CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
glanceUbuntu,python-glance-storeDebian +1 moreAn issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker...8.1 HighglanceUbuntuA Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack...6.5 Medium- No product listedD-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability...8.8 High
- maple media root browser classicMaple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames8.5 High
- flutecode secure folderFluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate6.8 Medium
- eclipse foundation jettyWhen Jetty's `HttpClient` make a request to a server through a forward proxy, the server may...8.2 High
- eclipse foundation jettyIn Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ```...8.2 High
- eclipse foundation jettyIn Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to...6.9 Medium
jetty12Debian,jetty9Debian,org.eclipse.jetty:apache-jspTuxCare +126 more +128 moreTuxCare security update for 123 packages (8 CVEs)5.6 Mediumjetty12Debian,jetty9Debian,org.eclipse.jetty:apache-jspTuxCare +126 more +128 moreTuxCare security update for 123 packages (8 CVEs)6.9 MediumjettyUbuntu,jetty12Debian,jetty9Debian +127 more +129 moreIn Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`,...8.8 Highjetty12Debian,jetty9Debian,org.eclipse.jetty:apache-jspTuxCare +126 more +128 moreJetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames8.8 Highjetty12Debian,jetty9Debian,org.eclipse.jetty:apache-jspTuxCare +126 more +128 moreUnauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring6.9 MediumdovecotDebian[sieve: symlink traversal flaw could result in arbitrary file disclosure]No score- No product listedIO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL9.8 Critical
- gerritRegular Expression Denial of Service (ReDoS) in Search Query Predicates and REST Filter Endpoints in Gerrit Code Review8.7 High
- gerritDenial of Service via Exponential Backtracking in ANTLR Search Query Parser in Gerrit Code Review8.7 High
- gerritIncorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review7.6 High
- apache software foundation airflow hashicorp providerApache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key6.5 Medium
- No product listedCatalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone8.8 High
- brocade sannavLogic flaw in SANnav Java cache key handling object comparison handling6.9 Medium
- brocade sannavInformation exposure vulnerability in the job scheduling component of SANnav before 3.0.1a6.9 Medium
- mrsteam isteamx application, isteamx hub +1 moreMrSteam iSteamX Improper Isolation or Compartmentalization8.4 High
- chillzhuang springbladechillzhuang SpringBlade user-auth-info Endpoint UserServiceImpl.java UserServiceImpl.userInfo authorization5.3 Medium
- 9001 copypartycopyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers2.3 Low
- botslab g980hBotslab G980H Dashcams Cleartext Transmission of Sensitive Information7.1 High
- botslab g980hBotslab G980H Dashcams Use of Hard-coded Credentials7.0 High
- botslab g980hBotslab G980H Dashcams Improper Limitation of a Pathname to a Restricted Directory7.1 High
libblockdevTuxCare,libblockdev-btrfsTuxCare,libblockdev-btrfs-develTuxCare +29 more +31 moreUpdate of libblockdevNo score- botslab g980hBotslab G980H Dashcams Out-of-bounds Write6.9 Medium
gitTuxCare,emacs-gitTuxCare,emacs-git-elTuxCare +15 more +17 moreUpdate of gitNo score- jhen0409 react-native-debuggerjhen0409 react-native-debugger Open in Editor window.js openDevTools os command injection5.3 Medium
- botslab g980hBotslab G980H Dashcams Insufficient Verification of Data Authenticity9.2 Critical
- botslab g980hBotslab G980H Dashcams Use of Hard-coded Cryptographic Key6.0 Medium
gdk-pixbuf2TuxCare,gdk-pixbuf2-develTuxCare,gdk-pixbuf2-testsTuxCare +2 moreUpdate of gdk-pixbuf2No score- botslab g980hBotslab G980H Dashcams Missing Authentication for Critical Function6.9 Medium
- brocade sannavIncomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a8.4 High
- botslab g980hBotslab G980H Dashcams Insertion of Sensitive Information into Log File5.1 Medium
- chonkie-inc littrschonkie-inc littrs lib.rs mount path traversal5.3 Medium
- botslab g980hBotslab G980H Dashcams Missing Authentication for Critical Function7.0 High
- gimanh taskview-communityTaskview Community Missing Authentication via OAuth Dynamic Client Registration8.5 High
- botslab g980hBotslab G980H Dashcams Use of Weak Credentials6.0 Medium
- botslab g980hBotslab G980H Dashcams Authentication Bypass by Capture-replay8.6 High
- botslab g980hBotslab G980H Dashcams Generation of Predictable Numbers or Identifiers7.7 High
- destiny.gg chatsongxinjianqwe Chat chat-server ChatServer.java server-side request forgery6.9 Medium
- krayin laravel-crmKrayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description5.1 Medium
- botslab g980hBotslab G980H Dashcams Insufficient session expiration8.7 High
- krayin laravel-crmKrayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field5.1 Medium
- krayin laravel-crmKrayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field5.1 Medium
- yunaiv ruoyi-vue-proYunaiV/zhijiantianya ruoyi-vue-pro OAuth2 Client OAuth2ClientServiceImpl.java validOAuthClientFromCache redirect5.3 Medium
- Show moreLoading…