Эксплуатируемые и новые серьёзные CVE: сентябрь 2026 г.

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Pr

• Без аутентификации

cisco · cisco secure firewall adaptive security appliance (asa) software16 сент. 2026 г.

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('O

• RCE
• Локальное повышение привилегий
• Инъекция команд

dell · update package framework16 сент. 2026 г.

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability.

• Локальное повышение привилегий

dell · update package framework16 сент. 2026 г.

Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability

• Без аутентификации
• Нарушение контроля доступа (IDOR)

cisco · cisco secure firewall management center (fmc)16 сент. 2026 г.

Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field

• Без аутентификации
• XSS
• CSRF

concretecms · concrete cms16 сент. 2026 г.

Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block

• XSS

concretecms · concrete cms16 сент. 2026 г.

oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

• Без аутентификации
• Обход пути

oras-project · oras-go16 сент. 2026 г.

Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability.

• Без аутентификации
• Ошибки памяти

dell · update package framework16 сент. 2026 г.

Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability.

dell · repository manager16 сент. 2026 г.

Ruijie RG-EW3000GX user_list_note admin os command injection

• RCE
• Инъекция команд

ruijie · rg-ew3000gx16 сент. 2026 г.

Guns through 8.3.5 Information Disclosure via Missing Permission Check

• Нарушение контроля доступа (IDOR)

stylefeng · guns16 сент. 2026 г.

Guns through 8.3.5 Improper Access Control via SysNoticeController

• Нарушение контроля доступа (IDOR)

stylefeng · guns16 сент. 2026 г.

TDuck survey form through 5.3 Server-Side Request Forgery via Unvalidated Webhook URL

• SSRF

tduckcloud · tduck-survey-form16 сент. 2026 г.

ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController

• Нарушение контроля доступа (IDOR)

continew-org · continew-admin16 сент. 2026 г.

Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

• Без аутентификации
• Отказ в обслуживании

isc · bind 916 сент. 2026 г.

djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

• Без аутентификации
• Обход аутентификации

djust-org · djust16 сент. 2026 г.

Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler

djust-org · djust16 сент. 2026 г.

SIMAC MyPHR 1.1 IDOR Account Takeover via /api/employes/put/{id}

• Нарушение контроля доступа (IDOR)

simac · myphr16 сент. 2026 г.

An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_hel

• RCE без входа

16 сент. 2026 г.

Unauthenticated remote crash of named via a single DoH SIG(0) request

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

isc · bind 916 сент. 2026 г.

SVCB AliasMode additional-data error leaks qpcache references

• Без аутентификации
• Отказ в обслуживании

isc · bind 916 сент. 2026 г.

Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees

• Без аутентификации
• Отказ в обслуживании

isc · bind 916 сент. 2026 г.

Scirius through 3.8.0 Arbitrary File Write via PCAP Upload

• Обход пути

stamusnetworks · scirius16 сент. 2026 г.

IRIS through 2.4.29 Unauthorized Comment Access via Object ID

• Нарушение контроля доступа (IDOR)

dfir-iris · iris-web16 сент. 2026 г.

Shuffle through 2.2.1 API Key Reset Cross-Tenant Privilege Escalation

• Нарушение контроля доступа (IDOR)

shuffle · shuffle16 сент. 2026 г.

Covenant through 0.6 Missing Authentication on the CovenantHub SignalR Hub

• Без аутентификации
• Обход аутентификации

cobbr · covenant16 сент. 2026 г.

Nuclei from 3.7.0 before 3.11.1 Template Signature Bypass via Modification-Time-Only Cache

• RCE
• Слабая криптография

projectdiscovery · nuclei16 сент. 2026 г.

Quickwit through 0.9.0 SSRF via SQS queue_url Parameter

• Без аутентификации
• SSRF

quickwit-oss · quickwit16 сент. 2026 г.

Kubero through 3.1.1 Unauthenticated Notifications API Access

• Без аутентификации
• Обход аутентификации

kubero-dev · kubero16 сент. 2026 г.

A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

16 сент. 2026 г.

Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`

• RCE
• Локальное повышение привилегий

redocly · redocly-cli16 сент. 2026 г.

Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability

• Без аутентификации
• SSRF

apache software foundation · apache myfaces16 сент. 2026 г.

Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administ

• RCE без входа

arista networks · eos16 сент. 2026 г.

On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacen

• Без аутентификации
• Ошибки памяти

arista networks · eos16 сент. 2026 г.

Use-after-free in query_addnoqnameproof() via the DNS64 filter64 path

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

isc · bind 916 сент. 2026 г.

RabbitMQ Java client: Frame-level OOM: Math.min(maxInboundMessageBodySize, 0) defeats frame size enforcement

• Без аутентификации
• Отказ в обслуживании

rabbitmq · rabbitmq-java-client16 сент. 2026 г.

RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

• Без аутентификации

modelcontextprotocol · rust-sdk16 сент. 2026 г.

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

• Без аутентификации
• Отказ в обслуживании

modelcontextprotocol · rust-sdk16 сент. 2026 г.

An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrar

• RCE

16 сент. 2026 г.

named aborts on a TKEY query when the user configuration has no global options statement

• Без аутентификации
• Отказ в обслуживании

isc · bind 916 сент. 2026 г.

CoreDNS: Unauthenticated memory exhaustion in custom transports

• Без аутентификации
• Отказ в обслуживании

coredns · coredns16 сент. 2026 г.

CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

• Без аутентификации

coredns · coredns16 сент. 2026 г.

Skipper: OPA body-authz bypass: truncated_body mitigation fails open on chunked/HTTP-2 (incomplete fix CVE-2026-50197)

• Без аутентификации
• Нарушение контроля доступа (IDOR)

zalando · skipper16 сент. 2026 г.

Validating resolver can abort while caching a mismatched NOQNAME proof

• Без аутентификации
• Отказ в обслуживании

isc · bind 916 сент. 2026 г.

Pocketbase: Unhandled panic in worker goroutines

• Без аутентификации

pocketbase · pocketbase16 сент. 2026 г.

react/http: A malformed HTTP chunked body can lead to a denial-of-service and peg the CPU

• Без аутентификации
• Отказ в обслуживании

reactphp · http16 сент. 2026 г.

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

• RCE без входа
• Ошибки памяти

hp · linux imaging and printing16 сент. 2026 г.

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

• RCE без входа
• Ошибки памяти

hp · linux imaging and printing16 сент. 2026 г.

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

• RCE
• Локальное повышение привилегий
• Инъекция команд

hp · linux imaging and printing16 сент. 2026 г.

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

• RCE без входа
• Ошибки памяти

hp · linux imaging and printing16 сент. 2026 г.

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

• RCE без входа
• Ошибки памяти

hp · linux imaging and printing16 сент. 2026 г.

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

• RCE без входа
• Ошибки памяти

hp · linux imaging and printing16 сент. 2026 г.

Backstage: Improper input validation in TechDocs MkDocs configuration

linuxfoundation · backstage plugin-techdocs-node16 сент. 2026 г.

Open5GS PFCP types.c ogs_pfcp_parse_volume_measurement null pointer dereference

16 сент. 2026 г.

SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints

• Без аутентификации
• Обход аутентификации

signoz · signoz16 сент. 2026 г.

Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability.

• Без аутентификации
• Обход аутентификации

dell · objectscale16 сент. 2026 г.

LMdeploy has Remote Code Execution by Pickle Deserialization via zmq_rpc.call_and_response() in InterLM/lmdeploy

• RCE без входа
• Десериализация

internlm · lmdeploy16 сент. 2026 г.

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

• Без аутентификации
• CSRF

djust-org · djust16 сент. 2026 г.

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust-org · djust16 сент. 2026 г.

Cisco Identity Services Engine Hardening Release - Improper Neutralization Vulnerabilities

• Без аутентификации

cisco · identity services engine16 сент. 2026 г.

Cisco Identity Services Engine Remote Code Execution Vulnerability

• RCE
• Инъекция команд

cisco · cisco identity services engine software16 сент. 2026 г.

Cisco Identity Services Engine Hardening Release - Access Control Vulnerabilities

• Без аутентификации
• Нарушение контроля доступа (IDOR)

cisco · identity services engine16 сент. 2026 г.

Cisco Identity Services Engine Hardening Release - Incorrect Resource Transfer Vulnerabilities

cisco · cisco identity services engine software16 сент. 2026 г.

Cisco Identity Services Engine Remote Code Execution Vulnerability

• RCE
• Десериализация

cisco · cisco identity services engine software16 сент. 2026 г.

Cisco Identity Services Engine Hardening Release - Input Validation Vulnerabilities

cisco · cisco identity services engine software16 сент. 2026 г.

Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

• RCE без входа
• Десериализация

cisco · cisco secure firewall management center (fmc)16 сент. 2026 г.

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Access Control

• Нарушение контроля доступа (IDOR)

cisco · cisco nexus dashboard16 сент. 2026 г.

Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability

• RCE
• Нарушение контроля доступа (IDOR)

cisco · cisco secure firewall management center (fmc)16 сент. 2026 г.

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Improper Neutralization of Special Elements used in a Command

• RCE
• Инъекция команд

cisco · cisco nexus dashboard16 сент. 2026 г.

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - Missing Authentication for Critical Function

• Без аутентификации
• Обход аутентификации

cisco · cisco nexus dashboard16 сент. 2026 г.

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Ex

cisco · cisco secure firewall adaptive security appliance (asa) software16 сент. 2026 г.

