CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- linuxcdx: Fix double free when sysfs file creation failsNo score
- linuxusb: gadget: f_tcm: fix deadlock in usbg_make_tpg()No score
- linuxof: fix out-of-bounds read in of_alias_scan() stem parserNo score
- linuxnfsd: guard nfsd_serv deref in nfsd_file_net_disposeNo score
- linuxnfsd: initialize DRC hash table before registering shrinkerNo score
- linuxsmb: client: harden DFS cache against invalid target hints7.1 High
- linuxBluetooth: hci_core: use skb_get() instead of skb_clone() for req_skbNo score
- linuxkasan: fix cache shrink race with CPU hotplugNo score
- linuxSUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry9.8 Critical
- linuxPCI/proc: Use file_ns_capable() when checking config space read accessNo score
- linuxiommu/arm-smmu-v3: Manage teardown with devmNo score
- araxis mergeAraxis Merge insufficiently protected credentials6.8 Medium
- No product listedDbGate JSON Runner runners.js code injection5.3 Medium
- thorsten phpmyfaqphpMyFAQ's two-factor authentication login bypasses the password factor8.1 High
- altera trusted firmwareUnchecked HKDF key-size input in EL3 causes a stack buffer overflow8.3 High
- altera trusted firmwareUnchecked SDM mailbox response address enables EL3 secure-memory corruption8.3 High
- altera trusted firmwareAltera SoCFPGA BL31 Mailbox Output Pointer Validation Enables EL3 Secure-Memory Corruption8.3 High
- altera trusted firmwareUnvalidated SiP v2 mailbox pointers allow non-secure EL1 access to arbitrary physical addresses through EL3.8.3 High
- altera trusted firmwareCrafted oversized firmware image causes EL3 stack overflow during VAB authentication on Trusted Firmware.8.3 High
- altera trusted firmwareSystemic Missing Address Validation in SiP SMC Handlers8.3 High
- altera trusted firmwareUnit Confusion in VAB Authentication8.3 High
- altera trusted firmwareEL3 Stack Buffer Overflow in FCS HKDF Request8.3 High
- rejetto hfs2HFS2 2.4.0 Unauthenticated Denial of Service via Hung Serving Thread8.7 High
- red hat ansible automation platform 2, ansible automation platform 2.6, ansible automation platform 2.6 for rhel 9 +9 more +11 morePulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pulp container registry signing key theft8.1 High
- excalidrawExcalidraw Imported File restore.ts cross site scripting5.3 Medium
- havelsan inc. liman render engineTLS Certificate Validation Disabled for Keycloak Connections in HAVELSAN's Liman Render Engine5.9 Medium
- genetec inc. security centerA flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow...6.5 Medium
- havelsan inc. liman render engineSSH Host Key Verification Bypass in HAVELSAN's Liman Render Engine5.9 Medium
- openstack zaqarIn OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending...9.2 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities7.1 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities9.6 Critical
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- ibm enterprise build of quarkusIBM Enterprise Build of Quarkus is affected by multiple vulnerabilities8.6 High
- ibm contextforge, contextforge mcp gateway +1 moreIBM ContextForge MCP Gateway is affected by path traversal4.9 Medium
- thorsten phpmyfaqphpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission8.2 High
- ibm concertMultiple Vulnerabilities in IBM Concert Software6.2 Medium
- opentext vendor invoice management for sap solutionsStored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application7.3 High
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +17 more +19 moreThis Power System update is being released to address3.2 Low
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +24 more +26 moreThis Power System update is being released to address4.3 Medium
- portswigger burp suite dastIn PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an...9.2 Critical
- ibm openbmc, power system e1050 \(9043-mrx\) firmware, power system e1150 \(9043-mru\) firmware +15 more +17 moreThis Power System update is being released to address3.4 Low
- ibm db2 mirror for iIBM Db2 Mirror for i is vulnerable to obtain sensitive information []3.3 Low
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +24 more +26 moreThis Power System update is being released to address3.4 Low
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +24 more +26 moreThis Power System update is being released to address5.1 Medium
- ibm powervm hypervisor, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +24 more +26 moreThis Power System update is being released to address5.1 Medium
- Show moreLoading…