Эксплуатируемые и новые серьёзные CVE: сентябрь 2026 г.

Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler

• Без аутентификации
• XSS

unknown · social media share buttons & social sharing icons2 сент. 2026 г.

Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas

• Нарушение контроля доступа (IDOR)

unknown · rank math seo2 сент. 2026 г.

RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field

• Без аутентификации
• XSS

unknown · registrationmagic2 сент. 2026 г.

SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field

• RCE без входа
• Обход пути

bdthemes · sigmaforms pro – ai generated forms2 сент. 2026 г.

Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action

• Без аутентификации

unknown · advanced custom fields: extended2 сент. 2026 г.

MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route

• Без аутентификации
• Утечка информации

unknown · masterstudy lms wordpress plugin2 сент. 2026 г.

FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information

• Без аутентификации
• XSS

unknown · faq builder ays2 сент. 2026 г.

Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification

• Без аутентификации
• XSS

unknown · simple ajax chat2 сент. 2026 г.

OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion

• Без аутентификации
• Обход аутентификации

unknown · oauth single sign on2 сент. 2026 г.

WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

marcus · login with ajax2 сент. 2026 г.

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405

• SQL-инъекция

zohocorp · manageengine password manager pro2 сент. 2026 г.

Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log

• Без аутентификации
• XSS

wpmudev · broken link checker2 сент. 2026 г.

Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction

• SQL-инъекция

baserow · baserow2 сент. 2026 г.

Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.

• Без аутентификации
• Обход аутентификации

oxford nanopore · minknow2 сент. 2026 г.

Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.

• RCE
• Инъекция команд

westermo · weos2 сент. 2026 г.

RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX

• Без аутентификации
• Обход пути

progress software · telerik ui for asp.net ajax2 сент. 2026 г.

DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX

• RCE без входа

progress software · telerik ui for asp.net ajax2 сент. 2026 г.

In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by

eclipse foundation · eclipse ditto2 сент. 2026 г.

WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability

• Десериализация

wedevs · wp user frontend2 сент. 2026 г.

WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability

• Без аутентификации
• SQL-инъекция

wc lovers · wcfm marketplace2 сент. 2026 г.

WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

wp swings · upsell order bump offer for woocommerce2 сент. 2026 г.

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

sonaar · mp3 audio player for music, radio & podcast by sonaar2 сент. 2026 г.

WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability

• Без аутентификации

paul ryan · authorizer2 сент. 2026 г.

WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability

liquidthemes · booking hub2 сент. 2026 г.

WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

mapgeo · interactive geo maps2 сент. 2026 г.

WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

trustedsite · trustedsite2 сент. 2026 г.

WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability

• Без аутентификации
• Десериализация

saturday drive · ninja forms - layout & styles2 сент. 2026 г.

WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability

• Без аутентификации
• XSS

estatik · estatik2 сент. 2026 г.

WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability

• Без аутентификации
• CSRF

elementor · activity log2 сент. 2026 г.

WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability

• Без аутентификации
• CSRF

nsquared · simply schedule appointments2 сент. 2026 г.

WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability

• Без аутентификации
• CSRF

kitae park · mang board wp2 сент. 2026 г.

Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset

• Нарушение контроля доступа (IDOR)

craftcms · cms2 сент. 2026 г.

Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance

• Без аутентификации
• Обход аутентификации

craftcms · cms2 сент. 2026 г.

Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass

• Нарушение контроля доступа (IDOR)

craftcms · cms2 сент. 2026 г.

Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite

• Нарушение контроля доступа (IDOR)

craftcms · cms2 сент. 2026 г.

Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file

• Нарушение контроля доступа (IDOR)

craftcms · cms2 сент. 2026 г.

Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers

• Обход аутентификации
• Нарушение контроля доступа (IDOR)

craftcms · cms2 сент. 2026 г.

SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist

• XSS

siyuan-note · siyuan2 сент. 2026 г.

Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095

• Без аутентификации
• Нарушение контроля доступа (IDOR)

centarro · commerce paypal2 сент. 2026 г.

Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102

• XSS

drupal · screenshot2 сент. 2026 г.

Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload

• Без аутентификации
• Загрузка файлов

unknown · embed html5 game2 сент. 2026 г.

WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console

• RCE

unknown · watchman-site72 сент. 2026 г.

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

• Обход пути

elastic · kibana2 сент. 2026 г.

Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM

• Локальное повышение привилегий

elastic · elastic agent2 сент. 2026 г.

Arbitrary user password reset leading to administrator account takeover

• Нарушение контроля доступа (IDOR)

craftcms · cms2 сент. 2026 г.

GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete

• Нарушение контроля доступа (IDOR)

craftcms · cms2 сент. 2026 г.

Authenticated SQL Injection via nested eager-loading criteria

• SQL-инъекция

craftcms · cms2 сент. 2026 г.

In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Ga

• Без аутентификации
• Слабая криптография

eclipse foundation · eclipse aerios2 сент. 2026 г.

WordPress WooCommerce Product Attachment plugin <= 2.3.4 - Sensitive Data Exposure vulnerability

• Без аутентификации
• Утечка информации

dotstore · woocommerce product attachment2 сент. 2026 г.

Session takeover via Auth Proxy cache key collision

• Обход аутентификации

grafana · grafana2 сент. 2026 г.

The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps.

• Локальное повышение привилегий
• Нарушение контроля доступа (IDOR)

motorola · smart connect application2 сент. 2026 г.

