CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- budibase serverBudibase server before 3.45.0 Cross-Tenant Information Disclosure7.1 High
- budibase serverBudibase Server before 3.45.0 Credential Exposure via External Table Broadcast7.0 High
- budibase serverBudibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps8.6 High
- budibase serverBudibase before 3.45.0 Information Disclosure via Chat Links8.3 High
- budibase serverBudibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC9.2 Critical
- budibase serverBudibase before 3.45.0 SQL Injection via column-rename DDL8.9 High
- budibase serverBudibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink8.7 High
- budibase serverBudibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook6.3 Medium
- budibase serverBudibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import8.6 High
- stoatchatstoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket7.1 High
- stoatchatstoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting8.3 High
- stoatchatstoatchat before 0.15.5 Account Enumeration via Error Location6.9 Medium
- stoatchatstoatchat before 0.15.5 Local Filesystem Read via SVG8.8 High
- stoatchatstoatchat before 0.15.5 Denial of Service via mass mentions7.1 High
- stoatchatstoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization5.3 Medium
- getgrav grav-plugin-datamanagerGrav Data Manager before 1.4.5 Stored XSS via item-detail view8.4 High
- getgrav grav-plugin-commentsgrav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure8.7 High
- getgrav gravGrav before 2.0.25 Session Cookie Theft via Twig Sandbox8.6 High
- getgrav gravGrav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass8.7 High
- getgrav gravGrav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass8.7 High
- getgrav gravGrav before 2.0.25 Sandbox Escape via array Filter7.1 High
- getgrav gravgrav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass6.9 Medium
- nettyNetty 4.2.0 through 4.2.16 Response Desynchronization via HttpServerCodec6.9 Medium
- nettyNetty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass8.7 High
- nettyNetty 4.2.2 through 4.2.17 HTTP/1 Host Header Authority Confusion8.7 High
- nettyNetty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/38.7 High
- nettyNetty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS8.7 High
- nettyNetty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation8.7 High
- nettyNetty before 4.2.18.Final QpackEncoder Unbounded Memory Retention8.7 High
- nettyNetty 4.2.0 through 4.2.17 HTTP/3 Request Routing Bypass6.9 Medium
- vllmvLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids7.1 High
- vllmvLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation8.3 High
- vllmvLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids8.2 High
- vllmvllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass7.1 High
- vllmvLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization7.1 High
- vllmvLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass6.3 Medium
- vllmvllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding6.9 Medium
- vllmvLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt6.9 Medium
- siyuan-note siyuanSiYuan before v3.8.4 Authentication Bypass via Missing Origin Header8.6 High
- siyuan-note siyuanSiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban8.6 High
- siyuan-note siyuanSiYuan before v3.8.4 SQL Injection via dailyNoteSavePath8.7 High
- siyuan-note siyuanSiYuan before v3.8.4 Stored XSS via Attribute View textarea8.5 High
- siyuan-note siyuanSiYuan v2.1.0 before v3.8.4 Cross-Site Request Forgery via CheckAuth7.2 High
- siyuan-note siyuanSiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content8.6 High
- siyuan-note siyuanSiYuan before v3.8.4 Clipboard Data Disclosure via IPC8.6 High
- siyuan-note siyuanSiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL8.6 High
- siyuan-note siyuanSiYuan before v3.8.4 Path Traversal via setNotebookIcon8.3 High
- siyuan-note siyuanSiYuan before v3.8.4 Path Traversal via checkoutRepo sessionID8.3 High
- siyuan-note siyuanSiYuan before v3.8.4 Path Traversal via exportBrowserHTML folder8.3 High
- siyuan-note siyuanSiYuan before v3.8.4 Authentication Bypass via Plaintext Session Cookie8.2 High
- Show moreLoading…