026-85697No exploit	Documenso 2.17.0 PDF Route Ignores Document Visibilitydocumenso · documenso · CWE-863 Broken access control (IDOR)	High7.1	—	0.4%	Sep 4, 2026
34Monitor	CVE-2026-85699No exploit	jina-ai reader server-side request forgery via redirect validation bypassjina-ai · reader · CWE-918 Pre-auth SSRF	High8.7	—	0.4%	Sep 4, 2026
28Monitor	CVE-2026-85700No exploit	Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpointsonyx-dot-app · onyx · CWE-522 Info leak	High7.1	—	0.5%	Sep 4, 2026
28Monitor	CVE-2026-85578No exploit	SiYuan through 3.8.1 Authorization Bypass via getFilesiyuan-note · siyuan · CWE-862 Broken access control (IDOR)	High7.1	—	0.3%	Sep 4, 2026
39Monitor	CVE-2026-18658No exploit	IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressedibm · operational decision manager · CWE-89 pre-auth RCE SQL injection	Critical9.8	—	0.7%	Sep 4, 2026
30Monitor	CVE-2026-18905No exploit	IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocationibm · contextforge · CWE-918 SSRF	High7.7	—	0.4%	Sep 4, 2026
38Monitor	CVE-2026-19274No exploit	IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container imageibm · observability with instana (agent) · CWE-284 Broken access control (IDOR)	Critical9.6	—	0.3%	Sep 4, 2026
30Monitor	CVE-2026-19283No exploit	IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container imageibm · observability with instana (agent) · CWE-863 Broken access control (IDOR)	High7.7	—	0.4%	Sep 4, 2026
35Monitor	CVE-2026-19298No exploit	Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpointlangflow · langflow · CWE-94 RCE	High8.8	—	0.8%	Sep 4, 2026
30Monitor	CVE-2026-19300No exploit	Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flowslangflow · langflow · CWE-200 Pre-auth Info leak	High7.5	—	0.5%	Sep 4, 2026
28Monitor	CVE-2026-85594No exploit	Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middlewaretraefik · traefik · CWE-639 Broken access control (IDOR)	High7.0	—	0.4%	Sep 4, 2026
38Monitor	CVE-2026-85595Proof of concept	Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuthtraefik · traefik · CWE-287 Pre-auth Auth bypass	Critical9.3	—	2.4%	Sep 4, 2026
32Monitor	CVE-2026-85596No exploit	Traefik v3.7 Authentication Bypass via TLS Option Conflicttraefik · traefik · CWE-287 Pre-auth Auth bypass	High8.2	—	0.4%	Sep 4, 2026
32Monitor	CVE-2026-85597No exploit	Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflicttraefik · traefik · CWE-863 Pre-auth Broken access control (IDOR)	High8.2	—	0.3%	Sep 4, 2026
32Monitor	CVE-2026-19303No exploit	Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing componentslangflow · langflow · CWE-22 Path traversal	High8.1	—	0.6%	Sep 4, 2026
30Monitor	CVE-2026-19305No exploit	Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple componentslangflow · langflow · CWE-918 Pre-auth SSRF	High7.5	—	0.4%	Sep 4, 2026
30Monitor	CVE-2026-19306No exploit	Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor componentslangflow · langflow · CWE-22 Path traversal	High7.7	—	0.5%	Sep 4, 2026
37Monitor	CVE-2026-44402Proof of concept	Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgivoltronic power · snmp web pro · CWE-434 pre-auth RCE File upload	Critical9.3	—	1.3%	Sep 4, 2026
36Monitor	CVE-2026-75160No exploit	An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgiCWE-269 Pre-auth	Critical9.1	—	0.6%	Sep 4, 2026
35Monitor	CVE-2026-75161No exploit	An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated uCWE-77 RCE Command injection	High8.8	—	0.7%	Sep 4, 2026
35Monitor	CVE-2026-75166No exploit	Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/CWE-269 RCE	High8.8	—	0.7%	Sep 4, 2026
