CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- progressive robot ltd hmailserverImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer9.8 Critical
- blubrry powerpress podcasting plugin by blubrryPowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block6.8 Medium
- nextscripts nextscripts: social networks auto-posterNextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion5.9 Medium
- ihomefinder optima express idxOptima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script6.8 Medium
- ihomefinder optima express idxOptima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache5.3 Medium
- malcure malware shield — removal, repair, monitor, unknown malcure malware shield — removal, repair, monitor +1 moreMalcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request7.2 High
- futtta wp youtube lyteWP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes6.8 Medium
- soft8soft llc verge3d publishing and e-commerceVerge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file5.3 Medium
- unknown mailchimp for woocommerceMailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR5.3 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import6.8 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview4.1 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings4.9 Medium
- etruel wpematico rss feed fetcherWPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run4.1 Medium
- unknown online scheduling and appointment booking systemBookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options4.7 Medium
- unknown online scheduling and appointment booking systemBookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR3.8 Low
- codename065 download managerDownload Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription8.8 High
- unknown embedpressEmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes6.8 Medium
- unknown webfacing™WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php5.3 Medium
- davidanderson updraftplus: wp backup & migration pluginUpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice5.3 Medium
- ad inserter inserter, unknown ad inserter +1 moreAd Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields7.5 High
- coollabsio coolifycoollabsio Coolify GitHub App Setup redirect missing authentication6.9 Medium
- edimax br-6428ncEdimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow5.3 Medium
- heymrun heymHeym before 0.0.53 Authentication Bypass via Telegram Webhook8.3 High
- heymrun heymHeym before 0.0.53 Slack Webhook Signature Verification Bypass8.3 High
- heymrun heymHeym before 0.0.53 Remote Code Execution via eval() Sandbox Escape8.7 High
- heymrun heymheym before 0.0.91 Remote Code Execution via Expression Engine8.7 High
- heymrun heymHeym before 0.0.91 SSRF via image fetching and IPv6 validation5.3 Medium
- heymrun heymheym before 0.0.91 Multiple Secrets Plaintext Storage6.9 Medium
- heymrun heymheym before 0.0.105 SSRF via credential-controlled base URLs5.3 Medium
- heymrun heymheym before 0.0.105 Authentication Bypass via Redis Node6.8 Medium
- heymrun heymHeym before 0.0.106 Credential Exfiltration via URL Override7.1 High
- heymrun heymheym before 0.0.109 Server-Side Request Forgery via Workflow Nodes7.6 High
- azuracastAzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass8.2 High
- azuracastAzuraCast before 0.23.8 Command Injection via Streamer Username8.7 High
- azuracastAzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile7.2 High
- azuracastAzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist4.8 Medium
- azuracastAzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs7.1 High
- azuracastAzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL7.1 High
- azuracastAzuraCast before 0.23.8 DQL Injection via sortOrder8.7 High
- project-monai monaiMONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains7.3 High
- project-monai monaiMONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache8.5 High
- project-monai monaiMONAI through 1.6.0 Remote Code Execution via bundle configuration8.5 High
- edgelesssys contrastContrast before 1.16.0 Remote Attestation Relay Attack9.1 Critical
- edgelesssys contrastContrast before 1.23.1 Image Substitution via Policy Generation8.6 High
- patriksimek vm2vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool6.9 Medium
- patriksimek vm2vm2 before 3.12.2 Host Process Termination via Construct Trap8.9 High
- patriksimek vm2vm2 before 3.12.2 Authorization Bypass via Custom Resolver9.5 Critical
- coollabsio coolifycoollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization6.9 Medium
- d-link dir-895lD-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write9.4 Critical
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project viewresult.php sql injection6.9 Medium
- Show moreLoading…