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Im

cisco · cisco secure firewall adaptive security appliance (asa) software16 сент. 2026 г.

Cisco Secure Firewall Management Center Software sftunnel Deserialization Root Command Execution Vulnerability

• RCE
• Десериализация

cisco · cisco secure firewall management center (fmc)16 сент. 2026 г.

Cisco Nexus Dashboard Software Security Hardening Release September 2026 - SQL Injection

• SQL-инъекция

cisco · cisco nexus dashboard16 сент. 2026 г.

Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests

• Без аутентификации

apache · nifi16 сент. 2026 г.

Cisco ISE API Authentication Bypass Vulnerability

• Без аутентификации
• Обход аутентификации

cisco · cisco identity services engine software16 сент. 2026 г.

Apache MyFaces: Denial of Service via Unbounded Request Parsing

• Без аутентификации
• Отказ в обслуживании

apache software foundation · apache myfaces16 сент. 2026 г.

Tanium addressed a SQL injection vulnerability in Asset.

• SQL-инъекция

tanium · asset16 сент. 2026 г.

Tanium addressed a SQL injection vulnerability in Asset.

• SQL-инъекция

tanium · asset16 сент. 2026 г.

Tanium addressed a SQL injection vulnerability in Threat Response.

• SQL-инъекция

tanium · threat response16 сент. 2026 г.

Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

• Обход пути

apache · nifi16 сент. 2026 г.

kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF).

• Без аутентификации
• SSRF

16 сент. 2026 г.

HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write

• RCE без входа

hp inc · hp ac print & scan16 сент. 2026 г.

HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write

• RCE без входа

hp inc · hp ac print & scan16 сент. 2026 г.

HP Advance – Potential Elevation of Privilege, Remote Code Execution & Arbitrary File Write

• RCE без входа
• Обход пути

hp inc · hp ac print & scan16 сент. 2026 г.

Server-Side Request Forgery in Altium Enterprise Server UnifiedLogin Service Allows Unauthenticated System Compromise

• Без аутентификации
• Обход аутентификации
• SSRF

altium · altium enterprise server16 сент. 2026 г.

Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability

• Без аутентификации
• Ошибки памяти
• Отказ в обслуживании

cisco · cisco secure firewall threat defense (ftd) software16 сент. 2026 г.

Cisco Secure Firewall Adaptive Security Appliance Software and Secure Firewall Threat Defense Software Logging Denial of Service

• Без аутентификации
• Отказ в обслуживании

cisco · cisco secure firewall adaptive security appliance (asa) software16 сент. 2026 г.

Cisco Secure Adaptive Security Appliance Software and Secure Firewall Threat Defense Software EIGRP Denial of Service Vulnerability

• Без аутентификации
• Отказ в обслуживании

cisco · cisco secure firewall adaptive security appliance (asa) software16 сент. 2026 г.

Cisco Identity Services Engine Unauthenticated SQL Injection Vulnerability

• Без аутентификации
• SQL-инъекция

cisco · cisco identity services engine software16 сент. 2026 г.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software IKEv2 Certificate Authentication Denial of Service Vulnerability

• Без аутентификации
• Отказ в обслуживании

cisco · cisco secure firewall adaptive security appliance (asa) software16 сент. 2026 г.

Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software for Firepower 3100 and 4200 Series DTLS Denial of Service Vulnerab

• Без аутентификации
• Отказ в обслуживании

cisco · cisco secure firewall adaptive security appliance (asa) software16 сент. 2026 г.

Cisco Identity Search Engine SXP REST API SQL Injection Vulnerability

• SQL-инъекция

cisco · cisco identity services engine software16 сент. 2026 г.

Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Memory Exhaustion Denial of Service Vulnerability

• Без аутентификации
• Отказ в обслуживании

cisco · cisco secure firewall management center (fmc)16 сент. 2026 г.

Cisco Identity Services Engine SQL Injection Vulnerability

• SQL-инъекция

cisco · cisco identity services engine software16 сент. 2026 г.

Cisco Secure Firewall Management Center and Secure Firewall Threat Defense Software sftunnel Unauthorized Authentication Bypass Vulnerability

• Без аутентификации
• Обход аутентификации
• Слабая криптография

cisco · cisco secure firewall management center (fmc)16 сент. 2026 г.

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Im

• Нарушение контроля доступа (IDOR)

cisco · cisco secure firewall adaptive security appliance (asa) software16 сент. 2026 г.

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - In

cisco · cisco secure firewall adaptive security appliance (asa) software16 сент. 2026 г.

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Co

cisco · cisco secure firewall adaptive security appliance (asa) software16 сент. 2026 г.

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - In

• Без аутентификации

cisco · cisco secure firewall adaptive security appliance (asa) software16 сент. 2026 г.