35Monitor	CVE-2026-75169No exploit	An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authentiCWE-434 File upload	High8.8	—	0.7%	Sep 4, 2026
39Monitor	CVE-2026-75171No exploit	An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.CWE-384 Pre-auth	Critical9.8	—	0.6%	Sep 4, 2026
39Monitor	CVE-2026-75429Proof of concept	PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the SeCWE-287 pre-auth RCE Auth bypass	Critical9.8	—	0.9%	Sep 4, 2026
36Monitor	CVE-2026-75431Proof of concept	PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication.CWE-321 pre-auth RCE Hard-coded credentials	Critical9.1	—	1.0%	Sep 4, 2026
38Monitor	CVE-2026-77822No exploit	IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpointibm · contextforge · CWE-918 SSRF	Critical9.6	—	0.3%	Sep 4, 2026
30Monitor	CVE-2026-78543No exploit	IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEsibm · app connect enterprise · CWE-835 Pre-auth Denial of service	High7.5	—	0.5%	Sep 4, 2026
34Monitor	CVE-2026-79418No exploit	EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality.emxtecnologia · gestao x business suite · CWE-79 RCE XSS	High8.7	—	0.3%	Sep 4, 2026
34Monitor	CVE-2026-79419No exploit	A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier.emxtecnologia · gestao x business suite · CWE-79 XSS	High8.7	—	0.3%	Sep 4, 2026
32Monitor	CVE-2026-85730No exploit	smol-toml: Denial of Service via malformed TOML documentssquirrelchat · smol-toml · CWE-606 Pre-auth	High8.2	—	0.5%	Sep 4, 2026
30Monitor	CVE-2026-13297No exploit	Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Accessibm · verify identity access · CWE-1336 pre-auth RCE SSTI	High7.5	—	0.4%	Sep 4, 2026
31Monitor	CVE-2026-16826No exploit	IBM i is Affected By Multiple Vulnerabilities in Debug Serveribm · i · CWE-78 RCE Command injection	High7.8	—	0.1%	Sep 4, 2026
36Monitor	CVE-2026-17057No exploit	IBM i is Affected By Denial of Service Vulnerabilities in NFS [, ]ibm · i · CWE-306 Pre-auth Auth bypass	Critical9.1	—	0.5%	Sep 4, 2026
36Monitor	CVE-2026-17207No exploit	IBM i is Affected By Denial of Service Vulnerabilities in NFS [, ]ibm · i · CWE-787 Pre-auth Memory safety	Critical9.1	—	0.4%	Sep 4, 2026
30Monitor	CVE-2026-17255No exploit	IBM i is Affected By Denial of Service Vulnerability []ibm · i · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.6%	Sep 4, 2026
30Monitor	CVE-2026-17470No exploit	IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [, ]ibm · i · CWE-787 Pre-auth Memory safety Denial of service	High7.5	—	0.5%	Sep 4, 2026
31Monitor	CVE-2026-17499No exploit	IBM i is Affected By Multiple Vulnerabilities in Debug Serveribm · i · CWE-78 RCE Command injection	High7.8	—	0.1%	Sep 4, 2026
28Monitor	CVE-2026-17627No exploit	Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpointlangflow · langflow · CWE-639 Broken access control (IDOR)	High7.1	—	0.2%	Sep 4, 2026
30Monitor	CVE-2026-18175No exploit	IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]ibm · i · CWE-285 Pre-auth Broken access control (IDOR)	High7.5	—	0.3%	Sep 4, 2026
39Monitor	CVE-2026-18221No exploit	IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]ibm · i · CWE-287 Pre-auth Auth bypass	Critical9.8	—	0.6%	Sep 4, 2026
35Monitor	CVE-2026-18341No exploit	IBM i is Affected By Buffer Overflow Vulnerability []ibm · i · CWE-122 Memory safety	High8.8	—	0.4%	Sep 4, 2026
35Monitor	CVE-2026-18486No exploit	IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter executionibm · contextforge · CWE-200 Info leak	High8.8	—	0.5%	Sep 4, 2026
29Monitor	CVE-2026-18489No exploit	IBM ContextForge Translate is affected by cross-client credential context confusionibm · contextforge · CWE-488 Pre-auth	High7.4	—	0.4%	Sep 4, 2026
