Эксплуатируемые и новые серьёзные CVE: сентябрь 2026 г.

Unauthenticated Command Injection Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface

• RCE без входа
• Инъекция команд

arubanetworks · fabric composer1 сент. 2026 г.

Unauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composer

• Без аутентификации
• CSRF

arubanetworks · fabric composer1 сент. 2026 г.

Authenticated Arbitrary File Write Vulnerability leads to Remote Code Execution in HPE Networking Fabric Composer

• RCE
• Обход пути

arubanetworks · fabric composer1 сент. 2026 г.

Authenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer API

• RCE
• Инъекция команд

arubanetworks · fabric composer1 сент. 2026 г.

Dell PowerStore contains a Command Injection vulnerability.

• RCE
• Локальное повышение привилегий
• Инъекция команд

dell · powerstoreos1 сент. 2026 г.

Authenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composer

• SQL-инъекция

arubanetworks · fabric composer1 сент. 2026 г.

Authenticated Command Injection Vulnerabilities in HPE Networking Fabric Composer Web-Based Management Interface

• RCE
• Инъекция команд

arubanetworks · fabric composer1 сент. 2026 г.

Authenticated Privilege Escalation Leading to Unauthorized State Changes in HPE Networking Fabric Composer Web-Based Management Interface

• Нарушение контроля доступа (IDOR)

arubanetworks · fabric composer1 сент. 2026 г.

Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer

• Нарушение контроля доступа (IDOR)

arubanetworks · fabric composer1 сент. 2026 г.

Local Privilege Escalation leads to Arbitrary Code Execution in HPE Networking Fabric Composer

• RCE
• Локальное повышение привилегий

arubanetworks · fabric composer1 сент. 2026 г.

Dell PowerStore SDNAS contains a Missing Authentication for Critical Function vulnerability.

• Без аутентификации
• Обход аутентификации

dell · powerstoreos1 сент. 2026 г.

Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access

• Без аутентификации
• Обход аутентификации

arubanetworks · fabric composer1 сент. 2026 г.

Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon

• RCE без входа
• Обход аутентификации

arubanetworks · fabric composer1 сент. 2026 г.

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

• Обход пути

elastic · kibana1 сент. 2026 г.

Missing Authorization in Elasticsearch Leading to Information Disclosure

• Нарушение контроля доступа (IDOR)

elastic · elasticsearch1 сент. 2026 г.

Gvfs: sftp: heap-based buffer overflow in read_reply()

• RCE без входа
• Ошибки памяти

gnome · gvfs1 сент. 2026 г.

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

• RCE без входа
• Десериализация

PyPI · mlflow1 сент. 2026 г.

Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter

• RCE
• Десериализация

cypht-org · cypht1 сент. 2026 г.

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX

• RCE без входа
• Нарушение контроля доступа (IDOR)

hpe · arubaos-cx1 сент. 2026 г.

Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution

• RCE
• Нарушение контроля доступа (IDOR)

hpe · arubaos-cx1 сент. 2026 г.

Authenticated Remote Command Injection in AOS-CX Web-based Management Interface

• RCE
• Инъекция команд

hpe · arubaos-cx1 сент. 2026 г.

Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX

• RCE без входа
• Обход пути

hpe · arubaos-cx1 сент. 2026 г.

Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

• RCE
• Инъекция команд

hpe · arubaos-cx1 сент. 2026 г.

Unauthenticated Remote Command Execution in Management Component

• RCE без входа
• Инъекция команд

hpe · arubaos-cx1 сент. 2026 г.

Authentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CX

• Без аутентификации
• Обход аутентификации

hpe · arubaos-cx1 сент. 2026 г.

Authenticated Path Traversal Vulnerabilities Lead to Remote Code Execution in AOS-CX

• RCE
• Обход пути

hpe · arubaos-cx1 сент. 2026 г.

Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX

• RCE
• Инъекция команд

hpe · arubaos-cx1 сент. 2026 г.

Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface

• RCE
• Инъекция команд

hpe · arubaos-cx1 сент. 2026 г.

Local Privilege Escalation in AOS-CX Command Line Interface

• Локальное повышение привилегий

hpe · arubaos-cx1 сент. 2026 г.

Authenticated Arbitrary File Write Vulnerability Leading to Remote Code Execution in AOS-CX

• RCE
• Обход пути

hpe · arubaos-cx1 сент. 2026 г.

Improper Authentication Handling in AOS-CX Management Interface and API

• Без аутентификации
• Обход аутентификации

hpe · arubaos-cx1 сент. 2026 г.

Unauthenticated Denial-of-Service (DoS) Vulnerability in AOS-CX

• Без аутентификации
• Отказ в обслуживании

hpe · arubaos-cx1 сент. 2026 г.

Unauthenticated Buffer Overflow Vulnerability leads to Sensitive Information Disclosure in AOS-CX

• Без аутентификации
• Ошибки памяти

hpe · arubaos-cx1 сент. 2026 г.

