Эксплуатируемые и новые серьёзные CVE: сентябрь 2026 г.

Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attri

• RCE

pdfcrowd · save as pdf plugin by pdfcrowd18 сент. 2026 г.

Totolink A3002MU formWlWds buffer overflow

• Без аутентификации
• Ошибки памяти

totolink · a3002mu19 сент. 2026 г.

WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import

unknown · wp import export lite19 сент. 2026 г.

Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter

• Без аутентификации
• XSS

unknown · estatik real estate plugin19 сент. 2026 г.

Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains

• Нарушение контроля доступа (IDOR)

unknown · unbounce landing pages19 сент. 2026 г.

Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

• Без аутентификации
• XSS

unknown · ultimate member19 сент. 2026 г.

Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route

• Без аутентификации
• Нарушение контроля доступа (IDOR)

unknown · botiga pro19 сент. 2026 г.

UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email

• Без аутентификации

unknown · userswp19 сент. 2026 г.

Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings

• Без аутентификации
• XSS

unknown · master blocks19 сент. 2026 г.

VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi

• Без аутентификации
• SQL-инъекция

unknown · vikrentitems flexible rental management system19 сент. 2026 г.

WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting

• Без аутентификации
• Нарушение контроля доступа (IDOR)

unknown · wpgraphql smart cache19 сент. 2026 г.

MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure

• Без аутентификации
• Утечка информации

unknown · mgosync19 сент. 2026 г.

Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value

• Без аутентификации
• XSS

mdmag · quill forms | conversational multi step forms, surveys & quizzes19 сент. 2026 г.

The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter

• RCE

sebwordpress · the welcomizer19 сент. 2026 г.

Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortco

• RCE

properfraction · paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress19 сент. 2026 г.

YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action

• Без аутентификации
• Утечка информации

ysinnovations · ys leadgen – popup builder, popup maker & form builder for wordpress | lead generation, email marketing, sales, conversions, opt-ins & subscribers19 сент. 2026 г.

Totolink A3002MU formWsc command injection

• RCE
• Инъекция команд

totolink · a3002mu19 сент. 2026 г.

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

• Без аутентификации

19 сент. 2026 г.

`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

• Обход пути

19 сент. 2026 г.

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width

• Без аутентификации
• Отказ в обслуживании

19 сент. 2026 г.

OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE

• RCE

openpanel-dev · openpanel19 сент. 2026 г.

Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership

• Нарушение контроля доступа (IDOR)

red hat · red hat build of keycloak19 сент. 2026 г.

Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector

• Нарушение контроля доступа (IDOR)

argoproj · argo-workflows19 сент. 2026 г.

Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal

• Без аутентификации
• Обход пути

gopeedlab · gopeed19 сент. 2026 г.

Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout

• RCE без входа

mistralai · mistral-vibe19 сент. 2026 г.

Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from

• Без аутентификации
• Ошибки памяти

exim · exim19 сент. 2026 г.

D-Link R95 DHMAPI ssi system os command injection

• RCE
• Инъекция команд

d-link · r9519 сент. 2026 г.

QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

• Обход пути

webkul · qloapps19 сент. 2026 г.

Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate

• Без аутентификации

libexpat · libexpat19 сент. 2026 г.

A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

zte · smartlife20 сент. 2026 г.

A password reset vulnerability in ZTE SmartLife APP

zte · smartlife20 сент. 2026 г.

NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication

• Без аутентификации
• Обход аутентификации

nginxproxymanager · nginx-proxy-manager20 сент. 2026 г.

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even th

• Без аутентификации

oisf · suricata20 сент. 2026 г.

Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with

• Без аутентификации
• Ошибки памяти

oisf · suricata20 сент. 2026 г.

NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import

• RCE
• Загрузка файлов

unknown · photo gallery, sliders, proofing and themes20 сент. 2026 г.

SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching

• Без аутентификации

unknown · saml single sign on20 сент. 2026 г.

Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection

• Десериализация

unknown · unlimited elements for elementor20 сент. 2026 г.

Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

• RCE

unknown · forminator forms20 сент. 2026 г.

Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion

• Без аутентификации
• Нарушение контроля доступа (IDOR)

unknown · tripzzy20 сент. 2026 г.

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users

unknown · import and export users and customers20 сент. 2026 г.

Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer

unknown · import and export users and customers20 сент. 2026 г.

Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow

• Без аутентификации
• Ошибки памяти

comfast · cf-n1-s20 сент. 2026 г.

NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager

• RCE
• Загрузка файлов

nivocart · nivocart20 сент. 2026 г.

getID3 before 1.9.26 OS Command Injection via Unescaped Filenames

• RCE
• Инъекция команд

james-heinrich · getid320 сент. 2026 г.

NivoCart through 2.4.0 Predictable Administrator Password Reset Token

• Без аутентификации
• Слабая криптография

nivocart · nivocart20 сент. 2026 г.

getID3 through 1.9.26 XML External Entity Injection via XML2array

• Без аутентификации
• SSRF
• XXE

james-heinrich · getid320 сент. 2026 г.

Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon

• Обход аутентификации

tencent · browserskill20 сент. 2026 г.

mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack

• Без аутентификации
• Обход аутентификации

mayswind · ezbookkeeping20 сент. 2026 г.

Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints

• Нарушение контроля доступа (IDOR)

frappe · erpnext20 сент. 2026 г.

An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in whic

• RCE без входа
• Обход пути

vanderbilt university · redcap20 сент. 2026 г.

D-Link DIR-X1860/DIR-X1860Z routerd ubus access control

• Без аутентификации

d-link · dir-x186020 сент. 2026 г.

openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer

• RCE
• SSTI

openequella · openequella20 сент. 2026 г.