39Monitor	CVE-2026-31020No exploit	In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbotCWE-94 pre-auth RCE SSTI	Critical9.8	—	1.0%	Sep 4, 2026
39Monitor	CVE-2026-75430Proof of concept	PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the CWE-306 pre-auth RCE Auth bypass	Critical9.8	—	1.2%	Sep 4, 2026
39Monitor	CVE-2026-78745Proof of concept	An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug BrCWE-284 pre-auth RCE Broken access control (IDOR)	Critical9.8	—	0.7%	Sep 4, 2026
32Monitor	CVE-2026-84933No exploit	undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared cachesnodejs · undici · CWE-200 Pre-auth Info leak	High8.2	—	0.3%	Sep 4, 2026
36Monitor	CVE-2026-84961No exploit	undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPoolnodejs · undici · CWE-295 Pre-auth Weak crypto	Critical9.1	—	0.1%	Sep 4, 2026
30Monitor	CVE-2026-85014No exploit	undici vulnerable to Denial of Service via WebSocketStream unclean closenodejs · undici · CWE-248 Pre-auth Denial of service	High7.5	—	0.3%	Sep 4, 2026
29Monitor	CVE-2026-85152No exploit	undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptorsnodejs · undici · CWE-346 Pre-auth Auth bypass	High7.4	—	0.1%	Sep 4, 2026
30Monitor	CVE-2021-44319No exploit	Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service.CWE-400 Pre-auth Denial of service	High7.5	—	0.7%	Sep 4, 2026
30Monitor	CVE-2021-44320No exploit	Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks.CWE-400 Pre-auth Denial of service	High7.5	—	0.6%	Sep 4, 2026

CVE-2026-74237
28Monitor
GFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf Client
HighCVSS 7.1No exploitEPSS 0%
gfi software · gfi exinda aiSep 4, 2026
CVE-2026-85649
31Monitor
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root u
HighCVSS 7.9Proof of conceptEPSS 0%
chewkeanho · software-actualizerSep 4, 2026
CVE-2026-12483
30Monitor
LearnDash LMS <= 5.1.5 - Authenticated (Subscriber+) Arbitrary File Upload via Assignment Upload Handler
HighCVSS 7.5No exploitEPSS 0%
- RCE
- File upload
stellarwp · learndash lmsSep 4, 2026
CVE-2026-52691
35Monitor
Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module
HighCVSS 8.8No exploitEPSS 0%
- SQL injection
apache software foundation · apache griffin hive metastore moduleSep 4, 2026
CVE-2026-77818
24Monitor
Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
yordam information technology consulting, training and electronic systems industry and trade inc. · library information and document automation programSep 4, 2026
CVE-2026-19205
30Monitor
User Enumeration in GastroMenum's GastroMenum Web Panel
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
gastromenum · gastromenum web panelSep 4, 2026
CVE-2026-6958
34Monitor
Acunetix 25.11.251107123 Local Privilege Escalation via wvsc.exe
HighCVSS 8.5No exploitEPSS 0%
- RCE
- Local privilege escalation
invicti security corp. · acunetixSep 4, 2026
CVE-2026-81832
30Monitor
IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
HighCVSS 7.7No exploitEPSS 0%
- XXE
ibm · app connect enterpriseSep 4, 2026
CVE-2026-82728
32Monitor
Unbounded HTTP/1 status-line and chunk-extension buffering in Mint causes memory-exhaustion DoS
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Denial of service
elixir-mint · mintSep 4, 2026
CVE-2026-85606
34Monitor
firecrawl-mcp-server 3.20.2 Arbitrary Local File Read via filePath
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
firecrawl · firecrawl-mcp-serverSep 4, 2026
CVE-2026-85607
34Monitor
Blinko 1.8.7 Cross-User AI Conversation Read and Write via message tRPC Router
HighCVSS 8.7No exploitEPSS 0%