Authenticated Sensitive Information Disclosure Vulnerabilities in AOS-CX

• Утечка информации

hpe · arubaos-cx1 сент. 2026 г.

Authenticated Signature Verification Bypass Leading to Arbitrary Code Execution in AOS-CX

• RCE
• Локальное повышение привилегий
• Слабая криптография

hpe · arubaos-cx1 сент. 2026 г.

Authorization Bypass Vulnerabilities Leading to Privilege Escalation in AOS-CX API Endpoint

• Без аутентификации
• Обход аутентификации

hpe · arubaos-cx1 сент. 2026 г.

Credential Manager Vulnerability Allows Unauthorized Administrative Access

• Без аутентификации
• Зашитые учётные данные

hpe · arubaos-cx1 сент. 2026 г.

Authentication Bypass Vulnerabilities Leading to Information Disclosure, Unauthorized Modification, and Service Disruption in AOS-CX

• Без аутентификации
• Обход аутентификации

hpe · arubaos-cx1 сент. 2026 г.

Lack of Cross-Site Request Forgery (CSRF) Protections for Certificate-Authenticated Sessions in AOS-CX

• RCE без входа
• CSRF

hpe · arubaos-cx1 сент. 2026 г.

Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management Interface

• RCE
• XSS

hpe · arubaos-cx1 сент. 2026 г.

Unauthenticated Format String Vulnerability leads to Remote Code Execution in AOS-CX

• RCE без входа

hpe · arubaos-cx1 сент. 2026 г.

Composer: Perforce source URL permits P4PORT `rsh:` command execution

• RCE без входа
• Инъекция команд

composer · composer1 сент. 2026 г.

Scrapy: S3DownloadHandler sends signed S3 requests over plaintext HTTP by default

• Без аутентификации
• Слабая криптография

scrapy · scrapy1 сент. 2026 г.

SVGO: removeScripts allows executable links through namespace and control-character bypasses

• Без аутентификации
• XSS

svg · svgo1 сент. 2026 г.

Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter

• Без аутентификации
• Обход аутентификации

proxmox server solutions gmbh · proxmox virtual environment (ve)1 сент. 2026 г.

Server-side request forgery vulnerability in GitHub Enterprise Server Manage API leaked a replayable gateway-agent bearer token

• Без аутентификации
• SSRF

github · enterprise server1 сент. 2026 г.

Race condition vulnerability was identified in GitHub Enterprise Server that allowed remote code execution

• RCE
• Состояние гонки

github · enterprise server1 сент. 2026 г.

Next.js: Unauthenticated Remote Code Execution on windows-hosted servers

• RCE без входа
• Обход пути

vercel · next.js1 сент. 2026 г.

Server-Side Request Forgery vulnerability in GitHub Enterprise Server allowed remote code execution via network access from pre-receive hooks to internal servic

• RCE
• SSRF

github · enterprise server1 сент. 2026 г.

A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.

• Без аутентификации
• SSRF

sonicwall · sma8200v1 сент. 2026 г.

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identi

• RCE
• Инъекция команд

sonicwall · sma8200v1 сент. 2026 г.

Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections

• RCE без входа
• Десериализация
• Инъекция команд

predis · predis1 сент. 2026 г.

Laravel Excel writes exports outside the configured filesystem disk when given a caller-controlled path

• Обход пути

spartnernl · laravel-excel1 сент. 2026 г.

Calendar invitation attachments could launch local executables

• Без аутентификации
• Загрузка файлов

mozilla · thunderbird1 сент. 2026 г.

Uninitialized memory in MIME parsing

• Без аутентификации

mozilla · thunderbird1 сент. 2026 г.

One byte overflow read in mail parser

• Без аутентификации

mozilla · thunderbird1 сент. 2026 г.

Information disclosure due to malicious IMAP server response

• Без аутентификации
• Ошибки памяти

mozilla · thunderbird1 сент. 2026 г.

Allowed UNC hostnames for attachments interpreted as a regular expression

• Без аутентификации
• Отказ в обслуживании

mozilla · thunderbird1 сент. 2026 г.

DataEdgePlatform DataMosaix™ Private Cloud

• Без аутентификации
• Обход аутентификации
• Зашитые учётные данные

rockwell automation · dataedgeplatform datamosaix™ private cloud1 сент. 2026 г.

OpenAI Codex Desktop for Windows and macOS automatically inspected Git metadata and working-tree status when a user opened a workspace.

• Без аутентификации

openai · codex desktop1 сент. 2026 г.

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifical

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

kamailio · kamailio1 сент. 2026 г.

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

• Без аутентификации
• Обход пути

npm · pnpm1 сент. 2026 г.

AVideo User_Location Plugin Unauthenticated SQL Injection

• Без аутентификации
• SQL-инъекция

wwbn · avideo1 сент. 2026 г.

WWBN AVideo Authentication Bypass via X-Real-IP Header

• Без аутентификации
• Обход аутентификации

wwbn · avideo1 сент. 2026 г.

