CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 extended lifecycle support +11 more +13 moreFlatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems7.5 High
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting5.3 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: path traversal issue in oci archive extraction via hardlinks6.5 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authentication5.3 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injection6.9 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injection6.9 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project cross-site request forgery5.3 Medium
- universal-tool-calling-protocol python-utcputcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass2.3 Low
- universal-tool-calling-protocol python-utcppython-utcp before 1.1.4 SSRF via unvalidated HTTP redirects8.4 High
- universal-tool-calling-protocol python-utcputcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass7.1 High
- universal-tool-calling-protocol python-utcppython-utcp before 1.1.12 SSRF via Remote HTTP Manual7.1 High
- universal-tool-calling-protocol python-utcputcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL2.3 Low
- fleetdm fleetFleet Homebrew Cask OS Command Injection via Metadata8.9 High
- pnpmpacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias7.1 High
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreTCP Initial Sequence Number (ISN) prediction8.8 High
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreMemory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service8.8 High
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreMemory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service8.8 High
- parse-community parse-serverParse Server 9.0.0 Authentication Bypass via Unverified Provider Identity7.4 High
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreMemory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of Service8.8 High
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreHTTP Request Smuggling9.3 Critical
- citrix netscaler gateway, citrix netscaler adc, gateway +1 more +3 moreFeature policy bypass due to improper HTTP URL based expression usage7.0 High
- citrix netscaler, netscaler gateway, citrix netscaler adc +2 more +4 moreMemory overflow vulnerability leading to Remote Code Execution or Denial of Service9.5 Critical
- citrix netscaler, netscaler gateway, citrix netscaler adc +2 more +4 moreA remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands9.5 Critical
- circl vulnerability-lookupVulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover6.3 Medium
- tombursch kitchenowlKitchenOwl through 0.7.10 IDOR via unchecked category ID5.3 Medium
- denisidoro navinavi through 2.24.0 OS Command Injection via Cheatsheet Variables7.3 High
- syliusSylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite8.7 High
- syliusSylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication8.7 High
- syliusSylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header8.7 High
- syliusSylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API8.2 High
- penpot, penpot @penpot/mcp +1 morePenpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge5.3 Medium
- spaceship-promptspaceship-prompt through 4.22.5 Terminal Escape Sequence Injection4.8 Medium
- o2sh onefetchonefetch through 2.28.1 Terminal Escape Sequence Injection4.8 Medium
latex-rustcrates.ioStack overflow on deeply nested LaTeX inputNo score- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.06.9 Medium
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.07.0 High
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.05.1 Medium
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.05.1 Medium
- svenbluege event gallery, svenbluege.de event gallery for joomla +1 moreJoomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.05.3 Medium
- wolfsslHeap use-after-free on read during bidirectional (D)TLS shutdown2.3 Low
- wolfsslOCSP stapling v2 multi accepts non-CA chain certificates as issuers8.3 High
- wolfsslNameConstraints not enforced across unconstrained intermediate CA6.3 Medium
- wolfsslSubject CN name-constraint check bypassed when non-DNS SAN present6.3 Medium
- wolfsslFailed X509_verify_cert leaves unverified CA in shared CertManager6.3 Medium
- wolfsslClient accepts unsolicited RawPublicKey server certificate type8.3 High
- wolfsslTrusted peer certificate match ignores public key, allowing forged CA clones8.3 High
- wolfssl(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange6.3 Medium
- wolfsslCRL check skipped when OCSP enabled and certificate has no OCSP URL2.3 Low
- wolfsslSignature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY2.3 Low
- wolfsslClient session cache reference poisoning allows resumption with wrong server2.3 Low
- Show moreLoading…