- Broken access control (IDOR)
blinkospace · blinkoSep 4, 2026
CVE-2026-85608
34Monitor
Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SSRF
evil0ctal · douyin_tiktok_download_apiSep 4, 2026
CVE-2026-85618
28Monitor
ConvertX 0.17.0 Arbitrary File Read via LaTeX Input Directives
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
c4illin · convertxSep 4, 2026
CVE-2026-85619
30Monitor
AppFlowy-Cloud 0.9.64 Cross-Workspace Collab Access via HTTP API
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
appflowy-io · appflowy-cloudSep 4, 2026
CVE-2026-85620
36Monitor
Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function
CriticalCVSS 9.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
crystaldba · postgres-mcpSep 4, 2026
CVE-2026-85623
34Monitor
goose 1.37.0 Arbitrary Command Execution via Recipe Extensions
HighCVSS 8.7No exploitEPSS 0%
- pre-auth RCE
aaif-goose · gooseSep 4, 2026
CVE-2026-85624
28Monitor
Blinko 1.8.7 Cross-User Private Note Disclosure via noteReferenceList
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
blinkospace · blinkoSep 4, 2026
CVE-2026-85625
36Monitor
sift 17.1.3 Prototype Pollution Remote Code Execution via $where
CriticalCVSS 9.2Proof of conceptEPSS 0%
- pre-auth RCE
- Prototype pollution
crcn · sift.jsSep 4, 2026
CVE-2026-85626
34Monitor
git-mcp-server 2.15.1 Argument Injection via Git Ref Parameters
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
cyanheads · git-mcp-serverSep 4, 2026
CVE-2026-85651
33Monitor
Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay
HighCVSS 8.4No exploitEPSS 0%
- Broken access control (IDOR)
triggerdotdev · trigger.devSep 4, 2026
CVE-2026-85660
36Monitor
cli-mcp-server 0.2.5 Command Allowlist Bypass via Shell Substitution
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
- Command injection
mladensu · cli-mcp-serverSep 4, 2026
CVE-2026-85661
37Monitor
excel-mcp-server 0.1.8 Arbitrary File Read/Write via stdio mode
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Path traversal
haris-musa · excel-mcp-serverSep 4, 2026
CVE-2026-85663
37Monitor
Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch
CriticalCVSS 9.3No exploitEPSS 0%
- pre-auth RCE
- Auth bypass
aimhubio · aimSep 4, 2026
CVE-2026-85664
34Monitor
Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhaustion
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Denial of service
chroma-core · chromaSep 4, 2026
CVE-2026-85665
28Monitor
Bruno through 4.1.0 Arbitrary File Read via Unconfined Body File Path
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Path traversal
usebruno · brunoSep 4, 2026
CVE-2026-85666
34Monitor
ogx 1.3.1 Server-Side Request Forgery via MCP tool server_url
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- SSRF
ogx-ai · ogxSep 4, 2026
CVE-2026-85667
37Monitor
xiaobei through 5.5.2 Unauthenticated Webhook Message Injection
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- SSRF
teamwiseflow · xiaobeiSep 4, 2026
CVE-2026-85668
34Monitor
Xinference 3.3.0 Unauthenticated Arbitrary-Path File Read via /v1/models/llm/auto-register
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- Path traversal
xorbitsai · inferenceSep 4, 2026
CVE-2026-85669
28Monitor
potpie through 2.0.0 Missing Ownership Check via code-changes sync
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
potpie-ai · potpieSep 4, 2026
CVE-2026-85670
28Monitor
tokenizers BpeBuilder Buffer Overflow via merge token
HighCVSS 7.1No exploitEPSS 0%
- Pre-auth
- Memory safety
huggingface · tokenizersSep 4, 2026
CVE-2026-85671
34Monitor
QAnything 2.0.0 Unauthenticated Cross-User File Disclosure
