CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- linuxACPI: bus: Introduce acpi_bus_get_primary_device()No score
- mongodb php driverPHP object injection via unsuppressible __pclass class inference in command monitoring events6.3 Medium
- mongodb c driverHeap buffer overflow via mid-scan command list growth in client topology monitoring8.3 High
- linuxvxlan: mdb: Fix use-after-free in vxlan_mdb_flush()7.8 High
- linuxspi: amlogic-spisg: Make sure clk_init_data is fully initializedNo score
- hcl software compassShell script injection via server-supplied database name in Open MongoDB shell7.3 High
- linuxdrm/xe: don't WARN on kernel job timeout when device already wedgedNo score
- mongodb laravel mongodb (php)Unauthorized cache lock takeover via expression injection in lock owner values in MongoDB integration for Laravel7.1 High
- linuxBluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereferenceNo score
- linuxocteontx2-af: fix out-of-bounds read setting MSI-X irq affinityNo score
- linuxapparmor: policy_int make sure list heads are initialized before fail pathNo score
- termix-ssh termixTermix: Authenticated blind SSRF through notification channel test endpoints6.4 Medium
- dokployDokploy: Authenticated OS Command Injection in patch.readRepoDirectories (repoPath) leads to RCE as root9.9 Critical
- No product listedDbGate files-style Endpoint files.js fs.readFile path traversal5.3 Medium
- suitenumerique docsLaSuite Doc: Public Documents Enumeration6.5 Medium
- linuxdrm/sysfb: simpledrm: Improve stride validationNo score
- linuxmm/secretmem: properly account locked pages6.8 Medium
- linuxscsi: qla2xxx: Fix response queue over-consumption in __qla_consume_iocb()No score
- linuxmemcg: bypass the reclaim and oom killer for dying tasks once oom_reaper is done5.7 Medium
- linuxmemcg: make the v1 soft limit knob inertNo score
- linuxarm64: mm: Fix the lockless page-table walk in show_pte()No score
- linuxs390/vfio-ap: fix potential use of uninitialized apm_filtered bitmapNo score
- linuxLoongArch: Add DIRECT_MAP_PHYSMEM_END definition7.8 High
- alam00000 bentopdfBentoPDF: Workflow Import Allows Unvalidated TSA URL Leading to PDF Hash Exfiltration via RFC 3161 Requests3.4 Low
- linuxmedia: meson: vdec: fix NULL pointer deref in vdec_try_fmt_commonNo score
- linuxf2fs: fix to zero post-EOF data when extending file size2.0 Low
- linuxdrm/gud: validate TV mode names before creating enum propertyNo score
- linuxdrm/nouveau/dmem: fix callocated underflow on large folio splitNo score
- linuxmm/hugetlb: fix boot panic with CONFIG_DEBUG_VM and HVO bootmem pagesNo score
- linuxlockd: fix swapped arguments in nlmsvc_match_ip()No score
- linuxmm/hugetlb: initialize gigantic bootmem hugepage struct pages earlierNo score
- linuxnfsd: add missing read barrier to rpc_status_get dumpit seqcount retry7.1 High
- linuxsvcrdma: Reject Write/Reply chunks with segcount 09.1 Critical
- linuxmm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfnNo score
- linuxipv6: use RCU iterator to dump route exceptionsNo score
- the wikimedia foundation mediawiki - cirrussearch extensionReflected XSS in CirrusSearch debug explain output5.5 Medium
- alam00000 bentopdfBentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass8.6 High
- hcl software sametimeInsufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version.4.3 Medium
- linuxphy: fsl-imx8mq-usb: fix typec switch leak on probe error path7.4 High
- linuxsvcrdma: Fix unmatched rn_unregister on failed accept8.1 High
- linuxstaging: media: tegra-video: fix of_node_put() on VIP parse errorsNo score
- linuxsignal: avoid shared siginfo namespace rewritesNo score
- logto-io logtoLogto: SSRF via Webhooks and Custom OAuth2 Connector UserInfo Endpoint8.5 High
- logto-io logtoLogto: Account API can disclose stored third-party provider tokens without the identities scope7.6 High
- linuxnfsd: convert nfsd_net boolean flags to unsigned long flags word8.1 High
- linuxsched_ext: Keep kick_sync waiting on the rq's own CPUNo score
- linuxclocksource/drivers/timer-sun4i: Advertise a real minimum deltaNo score
- linuxmm/huge_memory: skip device-private PMDs in madvise_free_huge_pmdNo score
- linuxmm/madvise: skip device-private PMDs in cold and pageout walksNo score
- linuxmm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()No score
- Show moreLoading…