CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- siyuan-note siyuanSiYuan before v3.8.4 Missing Authorization via siyuan-send-windows5.3 Medium
- siyuan-note siyuanSiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations8.5 High
- parse-community parse-serverParse Server 9.0.0 before 9.10.1 Protected Fields Disclosure via LiveQuery7.1 High
- parse-community parse-serverParse Server 9.0.0 Unauthenticated Installation Deletion via Operator Injection8.7 High
- wwbn avideoAVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field5.1 Medium
- cap-go capgo.appCapgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH7.0 High
- cap-go capgo.appcapgo.app before 12.128.12 Authentication Bypass via apikey8.7 High
- cap-go capgo.appCapgo bundle promotion API channel RBAC deny override bypass7.2 High
- cap-go capgo.appCapgo Build Upload Proxy Authorization Bypass via TUS Resource8.7 High
- cap-go capgo.appCapgo.app before 12.264.5 Upload Expiry Bypass via build upload5.3 Medium
- cap-go capgo.appCapgo Authentication Bypass via Direct PostgREST org_users Table Write8.7 High
- cap-go capgo.appcapgo.app through 12.129.0 Cache Restoration of Deleted Bundles8.7 High
- cap-go capgo.appcapgo.app Content-Lock Bypass via r2-direct Bundle Mutation5.3 Medium
- cap-go @capgo/cliCapgo CLI through 7.98.2 Excessive Permissions via Overpermissioned Play Console Service Account5.1 Medium
- cap-go capgo.appCapgo OTA Manifest Poisoning via app_versions.manifest Bypass8.7 High
- cap-go capgo.appCapgo App Icon Update Privilege Escalation via Service-Role Worker8.7 High
- cap-go capgo.appCap-go capgo.app Authorization Bypass via channel_permission_overrides8.7 High
- cap-go capgo.appcapgo.app Authentication Bypass via PostgREST customer_id Mutation7.0 High
- cap-go capgo.appCap-go capgo.app before 12.267.1 Privilege Escalation via API Key Rotation8.7 High
- cap-go capgo.appCapgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker8.7 High
- cap-go capgo.appcapgo.app Authorization Bypass via Stale Channel Permission Overrides6.0 Medium
- cap-go capgo.appCapgo SSO Provider ID Authentication Bypass via Incomplete Migration8.6 High
- cap-go capgo.appCapgo apikey_manager Role Privilege Escalation via Incomplete Role Deny-list7.1 High
- flowiseai flowiseFlowise through 3.1.4 Missing Authorization via upsert-history7.7 High
- flowiseai flowiseFlowise through 3.1.4 Insecure Direct Object Reference via Credential7.6 High
- flowiseai flowiseFlowise through 3.1.4 Authorization Bypass via BullMQ Dashboard8.7 High
- flowiseai flowiseFlowise through 3.1.4 Authentication Bypass via Email-Only SSO9.2 Critical
- flowiseai flowiseFlowise through 3.1.4 Authentication Bypass via SSO Email Match9.2 Critical
- flowiseai flowiseFlowise through 3.1.4 Missing Authorization via Chat Message Routes7.5 High
- openclaw clawhubClawHub Authentication Bypass via Former Publisher Skill Control5.3 Medium
- openclaw clawhubClawHub before 8c2de6c506 Skill Hiding via Coordinated Reports8.7 High
- openclaw clawhubClawHub Changelog Preview Information Disclosure via Authorization Bypass7.1 High
- openclaw clawhubClawHub SSRF via Unchecked DNS Resolution in Profile Image6.9 Medium
- openclaw clawhubClawHub before 8c2de6c506 Quota Exhaustion via Anonymous API6.9 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project mydetailsfaculty.php sql injection6.9 Medium
basic-tomlcrates.io`basic-toml` is unmaintainedNo score- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project updatedetailsfromstudent.php sql injection6.9 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting5.3 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project updateguest.php sql injection5.3 Medium
- linux, linux kernel +1 morecgroup: Avoid iteration of dying tasks with zero refcount7.8 High
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting5.1 Medium
- addify request a quote for woocommerceRequest a Quote for WooCommerce <= 2.9.2 - Unauthenticated Arbitrary File Upload via AJAX Popup Handler9.8 Critical
libdbi-perlDebian,perl-dbiAlpaquita,perl-DBI-debuginfoRed Hat +1 more +3 moreDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv6.2 Mediumlibdbi-perlDebian,perl-dbiAlpaquita +1 moreDBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName7.5 High- j0hnsmith testimonials widgetTestimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL5.8 Medium
- j0hnsmith testimonials widgetTestimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update7.5 High
- optimoleOptimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block6.8 Medium
- unknown mcp server for wordpressMCP Server for WordPress < 1.8.2 - Contributor+ Arbitrary Post Title Disclosure via workflows/run REST Route2.7 Low
- unknown mcp server for wordpressMCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check2.7 Low
- unknown mcp server for wordpressMCP Server for WordPress < 1.8.2 - Administrator Account Creation via CSRF8.8 High
- Show moreLoading…