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
netease-youdao · qanythingSep 4, 2026
CVE-2026-85672
38Monitor
zerox 1.1.20 OS Command Injection via Document URL File Extension
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
getomni-ai · zeroxSep 4, 2026
CVE-2026-85673
34Monitor
LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SSRF
hiyouga · llamafactorySep 4, 2026
CVE-2026-85674
34Monitor
aider 0.86.2 Remote Code Execution via .aider.conf.yml
HighCVSS 8.5No exploitEPSS 0%
- RCE
aider-ai · aiderSep 4, 2026
CVE-2026-85675
34Monitor
OWL DocumentProcessingToolkit Server-Side Request Forgery via URL Fetching
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SSRF
camel-ai · owlSep 4, 2026
CVE-2026-85684
35Monitor
marker through 2.0.0 Path Traversal via upload filename
HighCVSS 8.8No exploitEPSS 1%
- Pre-auth
- Path traversal
datalab-to · markerSep 4, 2026
CVE-2026-85685
34Monitor
AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skill
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
agentscope-ai · agentscopeSep 4, 2026
CVE-2026-85686
34Monitor
ms-swift 4.5.2 Unauthenticated SSRF via Multimodal Media URLs
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SSRF
modelscope · ms-swiftSep 4, 2026
CVE-2026-85687
34Monitor
surya 0.22.1 Unauthenticated Arbitrary File Read via screenshot server
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Path traversal
datalab-to · suryaSep 4, 2026
CVE-2026-85688
38Monitor
TEN Framework 0.11.71 Unauthenticated File Read/Write via TMAN Designer
CriticalCVSS 9.3Proof of conceptEPSS 2%
- Pre-auth
- Auth bypass
ten-framework · ten-frameworkSep 4, 2026
CVE-2026-85689
28Monitor
llmware 0.4.6 SQL Injection via unescaped filter values
HighCVSS 7.1No exploitEPSS 0%
- SQL injection
llmware-ai · llmwareSep 4, 2026
CVE-2026-85690
34Monitor
Plandex 2.2.1 Path Traversal via ApplyFiles
HighCVSS 8.5No exploitEPSS 0%
- Path traversal
plandex-ai · plandexSep 4, 2026
CVE-2026-85691
34Monitor
MegaParse 0.0.55 Server-Side Request Forgery via POST /v1/url
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- Auth bypass
- SSRF
the-vibe-company · megaparseSep 4, 2026
CVE-2026-85692
28Monitor
Nightingale 9.1.1 SSRF Guard Bypass via IPv6 Encoding
HighCVSS 7.1No exploitEPSS 0%
- SSRF
ccfos · nightingaleSep 4, 2026
CVE-2026-85693
28Monitor
Chatbot UI Cross-User Private File Content Disclosure via Retrieval API
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
mckaywrigley · chatbot-uiSep 4, 2026
CVE-2026-85694
36Monitor
LaVague 0.2.35 Remote Code Execution via eval extraction
CriticalCVSS 9.2No exploitEPSS 0%
- pre-auth RCE
lavague-ai · lavagueSep 4, 2026
CVE-2026-85695
37Monitor
FastChat Unauthenticated Worker Registration SSRF and Model Spoofing
CriticalCVSS 9.3No exploitEPSS 0%
- Pre-auth
- Auth bypass
- SSRF
lm-sys · fastchatSep 4, 2026
CVE-2026-85696
38Monitor
SadTalker OS Command Injection via Audio Filename
CriticalCVSS 9.3No exploitEPSS 2%
- pre-auth RCE
- Command injection
opentalker · sadtalkerSep 4, 2026
CVE-2026-85697
28Monitor
Documenso 2.17.0 PDF Route Ignores Document Visibility
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
documenso · documensoSep 4, 2026
CVE-2026-85699
34Monitor
jina-ai reader server-side request forgery via redirect validation bypass
HighCVSS 8.7No exploitEPSS 0%
- Pre-auth
- SSRF
jina-ai · readerSep 4, 2026
CVE-2026-85700
28Monitor
Onyx 4.6.6 Custom Tool Secret Header Disclosure via Tool Endpoints
HighCVSS 7.1No exploitEPSS 0%
- Info leak
onyx-dot-app · onyxSep 4, 2026
CVE-2026-85578
28Monitor
SiYuan through 3.8.1 Authorization Bypass via getFile
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
