CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- horilla horilla-hrHorilla attendance approval endpoint is vulnerable to cross-site request forgery5.9 Medium
- horilla horilla-hrHorilla: Authenticated RCE in Horilla List-View Export8.8 High
- actualbudget actualActual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token7.1 High
- pawelmalak flameFlame through 2.4.0 Admin Token Insufficient Session Expiration5.9 Medium
- pawelmalak flameFlame through 2.4.0 Brute-Force Attack via Login Endpoint8.3 High
- gitoxidelabs gitoxidegitoxide gix-fs before 0.23.0 Worktree Escape via Symlink7.3 High
- pawelmalak flameFlame through 2.4.0 Information Exposure via GET /api/config6.9 Medium
- horilla horilla-hrHorilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View8.5 High
- horilla horilla-hrHorilla: Server-Side Template Injection (SSTI) in Mail Preview Endpoints Allows Authenticated Users to Disclose Password Hashes and Server Metadata6.5 Medium
- horilla horilla-hrHorilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)6.5 Medium
khojPyPIkhoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystem8.7 High- invoiceplaneInvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade7.5 High
- phpOOB read / info leak in convert.* stream filters when line-break-chars contains NUL5.9 Medium
- phpIPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)6.5 Medium
- the wikimedia foundation mediawiki - wikilambda extensionStored i18n XSS in WikiLambda's VisualEditor integration4.8 Medium
- wikimedia foundation mediawiki - externaldata extensionUnauthenticated remote code execution through wikitext in ExternalData10.0 Critical
- wikimedia foundation mediawiki - uploadwizard extensionUploadWizard Flickr collection and set titles allow DOM XSS5.3 Medium
- phpTLS Hostname Verification Falls Back to CN After SAN Mismatch4.3 Medium
- the wikimedia foundation mediawiki - wikibase extensionReflected XSS in Wikibase Special:SetLabel language validation5.3 Medium
- wikimedia foundation wikipedia android appCross-request disclosure of CentralAuth cookies in Wikipedia Android App5.3 Medium
- phpHeap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN6.5 Medium
- the wikimedia foundation mediawiki - translate extensionMissing permission check in the Translate sandbox doRemind action5.3 Medium
- esri lercEsri Lerc has a security vulnerability7.5 High
- wikimedia foundation mediawiki - templatesandbox extensionTemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix4.8 Medium
- phpVarious packet overreads in mysqlnd_writeprotocol.c3.4 Low
- the wikimedia foundation mediawiki - wikilambda extensionRevision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract6.9 Medium
- phpCross-origin credential leak in HTTP stream wrapper redirects5.9 Medium
- issdandavis scbe-aethermooreSCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email Digests7.5 High
- phpSOAP: Unbounded Recursion in Server-Side cleanup_xml_node7.5 High
- alastairlundy alastairlundy.cliinvoke, cliinvoke +1 moreCliInvoke: Argument Injection in Extensibility Runner Factory8.4 High
- phpInteger overflow to buffer overflow in soap HTTP parsing6.5 Medium
- rustdeskRustDesk before 1.5.0 One-Way File Transfer Bypass2.3 Low
- phpPHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS6.9 Medium
- mhdzumair mediaflow-proxyMediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation8.8 High
- tobychui zoraxyZoraxy 3.2.3 through 3.3.4 Client IP Spoofing via X-Forwarded-For IPv69.1 Critical
- gestsupGestSup before 3.2.62 Remote Code Execution via IMAP Attachment9.2 Critical
- rustdeskRustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages5.3 Medium
- pgpointcloud pointcloudpgPointcloud through 1.2.5 heap out-of-bounds read via WKB deserialization7.2 High
- the wikimedia foundation mediawiki - flaggedrevs extension"Checked by" label in page history should not be shown if the underlying review log entry is suppressed"6.9 Medium
- phpPhar TAR phar_tar_number() Integer Overflow - Archive Entry Injection4.3 Medium
- phpOut-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header5.8 Medium
- alastairlundy cliinvoke.specializationsCliInvoke.Specializations: Command injection in PowerShell and Cmd shell wrappers8.4 High
- the wikimedia foundation mediawiki - cargo extensionCargo Exhibit field alias allows stored XSS6.9 Medium
- the wikimedia foundation mediawiki - cargo extensionReflected XSS through Cargo Drilldown full-text search6.9 Medium
- microsoft 365 apps, 365 apps for enterprise, office ltsc 2021 +3 more +5 moreMicrosoft Office Outlook Remote Code Execution Vulnerability7.5 High
- open-metadata openmetadataOpenMetadata through 2.0.2 SSRF via Webhook URL Validation Bypass5.1 Medium
- macwarrior clipbucket-v5ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php8.6 High
- gnu libextractorGNU libextractor before 1.16 Privilege Escalation via LIBEXTRACTOR_PREFIX7.3 High
- the wikimedia foundation mediawiki - cargo extensionAnonymous reflected XSS in CargoExport invalid-alias errors6.9 Medium
@openzeppelin/confidential-contractsnpmOpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet7.1 High- Show moreLoading…