CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- wazuhWazuh Manager cluster header parsing allows pre-authentication memory exhaustion7.5 High
- http4s http4s-scala-xmlhttp4s-scala-xml has an XML External Entity (XXE) processing issue9.3 Critical
- wazuhWazuh: Unbounded Recursion in os_xml `_getattributes()` Causes analysisd Worker Thread Stack Exhaustion6.5 Medium
- ixofoundation ixo-blockchainixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass9.3 Critical
- bittersecurity decepticon, decepticon-core, decepticon-sdk +2 moreDecepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context10.0 Critical
- openobserveOpenObserve: Unauthenticated /config/runtime endpoint exposes PostgreSQL database credentials7.5 High
- habiticaHabitica: Regex Injection / ReDoS in Member Search6.5 Medium
- bytebase dbhub@bytebase/dbhub's read-only mode does not prevent database writes7.4 High
- cstigler node-xhtml-purifierxhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS6.1 Medium
- zitadelZITADEL: MFA bypass via session reuse in Login V28.2 High
- web-infra-dev rsdoctor@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata7.5 High
- zitadelZITADEL: Actions V1 sandbox escape: host file read via require()8.7 High
- volotat anagnorisisvolotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting5.1 Medium
- bytebase dbhubDBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution9.3 Critical
- python-social-auth social-coresocial-auth-core has a Session Fixation issue4.2 Medium
- python-social-auth social-coresocial-auth-core: VK App backend accepts unsigned callback data when auth_key is missing7.4 High
- python-social-auth social-coresocial-auth-core has Login CSRF via Missing State Parameter in LoginRadius Backend4.3 Medium
- python-social-auth social-coresocial-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend Backend6.8 Medium
- python-social-auth social-coresocial-auth-core has an Improper Authentication issue6.4 Medium
- amazon kiro ideKiro IDE Allows Agentic Writes to Global Configurations While Working in Untrusted Workspaces8.6 High
- discourseDiscourse: Encode action_code_who in mention URLs6.4 Medium
- discourseDiscourse: Chat upload filenames rendered as raw HTML in excerpts5.0 Medium
- volotat anagnorisisvolotat Anagnorisis page.html start_streaming path traversal5.3 Medium
- discourseDiscourse: Stored HTML injection in video notification emails5.4 Medium
- discourseDiscourse: Wildcard iframe origin allowlist bypass via authority separators4.3 Medium
- discourseDiscourse: Chat MessageBus delivers read-restricted messages to unauthorized users8.7 High
openvpnTuxCare,openvpn-develTuxCare +1 moreUpdate of openvpnNo score- bsv-blockchain @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, @bsv/wallet-toolbox-mobile +2 more`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction (can redirect payments when using remote storage)8.7 High
- discourseDiscourse: Reject literal backslash path separators in iframe src traversal guard7.2 High
openvpnTuxCare,openvpn-develTuxCare +1 moreUpdate of openvpnNo score- discourseDiscourse: Escape LIKE metacharacters in upload paths to prevent disclosure6.5 Medium
- discourseDiscourse: Block post iframes whose encoded userinfo bypasses the allowed_iframes allowlist5.4 Medium
- discourseDiscourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables4.2 Medium
- sumatrapdfreader sumatrapdfSumatraPDF: Heap out-of-bounds read in MOBI header parser.6.8 Medium
- rmyndharis openwaOpenWA: VIEWER API keys can read WhatsApp group invite codes6.4 Medium
- volotat anagnorisisvolotat Anagnorisis Socket.IO Connect app.py missing authentication6.9 Medium
- rmyndharis openwaOpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream8.2 High
- grokability snipe-itSnipe-IT: Stored XSS via Custom Field name in asset-list column headers8.1 High
- grokability snipe-itSnipe-IT: 2FA bypass via the API token flow8.6 High
- thorsten phpmyfaqphpMyFAQ has SQL Injection in `StopWords::add()` — Unescaped Stop Word Insertion8.5 High
- grokability snipe-itSnipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API8.7 High
unboundTuxCare,unbound-develTuxCare,unbound-libsTuxCare +1 more +3 moreUpdate of unboundNo score- x.org libxiOut-of-bounds read in libXi's XListInputDevices() class parsing6.5 Medium
- goauthentik authentikauthentik: MFA Bypass via State Confusion / Parameter Injection in AuthenticatorEmailStage8.9 High
org.springframework.integration:spring-integration-coreRoot,io.root.org.springframework.integration:spring-integration-coreRoot +1 moreAIKIDO-2026-748560 in org.springframework.integration:spring-integration-core - Patched by RootNo score- goauthentik authentikauthentik: Privilege Escalation to Superuser via Group Hierarchy8.8 High
- x.org libxiOut-of-bounds read in libXi's XListInputDevices()6.5 Medium
- goauthentik authentikauthentik: Stored credentials are readable with view permission alone8.1 High
- goauthentik authentikauthentik: Authentication bypass via assertion confusion in SAML sources7.4 High
- x.org libxiOut-of-bounds read in libXi's XI2 XIQueryDevice reply parsing6.5 Medium
- Show moreLoading…