siyuan-note · siyuanSep 4, 2026
CVE-2026-18658
39Monitor
IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- SQL injection
ibm · operational decision managerSep 4, 2026
CVE-2026-18905
30Monitor
IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation
HighCVSS 7.7No exploitEPSS 0%
- SSRF
ibm · contextforgeSep 4, 2026
CVE-2026-19274
38Monitor
IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
CriticalCVSS 9.6No exploitEPSS 0%
- Broken access control (IDOR)
ibm · observability with instana (agent)Sep 4, 2026
CVE-2026-19283
30Monitor
IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
HighCVSS 7.7No exploitEPSS 0%
- Broken access control (IDOR)
ibm · observability with instana (agent)Sep 4, 2026
CVE-2026-19298
35Monitor
Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint
HighCVSS 8.8No exploitEPSS 0%
- RCE
langflow · langflowSep 4, 2026
CVE-2026-19300
30Monitor
Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Info leak
langflow · langflowSep 4, 2026
CVE-2026-85594
28Monitor
Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware
HighCVSS 7.0No exploitEPSS 0%
- Broken access control (IDOR)
traefik · traefikSep 4, 2026
CVE-2026-85595
38Monitor
Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
CriticalCVSS 9.3Proof of conceptEPSS 2%
- Pre-auth
- Auth bypass
traefik · traefikSep 4, 2026
CVE-2026-85596
32Monitor
Traefik v3.7 Authentication Bypass via TLS Option Conflict
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Auth bypass
traefik · traefikSep 4, 2026
CVE-2026-85597
32Monitor
Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
traefik · traefikSep 4, 2026
CVE-2026-19303
32Monitor
Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components
HighCVSS 8.1No exploitEPSS 0%
- Path traversal
langflow · langflowSep 4, 2026
CVE-2026-19305
30Monitor
Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- SSRF
langflow · langflowSep 4, 2026
CVE-2026-19306
30Monitor
Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components
HighCVSS 7.7No exploitEPSS 0%
- Path traversal
langflow · langflowSep 4, 2026
CVE-2026-44402
37Monitor
Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi
CriticalCVSS 9.3Proof of conceptEPSS 1%
- pre-auth RCE
- File upload
voltronic power · snmp web proSep 4, 2026
CVE-2026-75160
36Monitor
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
Sep 4, 2026
CVE-2026-75161
35Monitor
An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated u
HighCVSS 8.8No exploitEPSS 0%
- RCE
- Command injection
Sep 4, 2026
CVE-2026-75166
35Monitor
Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/
HighCVSS 8.8No exploitEPSS 0%
- RCE
Sep 4, 2026
CVE-2026-75169
35Monitor
An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenti
HighCVSS 8.8No exploitEPSS 0%
- File upload
Sep 4, 2026
CVE-2026-75171
39Monitor
An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
Sep 4, 2026
CVE-2026-75429
39Monitor
PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Se
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- Auth bypass
Sep 4, 2026
CVE-2026-75431
36Monitor
PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication.
CriticalCVSS 9.1Proof of conceptEPSS 1%
- pre-auth RCE
- Hard-coded credentials
Sep 4, 2026
CVE-2026-77822
38Monitor
IBM ContextForge MCP Gateway is affected by server-side request forgery (DNS rebinding) via the A2A agent invocation endpoint
CriticalCVSS 9.6No exploitEPSS 0%
- SSRF
ibm · contextforgeSep 4, 2026
CVE-2026-78543
30Monitor
IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
ibm · app connect enterpriseSep 4, 2026
CVE-2026-79418
34Monitor
EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality.