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

• Без аутентификации
• SQL-инъекция

ordasoft.com · ordasoft joomla gallery free extension for joomla20 сент. 2026 г.

Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

• SQL-инъекция

ordasoft.com · ordasoft joomla gallery free extension for joomla20 сент. 2026 г.

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

• RCE

ordasoft.com · ordasoft joomla gallery free extension for joomla20 сент. 2026 г.

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

• RCE
• Загрузка файлов

ordasoft.com · ordasoft joomla gallery free extension for joomla20 сент. 2026 г.

D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow

• Без аутентификации
• Ошибки памяти

d-link · dir-868l20 сент. 2026 г.

Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection

• RCE
• Инъекция команд

netcore · nbr200v220 сент. 2026 г.

Netcore NBR200V2 LAN IP Configuration network_tools command injection

• RCE
• Инъекция команд

netcore · nbr200v220 сент. 2026 г.

Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection

• RCE без входа
• Инъекция команд

netcore · nbr200v220 сент. 2026 г.

Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection

• RCE
• Инъекция команд

netcore · nbr200v220 сент. 2026 г.

Netcore NBR200V2 Backup Restore restore.cgi command injection

• RCE
• Инъекция команд

netcore · nbr200v220 сент. 2026 г.

Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflow

• Ошибки памяти

netcore · nbr200v220 сент. 2026 г.

Netcore NBR200V2 routerd vlan_load_form_uci buffer overflow

• Ошибки памяти

netcore · nbr200v220 сент. 2026 г.

BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where

• Ошибки памяти

biostar · vivid led dj20 сент. 2026 г.

BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where

• Ошибки памяти

biostar · valkyrie aurora20 сент. 2026 г.

BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-where

• Ошибки памяти

biostar · temperature monitor utility21 сент. 2026 г.

WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload

• Без аутентификации
• Загрузка файлов

unknown · web to print online designer21 сент. 2026 г.

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebVie

• Без аутентификации

canva · canva21 сент. 2026 г.

BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where

• Ошибки памяти

biostar · bios update utility21 сент. 2026 г.

Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate

• Без аутентификации
• Отказ в обслуживании

apache software foundation · apache mina21 сент. 2026 г.

temporalio/sqlparser malformed MySQL version comments can cause a panic

• Без аутентификации

temporal technologies, inc. · temporalio/sqlparser21 сент. 2026 г.

Temporal Server Schedule exclusion search can cause excessive CPU consumption

temporal technologies, inc. · temporal server21 сент. 2026 г.

temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal

• Без аутентификации
• Отказ в обслуживании

temporal technologies, inc. · temporalio/sqlparser21 сент. 2026 г.

temporalio/tchannel-go malformed checksum type causes process termination

• Без аутентификации

temporal technologies, inc. · temporalio/tchannel-go21 сент. 2026 г.

temporalio/tchannel-go zero-chunk call fragment causes process termination

• Без аутентификации

temporal technologies, inc. · temporalio/tchannel-go21 сент. 2026 г.

temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip

• Без аутентификации
• Отказ в обслуживании

temporal technologies, inc. · temporalio/ringpop-go21 сент. 2026 г.

Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

temporal technologies, inc. · temporal server21 сент. 2026 г.

Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host

• RCE
• Инъекция команд

temporal technologies, inc. · temporal server21 сент. 2026 г.

Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service

• Без аутентификации
• Отказ в обслуживании

apache · neethi21 сент. 2026 г.

Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion

• Без аутентификации
• Отказ в обслуживании

apache · neethi21 сент. 2026 г.

Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service

• Без аутентификации
• Отказ в обслуживании

apache · neethi21 сент. 2026 г.

Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service

• Без аутентификации
• Отказ в обслуживании

apache · neethi21 сент. 2026 г.

Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header

• Слабая криптография

red hat · red hat openshift data foundation 421 сент. 2026 г.

UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forward

• Без аутентификации

eclipse foundation · eclipse open vsx21 сент. 2026 г.

Cri-o: cri-o: insufficient validation during container checkpoint restore

• Обход пути

red hat · red hat openshift container platform 421 сент. 2026 г.

OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5

• RCE
• Инъекция команд

dassault systèmes · tuleap enterprise edition21 сент. 2026 г.

MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports

• Нарушение контроля доступа (IDOR)

misp · misp21 сент. 2026 г.

MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime

misp · misp21 сент. 2026 г.

MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension

• RCE

misp · misp21 сент. 2026 г.

Cri-o: cri-o checkpoint restore bypasses destination security context

red hat · confidential compute attestation21 сент. 2026 г.

libX11 XkbGetMap Reply Heap-based Buffer Overflow

• Без аутентификации
• Ошибки памяти

x.org · libx1121 сент. 2026 г.

libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow

• Без аутентификации
• Ошибки памяти

x.org · libxrender21 сент. 2026 г.

MISP Arbitrary Local File Read and SSRF via MISP Export Upload

• SSRF
• Обход пути

misp · misp21 сент. 2026 г.

MISP CSRF vulnerability allows unauthorized attribute modification

• Без аутентификации
• CSRF

misp · misp21 сент. 2026 г.

GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages

• XSS

gocd · gocd21 сент. 2026 г.

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

• RCE
• Инъекция команд

sepinetam · mcp-for-stata21 сент. 2026 г.

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

• Без аутентификации

chofstede · ansible_jailexec21 сент. 2026 г.

BleachBit: Exploit File Delete to Escalate Privilege

• Локальное повышение привилегий
• Состояние гонки

bleachbit · bleachbit21 сент. 2026 г.

nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

• Без аутентификации
• Состояние гонки

lucasdillmann · nginx-ignition21 сент. 2026 г.