CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
inetutilsDebian[use of uninitialized struct sigaction]No score- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to denial of service4.9 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to denial of service6.5 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to denial of service6.5 Medium
- elastic kibanaUncontrolled Resource Consumption in Kibana Leading to denial of service6.5 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to denial of service6.5 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to denial of service6.5 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service6.5 Medium
- elastic elasticsearchUncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service6.5 Medium
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Deletion of Data6.5 Medium
- elastic kibanaAuthorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data6.3 Medium
- elastic kibanaUnintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation7.3 High
- themefic ultra addons for contact form 7Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field9.8 Critical
- cyberlord92 miniorange otp login, verification and sms notificationsminiOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter9.8 Critical
- itthinx groups – memberships and access controlGroups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode8.8 High
- lomart up, lomart.fr up plugin for joomla +1 moreJoomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.299.2 Critical
- lomart up, lomart.fr up plugin for joomla +1 moreJoomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.2910.0 Critical
- lomart up, lomart.fr up plugin for joomla +1 moreJoomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.298.3 High
- lomart up, lomart.fr up plugin for joomla +1 moreJoomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.299.4 Critical
- acymailing, acymailing.com acymailing extension for joomla +1 moreJoomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.08.3 High
- acymailing, acymailing.com acymailing enterprise extension for joomla +1 moreJoomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.09.5 Critical
- joomlaboat youtube gallery, joomlaboat.com youtube gallery extension for joomla +1 moreJoomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.39.3 Critical
- cap-go capgo.appcapgo through 12.128.2 IDOR via PUT /app icon endpoint5.3 Medium
- froxlorFroxlor before 2.3.12 Stored XSS via SSL certificate issuer9.3 Critical
- froxlorFroxlor before 2.3.12 Credential Disclosure via DirProtections API7.1 High
- froxlorFroxlor before 2.3.12 Authentication Bypass via EmailSender.add7.1 High
- froxlorfroxlor before 2.3.12 CRLF Injection via validateUrl userinfo8.5 High
- froxlorFroxlor before 2.3.12 Privilege Escalation via Symlink9.4 Critical
- froxlorFroxlor before 2.3.12 Arbitrary File Deletion via Symlink8.5 High
- froxlorFroxlor before 2.3.12 Command Injection via letsencryptchallengepath9.4 Critical
- froxlorFroxlor before 2.3.12 Privilege Escalation via SSH Key Sync7.1 High
- froxlorfroxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF7.1 High
- froxlorfroxlor before 2.3.12 Authentication Bypass via Session Persistence8.7 High
- froxlorFroxlor before 2.3.12 DKIM Private Key Disclosure via API6.9 Medium
- froxlorFroxlor before 2.3.11 2FA Bypass via Namespace Confusion7.7 High
- froxlorFroxlor before 2.3.13 Private Key Disclosure via Certificates API7.1 High
- kyvernoKyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path8.3 High
- kyvernokyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath9.4 Critical
- kyvernoKyverno before 1.19.1 SSRF via legacy apiCall service executor8.3 High
- kyvernoKyverno before 1.19.1 ImageValidatingPolicy Exception Bypass8.3 High
- kyvernoKyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib8.3 High
- nodemailerNodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays8.2 High
- nodemailerNodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion6.0 Medium
- nodemailernodemailer before 10.0.6 Denial of Service via addressparser8.7 High
- nodemailerNodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment6.9 Medium
- vrana adminerAdminer before 6.0.2 Privileged-Port SSRF via host_port Regex6.9 Medium
- vrana adminerAdminer 6.0.0 Server-Side Request Forgery via ClickHouse driver5.3 Medium
- vrana adminerAdminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver6.9 Medium
- vrana adminerAdminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE5.3 Medium
- gitpython-developers gitpythonGitPython before 3.1.62 Path Traversal via gitmodules path8.7 High
- Show moreLoading…