CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- zammadZammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller8.8 High
- zammadZammad: Cross-User Taskbar Item Access Control Vulnerability5.3 Medium
- zammadZammad: Denial of Service via OTRS Import Controller8.7 High
- zammadZammad: Malicious input in Ticket Body Enables Session Termination5.3 Medium
- zammadZammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers2.1 Low
- zammadZammad: Incorrect Authorization and Improper Privilege Management8.7 High
- zammadZammad: Cross-Site Scripting in Ticket Notifications8.4 High
- zammadZammad: Improper neutralization of `srcset` attribute in IMG tags in Zammad5.3 Medium
- zammadZammad: PGP signature spoofing via unvalidated verification return7.1 High
- zammadZammad: Avatar Image URL Server-Side Request Forwarding5.3 Medium
- zammadZammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak5.1 Medium
- bludit cmsBludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints5.3 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project Faculty Authentication loginlinkfaculty.php sql injection6.9 Medium
- bludit cmsBludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint7.1 High
- zammadZammad: Titles of knowledge base answers will be shown across all categories via the global search2.1 Low
- bludit cmsBludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()5.3 Medium
- payloadcms payloadPayload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route5.3 Medium
- the wikimedia foundation mediawiki - thanks extensionStored i18n XSS in the Flow integration of Thanks6.1 Medium
- zammadZammad: Incorrect implementation of permission checks in the knowledge base module7.1 High
- zhistaredu startrainingzhistaredu StarTraining api-docs Endpoint SecurityConfig.java missing authentication6.9 Medium
- golang.org/x/playgroundMalicious user input may lead to RCE in golang.org/x/playground8.8 High
- kitty project kittyMissing ownership check on the shared memory object named by the kitty askpass escape code5.6 Medium
- zhistaredu startrainingzhistaredu StarTraining Druid Console index.html anonymous missing authentication6.9 Medium
- kitty project kittyUse after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer4.6 Medium
- foxit readerCVE-2026-183116.1 Medium
- foxit readerCVE-2026-183206.1 Medium
- foxit readerCVE-2026-183126.1 Medium
- kitty project kittyMissing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop6.0 Medium
- zhistaredu startrainingzhistaredu StarTraining JWT Token application.yml UserLoginService.createToken hard-coded password6.9 Medium
- gnome networkmanager-iodineNetworkmanager-iodine: networkmanager-iodine: local privilege escalation to root via nameserver option injection7.8 High
- rattadan cosmowarp contractThe Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value...8.4 High
- berriai litellmBerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer8.7 High
- zhonglun cloudposZhonglun CloudPos JSBridge JSBridge.cs OpenLocalBrowser code injection6.9 Medium
- cordea oauthFriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider9.8 Critical
- piwigoPiwigo: Authenticated RCE via File Upload in Logo Upload Feature9.1 Critical
- piwigoPiwigo: Second-Order SQL Injection7.2 High
- piwigoPiwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)8.1 High
- piwigoPiwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`9.1 Critical
- piwigoPiwigo: SQL Injection in Batch Manager7.2 High
- dalibo postgresql anonymizerPostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink4.3 Medium
- invoiceplaneInvoicePlane: Missing CSRF Protection on State-Changing delete Actions7.5 High
- invoiceplaneInvoicePlane permits local file inclusion through the e-invoice XML configuration identifier7.5 High
- invoiceplaneInvoicePlane permits DDL injection through tax_rate_decimal_places7.2 High
- input-leap input leapInput Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used...5.3 Medium
- invoiceplaneInvoicePlane: Remote Code Execution via Writable Templates Directory9.1 Critical
- invoiceplaneInvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms4.8 Medium
- invoiceplaneInvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check6.5 Medium
- invoiceplaneInvoicePlane: Missing CSRF Token Validation on Multiple Delete Endpoints6.5 Medium
- invoiceplaneInvoicePlane: Loose Type Comparison in Core Authentication Check (Defense-in-Depth)4.8 Medium
- invoiceplaneInvoicePlane: Recurring Invoice State Change via GET Request Without CSRF Protection6.5 Medium
- Show moreLoading…