CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- david de boer paytium: mollie payment forms & donationsPaytium: Mollie payment forms & donations <= 5.0.3 - Unauthenticated Privilege Escalation via 'pt_form_field[pt-user-role]' Parameter9.8 Critical
- forma lmsForma LMS Multi-User-Selector AJAX Endpoint getData getDataTask sql injection5.3 Medium
- spon communications ip network audio device xc-9603SPON Communications IP Network Audio Device XC-9603 Configuration File Download sys_cfg.txt loadCfg information disclosure6.9 Medium
- intelliants subrion cmsIntelliants Subrion CMS Login Page login.php authorize redirect5.3 Medium
- intelliants subrion cmsIntelliants Subrion CMS actions.json assign-owner information disclosure6.9 Medium
- kvcache-ai mooncakekvcache-ai mooncake Regular Expression GetReplicaListByRegex allocation of resources5.3 Medium
- kvcache-ai mooncakekvcache-ai mooncake MountSegment Request Processing segment.cpp access control5.3 Medium
- dashbit nimble ztaImproper Verification of Cryptographic Signature in dashbit nimble_zta Cloudflare strategy9.3 Critical
- No product listedAn out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit...7.7 High
- No product listedEspruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the...7.5 High
librawDebian,darktableUbuntu,dcrawUbuntu +5 more +7 moreLibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd()...5.5 MediumlibsndfileAzure Linuxlibsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing...5.5 MediummxmlDebianMini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML...6.5 MediumopenexrDebianOpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially...5.5 MediumlibicalAzure Linux,libical3Debian +1 morelibical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When...6.2 MediumhiredisDebianhiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in...7.5 HighquickjsDebian,quickjs-ngDebian +1 moreQuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().9.8 Critical- No product listedBento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration...6.2 Medium
- No product listedBento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and...7.5 High
libde265Debian,rootio-libde265Root +1 morelibde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path...7.5 HighlibsndfileAzure Linux,rootio-libsndfileRoot +1 morelibsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing...7.5 HighzbarDebianZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6()...5.5 Medium- No product listedlibconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled...5.3 Medium
jsmnDebianzserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump().7.3 HighnanosvgUbuntuNanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer...7.5 HighnanosvgUbuntuNanoSVG 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__curveDivs()...6.5 MediumnanosvgUbuntuNanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in...7.5 High- No product listedminimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when...9.8 Critical
mujsDebianMuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c...7.5 High- No product listedSumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec()...7.5 High
vipsDebianlibvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images....7.5 HighlibfyamlDebianlibfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When...6.5 MediumsimdjsonAlpaquitasimdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser:...6.5 MediumndpiDebiannDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization...7.5 High- No product listedAn incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(...7.5 High
mpackUbuntuAn integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms...9.8 Criticaljackson-dataformats-textopenSUSEjackson-dataformat-csv-2.18.11-1.1 on GA mediaNo score- fasterxml jackson-corejackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service7.5 High
- fasterxml jackson-dataformats-binaryjackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service7.5 High
- fasterxml jackson-dataformats-binaryjackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service7.5 High
- No product listedAn issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive...7.5 High
- No product listedAn issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary...8.8 High
- No product listedAn issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary...9.8 Critical
- No product listedAn issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive...7.5 High
- No product listedmcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF)...9.1 Critical
els-os-releaseTuxCareUpdate of els-os-releaseNo score- kvcache-ai mooncakekvcache-ai mooncake RPC Path UnmountSegment authorization6.9 Medium
- brocade sannavUnauthenticated remote command injection in the Brocade SANnav orchestrator HTTP service8.6 High
- pmticket project-management-softwarepmTicket Project-Management-Software add_project.php setSync sql injection6.9 Medium
- No product listedSEMCMS KindEditor Upload upload_json.php cross site scripting5.3 Medium
- Show moreLoading…