NGINX ngx_http_js_module vulnerability

• Без аутентификации

f5 · nginx javascript2 сент. 2026 г.

Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation

• RCE без входа
• Инъекция команд

as203038 · looking-glass2 сент. 2026 г.

Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX config

f5 · nginx gateway fabric2 сент. 2026 г.

BIG-IP and BIG-IQ Configuration utility vulnerability

• SSRF

f5 · big-ip2 сент. 2026 г.

NGINX Ingress Controller vulnerability

f5 · nginx ingress controller2 сент. 2026 г.

NGINX ngx_http_js_module vulnerability

• Без аутентификации
• Ошибки памяти

f5 · nginx javascript2 сент. 2026 г.

NGINX ngx_http_js_module vulnerablility

• Без аутентификации
• Ошибки памяти

f5 · nginx javascript2 сент. 2026 г.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confi

• RCE

jenkins · jenkins2 сент. 2026 г.

In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier,

• Десериализация

jenkins project · jenkins2 сент. 2026 г.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timesta

• Без аутентификации
• XSS

jenkins · jenkins2 сент. 2026 г.

In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 th

• Без аутентификации
• CSRF

jenkins project · jenkins2 сент. 2026 г.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to

• Десериализация

jenkins · jenkins2 сент. 2026 г.

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me

jenkins · jenkins2 сент. 2026 г.

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner

• XSS

jenkins project · jenkins sonarqube scanner plugin2 сент. 2026 г.

Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing atta

• Обход пути

jenkins project · jenkins thinbackup plugin2 сент. 2026 г.

Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data bindi

• Нарушение контроля доступа (IDOR)

jenkins project · jenkins saml plugin2 сент. 2026 г.

A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish A

• Обход пути

jenkins project · jenkins allure plugin2 сент. 2026 г.

Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached

• RCE
• Десериализация

jenkins project · jenkins performance plugin2 сент. 2026 г.

Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file sys

• RCE
• Обход пути

jenkins project · jenkins file parameter plugin2 сент. 2026 г.

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's

• Нарушение контроля доступа (IDOR)

jenkins project · jenkins microsoft entra id (previously azure ad) plugin2 сент. 2026 г.

Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler

• XSS

jenkins project · jenkins customizable header plugin2 сент. 2026 г.

OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable v

• RCE
• Инъекция команд

jenkins project · jenkins tics plugin2 сент. 2026 г.

Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability

• RCE без входа

cisco · cisco nx-os software2 сент. 2026 г.

Cisco IOS XR Software Security Hardening Release: September 2026

• Без аутентификации

cisco · ios xr2 сент. 2026 г.

Cisco IOS XR Software Security Hardening Release: September 2026

• Без аутентификации

cisco · cisco ios xr software2 сент. 2026 г.

Cisco IOS XR Software Security Hardening Release: September 2026

• Без аутентификации
• Отказ в обслуживании

cisco · ios xr2 сент. 2026 г.

Cisco IOS XR Software Security Hardening Release: September 2026

• Без аутентификации

cisco · cisco ios xr software2 сент. 2026 г.

Cisco IOS XR Software Security Hardening Release: September 2026

cisco · cisco ios xr software2 сент. 2026 г.

Cisco IOS XR Software Security Hardening Release: September 2026

• Без аутентификации
• Нарушение контроля доступа (IDOR)

cisco · cisco ios xr software2 сент. 2026 г.

Cisco IOS XR Software Security Hardening Release: September 2026

cisco · ios xr2 сент. 2026 г.

Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability

• Без аутентификации
• Отказ в обслуживании

cisco · cisco session initiation protocol (sip) software2 сент. 2026 г.

Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project

• Нарушение контроля доступа (IDOR)

nuclio · nuclio2 сент. 2026 г.

Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE

• RCE
• Инъекция команд

nuclio · nuclio2 сент. 2026 г.

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

• Обход аутентификации
• Обход пути

nuclio · nuclio2 сент. 2026 г.

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

• RCE

nuclio · nuclio2 сент. 2026 г.

Open edX Platform: Insufficient Permission on set_course_mode_price()

• Нарушение контроля доступа (IDOR)

openedx · openedx-platform2 сент. 2026 г.

Nuclio: Kaniko build tempDir command injection

• RCE
• Инъекция команд

nuclio · nuclio2 сент. 2026 г.

Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)

• RCE
• Инъекция команд

nuclio · nuclio2 сент. 2026 г.

Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform

• RCE без входа
• Инъекция команд

nuclio · nuclio2 сент. 2026 г.

TOON: Prototype pollution when decoding untrusted TOON input

• Без аутентификации
• Prototype pollution

toon-format · toon2 сент. 2026 г.

Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode

• Без аутентификации

tencent · ai-infra-guard2 сент. 2026 г.

claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan

• Без аутентификации

claude-world · claude-skill-antivirus2 сент. 2026 г.

agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode

• RCE без входа

agentverus · agentverus-scanner2 сент. 2026 г.

Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102

• Загрузка файлов

drupal · screenshot2 сент. 2026 г.

Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2

• Отказ в обслуживании

malach-it · boruta-server2 сент. 2026 г.

DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN

• RCE

dspace · dspace2 сент. 2026 г.

Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE

• RCE без входа
• Обход аутентификации

bishopfox · joro2 сент. 2026 г.

PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification

• Без аутентификации

vbpf · prevail2 сент. 2026 г.

PREVAIL: Context-write no-op in do_mem_store allows unsafe eBPF programs to pass verification

• Без аутентификации

vbpf · prevail2 сент. 2026 г.