CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- zohocorp eventlog analyzer, log360 +1 moreDenial of Service (DoS)5.3 Medium
- delta electronics diaenergieImproper Access Control in DIAEnergie6.5 Medium
- delta electronics diaenergiePath Traversal in DIAEnergie9.1 Critical
- delta electronics diaenergieAuthorization Bypass Through User-Controlled Key in DIAEnergie4.3 Medium
- delta electronics diaenergieSQL Injection in DIAEnergie8.8 High
- delta electronics diaenergieSQL Injection in DIAEnergie8.8 High
- delta electronics diaenergieAuthentication Bypass in DIAEnergie9.8 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreGimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file7.8 High
- yop poll, yourownprogrammer yop poll +1 moreYOP Poll <= 7.0.10 - Unauthenticated Origin Validation Error to Administrator Account Takeover via '/auth/wp-login-redirect' REST Route8.8 High
- eesywp eesy id2wp – publish indesign html5eesy_ID2WP – Publish InDesign HTML5 <= 1.0.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'id2wp_path' Query Parameter7.5 High
- ezglobal gpm lightezGlobal｜GPM LIGHT - Sensitive Data Exposure6.9 Medium
- papercut hivePaperCut Hive Embedded App for Ricoh: Javascript injection3.8 Low
- papercut ng/mfPaperCut MF/NG: User permissions are not evaluated on report generation6.9 Medium
- papercut ng/mfPaperCut NG/MF: Remote Code Execution via Scan2Fax7.3 High
serovalRoot,seroval-pluginsRoot,@rootio/serovalRoot +1 more +3 moreAIKIDO-2026-310861 in seroval-plugins - Patched by RootNo score- huawei harmonyosOut-of-bounds read vulnerability in the graphics module. Successful exploitation of this...5.9 Medium
- pixelite events managerEvents Manager 7.4.1 - 7.4.4 - Subscriber+ Unpublished Event and Location Disclosure via 'owner' Parameter4.3 Medium
- pixelite events managerEvents Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR2.7 Low
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category6.8 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Campaign Configuration and Log Disclosure via IDOR2.7 Low
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview6.8 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation4.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled5.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import4.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS 3.5.29 - < 3.7.50 - Contributor+ LFI via Elementor Courses Categories Widget7.2 High
- radiustheme the post gridThe Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening3.5 Low
- unknown masteriyo lmsMasteriyo LMS < 3.4.2 - Subscriber+ Quiz Answer Key Disclosure4.3 Medium
- unknown masteriyo lmsMasteriyo LMS < 3.4.2 - Subscriber+ Arbitrary User Course Progress Disclosure via IDOR4.3 Medium
- unknown 10web booster10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion6.5 Medium
- tomdever wpforo forumwpForo Forum < 3.1.6 - Subscriber+ PHP Object Injection via Profile Fields7.5 High
- jtsternberg cmb2CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler6.8 Medium
- syed balkhi wpformsWPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent6.8 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: generic user update bypasses denied reset-password permission6.6 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator4.2 Medium
- papercut ng/mfPaperCut NG/MF: Remote Code Execution via Scripting Subsystem7.5 High
- fabasoft folio clientFabasoft Folio Client before 2026, a locally installed component that communicates with the...6.5 Medium
- yhx070424 shopxoyhx070424 ShopXO Ueditor Upload ueditor.php path traversal6.9 Medium
- nanomsgNanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in...8.6 High
- edimax br-6428ncEdimax BR-6428nC goform websRedirect redirect5.3 Medium
- mwilliamson mammoth.jsmammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the...8.4 High
- d-link dir-825D-Link DIR-825 rp-l2tp tunnel.c tunnel_set_params out-of-bounds write9.3 Critical
- No product listedMantisZip Preview MainWindow.UI.cs Path.Combine path traversal5.3 Medium
- talelin lin-cms-spring-bootTaleLin lin-cms-spring-boot book Endpoint BookController.java searchBook improper authorization6.9 Medium
- openstack swiftIn OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header...5.3 Medium
- talelin lin-cms-spring-bootTaleLin lin-cms-spring-boot book Endpoint BookController.java getBooks improper authorization6.9 Medium
- talelin lin-cms-spring-bootTaleLin lin-cms-spring-boot book Endpoint BookController.java getBook improper authorization6.9 Medium
- signozSigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass7.6 High
- signozSigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret9.2 Critical
- huanzi-qch base-adminhuanzi-qch base-admin Add User CommonController.java save cross site scripting5.1 Medium
- java110 microcommunityjava110 MicroCommunity fallBack API Endpoint BusinessApi.java QueryServiceSMOImpl.fallBack sql injection6.9 Medium
- Show moreLoading…