WWBN AVideo Authentication Bypass via User-Agent Header

• Без аутентификации
• Обход аутентификации

wwbn · avideo1 сент. 2026 г.

WWBN AVideo Password Recovery Token Expiration Bypass

• Без аутентификации

wwbn · avideo1 сент. 2026 г.

WWBN AVideo Cross-Site Request Forgery via get_domain() validation

• Без аутентификации
• CSRF

wwbn · avideo1 сент. 2026 г.

Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record

• Без аутентификации
• Отказ в обслуживании

1 сент. 2026 г.

Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via

• RCE без входа
• Ошибки памяти

google · chrome1 сент. 2026 г.

Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to

• Без аутентификации

google · chrome1 сент. 2026 г.

Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox

• RCE без входа
• Ошибки памяти

google · chrome1 сент. 2026 г.

Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the

• RCE без входа
• Ошибки памяти

google · chrome1 сент. 2026 г.

Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary co

• RCE
• Нарушение контроля доступа (IDOR)

google · chrome1 сент. 2026 г.

Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proce

• RCE без входа
• Нарушение контроля доступа (IDOR)

google · chrome1 сент. 2026 г.

Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via

• RCE без входа
• Ошибки памяти

google · chrome1 сент. 2026 г.

Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to exec

• RCE без входа
• Ошибки памяти

google · chrome1 сент. 2026 г.

Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitr

• RCE без входа
• Ошибки памяти

google · chrome1 сент. 2026 г.

Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proc

• RCE без входа
• Ошибки памяти

google · chrome1 сент. 2026 г.

Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside th

• RCE без входа
• Ошибки памяти

google · chrome1 сент. 2026 г.

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engine

• RCE без входа
• Ошибки памяти

google · chrome1 сент. 2026 г.

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to exe

• RCE без входа
• Нарушение контроля доступа (IDOR)

google · chrome1 сент. 2026 г.

Coolify before 4.2.0 Remote Code Execution via Environment Variable Key

• RCE
• Инъекция команд

coollabsio · coolify1 сент. 2026 г.

BookStack before 26.05.4 Stored XSS via Drawing Upload

• XSS

bookstackapp · bookstack1 сент. 2026 г.

Phison PS3111-S11 Controller Firmware Missing Authentication on Vendor Unique Commands

• Обход аутентификации
• Локальное повышение привилегий

phison electronics corporation · ps3111-s11 controller firmware1 сент. 2026 г.

PX4 Autopilot sd_bench Heap Buffer Overflow via Block Size

• Без аутентификации
• Ошибки памяти

px4 · px4-autopilot1 сент. 2026 г.

Team Password Manager before 14.184.308 Authentication Bypass in Password Reset

• Без аутентификации
• Обход аутентификации

team password manager · team password manager1 сент. 2026 г.

Pika Unauthenticated Replication Access via Internal Protobuf Port

• Без аутентификации
• Обход аутентификации

openatomfoundation · pikiwidb1 сент. 2026 г.

facefusion before 3.7.0 Path Traversal via Job Identifier

• Без аутентификации
• Обход пути

facefusion · facefusion1 сент. 2026 г.

js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources

• Без аутентификации
• Отказ в обслуживании

nodeca · js-yaml1 сент. 2026 г.

ION-DTN before 4.2.0 Out-of-Bounds Read via decodeSdnv

• Без аутентификации
• Ошибки памяти

nasa-jpl · ion-dtn1 сент. 2026 г.

APITable through 1.13.0-beta.1 Missing Authentication on the Internal Organization Load or Search Endpoint

• Без аутентификации
• Обход аутентификации

apitable · apitable1 сент. 2026 г.

FeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update

• Нарушение контроля доступа (IDOR)

mythicalltd · featherpanel1 сент. 2026 г.

FIPS mode assertion failure via malicious CERT payload

• RCE без входа
• Отказ в обслуживании

the libreswan project · libreswan1 сент. 2026 г.

WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deletion via 'remoteurl' Parameter

• RCE
• Обход пути

joomunited · wp file download1 сент. 2026 г.

Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'

• Без аутентификации

melograno · booking for appointments and events calendar – amelia2 сент. 2026 г.

Advanced Custom Fields: Extended < 0.9.2.7 - Unauthenticated Administrator Account Takeover via Front-End User Update Action

• Без аутентификации
• Обход аутентификации

unknown · advanced custom fields: extended2 сент. 2026 г.

Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters

• Без аутентификации
• XSS

unknown · photo gallery by 10web2 сент. 2026 г.

DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter

• RCE
• Нарушение контроля доступа (IDOR)

dplugins · devkit pro2 сент. 2026 г.

WP User Frontend < 4.3.11 - Subscriber+ PHP Object Injection via Frontend Post Edit Form

• RCE
• Десериализация

unknown · user frontend2 сент. 2026 г.

JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection

unknown · jetbackup2 сент. 2026 г.