CVEs published in September 2026
14,833 vulnerabilities, 1,542 critical, 36 exploited.
- tornadoweb tornado Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient 8.7 High
- tornadoweb tornado Tornado before 6.5.9 Denial of Service via Query String 6.9 Medium
- decolua 9router decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery 6.9 Medium
- pecee simple-router simple-php-router through 5.4.1.7 IP restriction bypass via forwarding headers 6.9 Medium
- asyncfuncai deepwiki-open DeepWiki-Open through commit d92819a Unauthenticated Arbitrary File Read via /codemap/file 8.7 High
- webkul qloapps QloApps through 1.7.0 Reflected XSS via Length of Stay Fields 5.1 Medium
- webkul qloapps QloApps through 1.7.0 Reflected XSS via Room Type Editor 5.1 Medium
- webkul qloapps QloApps through 1.7.0 Reflected XSS via exceptions field 5.1 Medium
- webkul qloapps QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters 5.1 Medium
- the wikimedia foundation mediawiki mediasearch extension attacker-controlled javascript license URL via XSS 1.2 Low
- the wikimedia foundation mediawiki commonsmetadata extension attacker-controlled javascript license URL via XSS 1.1 Low
- aja video systems helo plus AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter 5.3 Medium
- es iperf3 iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a... 9.2 Critical
- jpadilla pyjwt PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuse 6.5 Medium
- es iperf3 iperf3 3.21 (esnet/iperf) contains a remote, unauthenticated heap use-after-free: the server's... 9.2 Critical
- meta platforms, inc horizon os Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a... 8.8 High
- meta platforms, inc horizon os Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a... 9.1 Critical
- yonyou u8 crm Yonyou U8 CRM Arbitrary File Read via getemaildata.php 8.7 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway server-side request forgery 9.1 Critical
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway improper authentication 9.1 Critical
- accellion kiteworks, kiteworks core +1 more Kiteworks Core user impersonation in a file-request feature 4.6 Medium
- inspur haiyue hcm cloud Inspur HCM Cloud Arbitrary File Read via file/download Endpoint 8.7 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway deserialization of untrusted data 7.2 High
- accellion kiteworks, kiteworks secure data forms +1 more Kiteworks Secure Data Forms SQL injection 7.1 High
- idocview iDocView SSRF via /doc/upload Endpoint Hardcoded Token 8.7 High
- accellion kiteworks, kiteworks core +1 more Missing authentication on a Kiteworks appliance setup function 5.9 Medium
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Improper Validation of Specified Quantity in Input 4.9 Medium
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Local Privilege Escalation 7.8 High
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Local Privilege Escalation 7.8 High
- accellion kiteworks, kiteworks core +1 more Kiteworks Core OS Command Injection 7.2 High
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Authentication Bypass in the Password Reset Workflow 9.8 Critical
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway Path Traversal 7.2 High
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Remote Code Execution 7.2 High
- accellion kiteworks, kiteworks core +1 more Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation 7.8 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway Path Traversal 7.2 High
- accellion kiteworks, kiteworks core +1 more Kiteworks Core OS Command Injection 8.8 High
- accellion kiteworks, kiteworks secure data forms +1 more Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor 8.6 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway server-side request forgery 9.1 Critical
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Incorrect Authorization 4.3 Medium
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Path Traversal 7.4 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway server-side request forgery 9.1 Critical
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Missing Authentication for Critical Function 6.5 Medium
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Sandbox Escape 8.8 High
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Stored Cross-site Scripting (XSS) 8.1 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway Improper Restriction of XML External Entity Reference 7.0 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway Improper Authentication 7.5 High
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Incorrect Privilege Assignment 7.2 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway Remote Code Execution 7.2 High
- accellion kiteworks, kiteworks email protection gateway +1 more Kiteworks Email Protection Gateway Improper Handling of Case Sensitivity 7.2 High
- accellion kiteworks, kiteworks core +1 more Kiteworks Core Privilege Escalation through Improper Access Control 7.2 High
- Show olderLoading…