HighCVSS 8.7No exploitEPSS 0%
- RCE
- XSS
emxtecnologia · gestao x business suiteSep 4, 2026
CVE-2026-79419
34Monitor
A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier.
HighCVSS 8.7No exploitEPSS 0%
- XSS
emxtecnologia · gestao x business suiteSep 4, 2026
CVE-2026-85730
32Monitor
smol-toml: Denial of Service via malformed TOML documents
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
squirrelchat · smol-tomlSep 4, 2026
CVE-2026-13297
30Monitor
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- SSTI
ibm · verify identity accessSep 4, 2026
CVE-2026-16826
31Monitor
IBM i is Affected By Multiple Vulnerabilities in Debug Server
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
ibm · iSep 4, 2026
CVE-2026-17057
36Monitor
IBM i is Affected By Denial of Service Vulnerabilities in NFS [, ]
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · iSep 4, 2026
CVE-2026-17207
36Monitor
IBM i is Affected By Denial of Service Vulnerabilities in NFS [, ]
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Memory safety
ibm · iSep 4, 2026
CVE-2026-17255
30Monitor
IBM i is Affected By Denial of Service Vulnerability []
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
ibm · iSep 4, 2026
CVE-2026-17470
30Monitor
IBM i is Affected By Denial of Service Vulnerabilities in Line Printer Daemon [, ]
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
ibm · iSep 4, 2026
CVE-2026-17499
31Monitor
IBM i is Affected By Multiple Vulnerabilities in Debug Server
HighCVSS 7.8No exploitEPSS 0%
- RCE
- Command injection
ibm · iSep 4, 2026
CVE-2026-17627
28Monitor
Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
langflow · langflowSep 4, 2026
CVE-2026-18175
30Monitor
IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Broken access control (IDOR)
ibm · iSep 4, 2026
CVE-2026-18221
39Monitor
IBM i is Affected By Improper Authorization and Authentication Vulnerabilities in DDM / DRDA [, ]
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Auth bypass
ibm · iSep 4, 2026
CVE-2026-18341
35Monitor
IBM i is Affected By Buffer Overflow Vulnerability []
HighCVSS 8.8No exploitEPSS 0%
- Memory safety
ibm · iSep 4, 2026
CVE-2026-18486
35Monitor
IBM ContextForge MCP Gateway is affected by credential disclosure and privilege escalation via jq filter execution
HighCVSS 8.8No exploitEPSS 0%
- Info leak
ibm · contextforgeSep 4, 2026
CVE-2026-18489
29Monitor
IBM ContextForge Translate is affected by cross-client credential context confusion
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
ibm · contextforgeSep 4, 2026
CVE-2026-31020
39Monitor
In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- SSTI
Sep 4, 2026
CVE-2026-75430
39Monitor
PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- Auth bypass
Sep 4, 2026
CVE-2026-78745
39Monitor
An issue in HiDPT/ Weyon HiDPTAndroid Hi3751V350 Hi3751V352E_DMO allows a remote attacker to execute arbitrary code via the Android Debug Br
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
- Broken access control (IDOR)
Sep 4, 2026
CVE-2026-84933
32Monitor
undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Info leak
nodejs · undiciSep 4, 2026
CVE-2026-84961
36Monitor
undici vulnerable to TLS certificate validation bypass via dropped connect options in BalancedPool
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Weak crypto
nodejs · undiciSep 4, 2026
CVE-2026-85014
30Monitor
undici vulnerable to Denial of Service via WebSocketStream unclean close
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
nodejs · undiciSep 4, 2026
CVE-2026-85152
29Monitor
undici vulnerable to cross-origin cache poisoning via missing origin isolation in interceptors
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Auth bypass
nodejs · undiciSep 4, 2026
CVE-2021-44319
30Monitor
Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Sep 4, 2026
CVE-2021-44320
30Monitor
Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks.
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
Sep 4, 2026