CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- the wikimedia foundation mediawiki - cargo extensionReflected XSS in Cargo Drilldown hierarchy filters6.9 Medium
- ciena navigator ncsUnauthenticated Event Stream Exposure of Session Tokens in Navigator NCS7.5 High
- tduckcloud tduck-survey-formTDuck survey form through 6.0 Write Password Bypass via Client-Side Enforcement6.9 Medium
- tduckcloud tduck-survey-formTDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endpoint5.3 Medium
- tduckcloud tduck-survey-formTDuck survey form 6.0 Information Disclosure via Fail-Open Form Ownership Check6.0 Medium
- tduckcloud tduck-survey-formTDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints5.3 Medium
- krayin laravel-crmKrayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting5.1 Medium
- glpi-project glpiGLPI: SQL injection in history tab7.1 High
- glpi-project glpiGLPI: Arbitrary Document Read via Form Context Authorization Bypass7.1 High
- glpi-project glpiGLPI: RCE via Form import9.4 Critical
- glpi-project glpiGLPI: Privilege Escalation via authtype API manipulation7.5 High
- glpi-project glpiGLPI: Reflected XSS in dashboards7.5 High
- glpi-project glpiGLPI: arbitrary file deletion8.5 High
- glpi-project glpiGLPI: Stored XSS in suppliers8.5 High
- glpi-project glpiGLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force7.7 High
- krayin laravel-crmkrayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting5.1 Medium
- glpi-project glpiGLPI: Unallowed modfication of knowbase items comments and translations5.3 Medium
- glpi-project glpiGLPI: Unallowed authentication method update by administrator5.9 Medium
- glpi-project glpiGLPI: Unauthorized Debug Mode Activation via Profile Update (Privilege Escalation)5.3 Medium
- glpi-project glpiGLPI: Unexpected access to update operations through the API6.0 Medium
- glpi-project glpiGLPI: LDAP filter injection in user import feature4.6 Medium
- zammadZammad: Microsoft Graph error logs expose partially masked OAuth access tokens5.1 Medium
- zammadZammad: HTML sanitizer API path allowlist bypass via interior path traversal in img src/srcset5.3 Medium
- zammadZammad: Authenticated agents can read AI summary error messages from inaccessible tickets2.3 Low
- zammadZammad: Invalid PGP Detached Signatures Reported as Good Signature on Inbound Mail5.3 Medium
- zammadZammad: Missing rate limiting allows password brute-forcing during two-factor login6.9 Medium
- zammadZammad: Sensitive Information Exposure in Integration Administration API6.9 Medium
- zammadZammad: S/MIME signature verification allows forged sender impersonation7.1 High
- zammadZammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute6.3 Medium
- zammadZammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data7.1 High
- zammadZammad: Stored XSS via unescaped option labels in the object attribute options context UI5.3 Medium
- zammadZammad: Account takeover via unverified email matching during SSO auto-link9.1 Critical
- krayin laravel-crmkrayin laravel-crm User Management UserController.php privileges management5.3 Medium
- zammadZammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration5.3 Medium
- zammadZammad: Remote image tracking bypass via shortened URL scheme5.3 Medium
- zammadZammad: Channel admins can read unauthorized attachments via signature rich-text body5.1 Medium
- yzcheng90 x-springbootX-SpringBoot through 6.0 Authentication Bypass via Static Master Code9.3 Critical
- yzcheng90 x-springbootX-SpringBoot through 6.0 Authentication Bypass via Login Code9.3 Critical
- yzcheng90 x-springbootX-SpringBoot through 6.0 Authorization Bypass via User Management8.6 High
- yzcheng90 x-springbootX-SpringBoot through 6.0 Credential Exposure via Unauthenticated Endpoint6.9 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project managevideos2.php sql injection5.3 Medium
- [unknown] networkmanager-vpncNetworkmanager-vpnc: networkmanager-vpnc: incomplete fix for cve-2018-10900 allows root privilege escalation via ca-file path newline injection7.8 High
- [unknown] networkmanager-vpncNetworkmanager-vpnc: networkmanager-vpnc: local privilege escalation to root via newline injection in vpn username7.8 High
- gnome networkmanager-fortisslvpnNetworkmanager-fortisslvpn: networkmanager-fortisslvpn: local privilege escalation to root via crlf injection in vpn profile credentials7.8 High
- gnome networkmanager-sstpNetworkmanager-sstp: networkmanager-sstp: local privilege escalation to root via shell injection in vpn profile fields7.8 High
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project updatefaculty.php sql injection6.9 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project Student Update Functionality updatestudent.php sql injection5.3 Medium
- zammadZammad: AI Agent template sanitizer bypass leads to remote code execution8.6 High
- zammadZammad: Pending upload deletion bypass via legacy attachment endpoint2.3 Low
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project updatequery.php sql injection6.9 Medium
- Show moreLoading…