CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- gitlabDouble Free in GitLab9.9 Critical
- gitlabUse of Less Trusted Source in GitLab4.3 Medium
- gitlabMissing Authorization in GitLab7.7 High
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab5.4 Medium
- gitlabConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab3.1 Low
- gitlabInteger Overflow or Wraparound in GitLab9.9 Critical
- bytedance coze scraper extensionByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization5.3 Medium
- weiqingwen spring-boot-forumweiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal5.3 Medium
- microsoft 365 apps, 365 apps for enterprise, office ltsc 2021 +3 more +5 moreMicrosoft Office Outlook Remote Code Execution Vulnerability7.8 High
- fast fac1900rFast FAC1900R uhttpd get_alias_name stack-based overflow5.3 Medium
- lb-link bl-cpe600euLB-Link BL-CPE600EU Configuration Backup Mifi_config.bin information disclosure6.9 Medium
- softnews media group datalife engineSoftNews Media Group DataLife Engine Search search.php strip_data sql injection6.9 Medium
plone-app-contenttypesPyPIplone.app.contenttypes has a Denial of Service in File Upload due to excessive filename length6.5 Medium- abdurrab5 online-makeup-storeAbdurrab5 online-makeup-store Admin functions.php confirm_user authorization6.9 Medium
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities7.7 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities7.7 High
- plank laravel-mediableLaravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload9.3 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- carazo import and export users and customersImport and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile F…8.8 High
- lynn999 ethpress – web3 loginEthPress <= 2.3.5 - Unauthenticated Authentication Bypass8.1 High
- red hat openshift container platform 4.12, openshift container platform 4.13, openshift container platform 4.14 +8 more +10 moreOpenshift/console: openshift/console: unauthenticated path traversal in i18n locale handler7.5 High
- abdurrab5 online-makeup-storeAbdurrab5 online-makeup-store Customer Login customerSignin.php sql injection6.9 Medium
- abdurrab5 online-makeup-storeAbdurrab5 online-makeup-store Admin Login index.php sql injection6.9 Medium
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm concertMultiple Vulnerabilities in IBM Concert Software7.8 High
- ibm concertMultiple Vulnerabilities in IBM Concert Software9.8 Critical
- ibm concertMultiple Vulnerabilities in IBM Concert Software5.3 Medium
- ibm concertMultiple Vulnerabilities in IBM Concert Software7.8 High
- red hat openshift container platform 4, openshift container platform 4.17, openshift container platform 4.18 +4 more +6 moreOpenshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding7.2 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Trust-store whitelist by Issuer+Serial only9.1 Critical
- ibm concertMultiple Vulnerabilities in IBM Concert Software9.8 Critical
- ibm concertMultiple Vulnerabilities in IBM Concert Software9.8 Critical
- brocade sannavInsufficient input sanitization of shell metacharacters in Brocade SANnav before 3.0.1a8.6 High
- ibm concertMultiple Vulnerabilities in IBM Concert Software6.2 Medium
- neethuharii cafemanagementNeethuharii CafeManagement AddCashierCode.php addcashier improper authorization6.9 Medium
- sfturing hosp ordersfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt2.3 Low
- webpros wp toolkit for cpanelArgument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated...9.4 Critical
- webpros cpanelExecution with unnecessary privileges in cPanel allows remote authenticated users to execute...9.4 Critical
- webpros plesk extension "site import"OS command injection in Plesk allows remote authenticated users to execute arbitrary code with...9.4 Critical
- plesk, webpros plesk extension "plesk restful api" +1 moreAn untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before...8.7 High
- webpros cpanelIncorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information...8.2 High
- sfturing hosp ordersfturing hosp_order CommonUserController.java cross-site request forgery5.3 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: systemjob extra_vars.days argument injection into uncontainerized control-plane awx-manage process6.6 Medium
- red hat ansible automation platform 2, ansible automation platform 2.7 +1 moreAutomation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)6.4 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle6.5 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust4.3 Medium
- Show moreLoading…