CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- jegstudio gutenverse – wordpress blocks, page builder & site editorGutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute6.4 Medium
- 101gen automation web platform – notifications and otp for woocommerce, advanced country codeAutomation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter9.8 Critical
- bookingalgorithms ba book everythingBA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter7.2 High
- htplugins ht contact form – drag & drop form builder for wordpressHT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume7.2 High
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter9.1 Critical
- pr-gateway blog2social: social media auto post & schedulerBlog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers4.3 Medium
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data5.3 Medium
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter6.4 Medium
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter9.1 Critical
- allterraindeveloper openstation: desktop windows, dock & virtual desktops for wp adminOpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint4.3 Medium
- wordplus better messages – chat rooms, group chat, private messages & ai chat botsBetter Messages <= 3.0.4 - Authenticated (Subscriber+) SQL Injection via 'group_id' Message Meta Parameter6.5 Medium
- radykal fancy product designerFancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job7.2 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field6.1 Medium
- radykal fancy product designerFancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta7.2 High
- mohammed kaludi amp for wp – accelerated mobile pagesAMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation7.2 High
- paoltaia geodirectory – wp business directory plugin and classified listings directoryGeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')6.4 Medium
- elementor website builderWordPress Elementor Website Builder plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- tohoku electric power company, incorporated electric power "yorisou e net" android app, electric power "yorisou e net" ios app +1 moreSmartphone application Tohoku Electric Power "Yorisou e Net" uses a hard-coded cryptographic key,...2.4 Low
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding6.8 Medium
- unknown link libraryLink Library < 7.9.6 - Unauthenticated SSRF via Reciprocal Link Validation4.0 Medium
- unknown link libraryLink Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter4.1 Medium
- unknown link libraryLink Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links6.1 Medium
- sanluan publiccmsSanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization5.1 Medium
- phpipamphpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api...8.6 High
- allauth django-allauthdjango-allauth before 65.19.4 does not have the expected limits on failed login attempts because,...3.7 Low
- muety wakapiIn Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended...7.4 High
- steveiliop56 tinyauthtinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by...5.4 Medium
- itflowITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser...8.0 High
- wipeoutmedia css & javascript toolboxCSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode6.4 Medium
- ironmace ironshieldIRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client...5.1 Medium
- minioMinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears...7.1 High
- netgate pfsense ce, pfsense plus +1 moreIn Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI)...8.5 High
- cyber-iii student-management-systemningzichun student-management-system addLog.php echo cross site scripting5.3 Medium
- swmansion react native reanimatedA prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2...5.3 Medium
- madpsy ka9q ubersdrmadpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the...5.4 Medium
- cyber-iii student-management-systemningzichun student-management-system example_lite.sql default credentials5.1 Medium
lemonldap-ngDebianLemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restric…6.5 Medium- cyber-iii student-management-systemningzichun student-management-system cross-site request forgery5.3 Medium
- cyber-iii student-management-systemningzichun student-management-system editLog.php authorization6.9 Medium
lemonldap-ngDebianLemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentials does not verify…9.1 Critical- cyber-iii student-management-systemningzichun student-management-system getStudent.php authorization6.9 Medium
lemonldap-ngDebianLemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not ve…9.1 Critical- containerdContainerd has image-pull DoS via crafted OCI index graph amplification6.9 Medium
- brocade sannavIncomplete property masking in the SANnav logging subsystem6.4 Medium
- No product listedIncorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2...7.5 High
- No product listedA reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of...5.4 Medium
- No product listedEspruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in...6.2 Medium
- No product listedSeclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability...7.8 High
- No product listedCross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to...6.1 Medium
- No product listedAn issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270,...7.5 High
- Show moreLoading…