CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- invoiceplaneInvoicePlane: Log Injection via Unsanitized User Input in Cron Key Error Logging5.3 Medium
- invoiceplaneInvoicePlane: Sensitive Information Disclosure via Unstripped EXIF Metadata in Attachments4.9 Medium
- invoiceplaneInvoicePlane: Second-order SQL injection through the unvalidated custom_field_table field in the Custom Fields module6.0 Medium
- langchain4jlangchain4j LangChain4j-agentic AgenticScopeJsonSerializationIT.java AgenticScopeSerializer.fromJson deserialization2.1 Low
- sheshbabu zensheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting5.1 Medium
- the wikimedia foundation mediawiki - cargo extensionStored XSS in Cargo Drilldown tab names2.3 Low
- google gvisorHost Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE8.8 High
- zhonglun cloudposZhonglun CloudPOS Automatic Update Program.cs channel accessible6.3 Medium
- ibm financial transaction manager (ftm) for redhat openshiftFTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an...6.5 Medium
- ibm server firmware, power system e1080 \(9080-hex\) firmware, power system e1180 \(9080-heu\) firmware +7 more +9 moreThis Power System update is being released to address7.1 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.2 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.5 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.5 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.6 High
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address9.3 Critical
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request9.8 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.5 High
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation9.3 Critical
- synacor zimbra collaboration suite (zcs), zimbra collaboration suite (zcs) +1 moreZimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation9.3 Critical
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.8 High
- ail project frameworkStored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page6.3 Medium
- gnome gnumericGnumeric: gnumeric: heap use-after-free when opening a malformed workbook5.5 Medium
- piwigoPiwigo arbitrary file read and remote code execution via insecure image processing7.2 High
- ail project frameworkAIL Framework Onion Module: Non-Onion URL Accepted as Crawler Task Due to Bypassed Domain Validation6.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreQemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape8.8 High
- ail project frameworkAil Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment6.3 Medium
- No product listedOpen-Web-Analytics Remote Event Queue Endpoint queue.php loadFromArray deserialization6.9 Medium
- ail project frameworkStored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip8.5 High
- kitty project kittyOut-of-bounds write in the kitty text sizing protocol allows termination of the terminal process6.8 Medium
- ail project frameworkStored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names5.1 Medium
- ail project frameworkStored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes8.5 High
- kitty project kittyImproper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory4.6 Medium
- linux, linux kernel +1 moresmb/server: fix tree connection leak in smb2_tree_connect()5.5 Medium
- linux, linux kernel +1 morenvdimm: pmem: keep PREFLUSH before data writes5.5 Medium
- linux, linux kernel +1 morestaging: rtl8723bs: fix mismatched free of HalData in rtw_sdio_if1_init()5.5 Medium
- linux, linux kernel +1 moreusb: typec: ucsi: unregister debugfs entries on teardown5.5 Medium
- linux, linux kernel +1 morewifi: iwlwifi: mei: pass correct argument to function5.5 Medium
- linux, linux kernel +1 moredrm/msm: Recover HW before retire hung submit5.5 Medium
- linux, linux kernel +1 morestaging: rtl8723bs: fix xmit_frame/xmit_buf leaks on mgnt-frame error paths5.5 Medium
- linux, linux kernel +1 moreRDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters9.8 Critical
- linux, linux kernel +1 morebpf: Mark bpf_refcount field as unique5.5 Medium
- linux, linux kernel +1 moreext4: fix transaction overflow during writeback5.5 Medium
- linux, linux kernel +1 moreACPI: platform: Use acpi_bus_get_primary_device()7.8 High
- linux, linux kernel +1 morenet: hsr: free learned nodes on device setup failure5.5 Medium
- linux, linux kernel +1 morenetfilter: nf_nat_sip: rewind offset when NAT shrinks the packet5.5 Medium
- gibbonedu gibbonGibbonEdu Gibbon Unit Planner units_add_blockAjax.php makeBlock missing authentication6.9 Medium
- kitty project kittyReflected unknown field names in the kitty colour control escape code allow command execution in the user's shell9.3 Critical
domaincrates.ioVarious panics, soundness and resource exhaustion issuesNo score- linux, linux kernel +1 morewifi: mt76: mt7921: validate CLC firmware records5.5 Medium
- linux, linux kernel +1 moreppp_async: drop the errored frame instead of resetting its headroom5.5 Medium
- Show moreLoading…