CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- canonical lxdPath traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root9.6 Critical
- canonical lxdPath traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD9.9 Critical
- canonical lxdLXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse6.3 Medium
- canonical lxdCLI Path Traversal via Content-Disposition in LXD Image Export/Copy4.2 Medium
udisks2TuxCare,libudisks2TuxCare,libudisks2-develTuxCare +3 more +5 moreUpdate of udisks2No score- abb protection and control ied manager (pcm600)Path Traversal During Project Archive Import5.6 Medium
systemdTuxCare,libgudev1TuxCare,libgudev1-develTuxCare +7 more +9 moreUpdate of systemdNo score- No product listeddbgate Files Endpoint runners.js files path traversal6.9 Medium
systemdTuxCare,libgudev1TuxCare,libgudev1-develTuxCare +7 more +9 moreUpdate of systemdNo score- cbk soft software hardware electronic computer systems industry and trade inc. envisionSQLi in Iron Mountain's enVision8.8 High
- dayforce ess excelityPath Traversal in Dayforce ESS Excelity9.2 Critical
- dayforce ess excelityMultiple Reflected XSS in Dayforce ESS Excelity5.1 Medium
- dayforce ess excelityTime-based SQL Injection in Dayforce ESS Excelity9.3 Critical
huggingface-hubRootAIKIDO-2026-285573 in huggingface-hub - Patched by RootNo score- abb protection and control ied manager (pcm600)Improper Permission Assignment in Scheduler Service7.1 High
- kaon ar2140Improper Authentication in Kaon AR2140X5.3 Medium
- kaon ar2140Missing authentication for backup functionality in Kaon AR2140X7.1 High
- No product listeddbgate Export databaseConnections.js exportModelSql path traversal6.9 Medium
- zscaler zscaler-mcp-serverHMAC Confirmation Token Unbinding in zscaler-mcp-server4.6 Medium
libpngTuxCare,libpng-develTuxCare,libpng-staticTuxCare +2 moreUpdate of libpngNo score- No product listeddbgate Create Connection Endpoint zipJsonLinesData.js zipJsonLinesData path traversal6.9 Medium
- red hat amq broker 7, jboss enterprise application platform 7.4 els on rhel 7, jboss enterprise application platform 7.4.25 +2 moreArtemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization8.2 High
- enocta educational technologies inc. platformImproper Authorization in Enocta Educational's Enocta Platform8.1 High
- enocta educational technologies inc. platformHTML Injection in Enocta Educational's Enocta Platform4.1 Medium
- github.com/antono connect-corsOrigin validation error in the connect-xcors npm package5.3 Medium
- No product listeddbgate save-uploaded-file Endpoint files.js saveUploadedFile path traversal6.9 Medium
freerdp3Ubuntufreerdp3 vulnerabilitiesNo scoreperl-FCGITuxCareUpdate of perl-FCGINo score- manageengine ddi centralAuthenticated Broken Access Control8.8 High
- red hat openshift data foundation 4Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal7.2 High
- No product listeddbgate Archive Link Creation archive.js createLink path traversal6.9 Medium
- f&f filipowski mh-developerDenial of Service in mH-DEVELOPER5.9 Medium
- f&f filipowski mh-developerUse of End-of-Life components in mH-DEVELOPER6.9 Medium
- f&f filipowski mh-developerCleartext Transmission of Sensitive Information in mH-DEVELOPER6.0 Medium
- f&f filipowski mh-developerMissing Firewall Configuration in mH-DEVELOPER5.3 Medium
- f&f filipowski mh-developerMissing Authentication in mH-DEVELOPER6.4 Medium
- f&f filipowski mh-developerUse of Shared Cryptographic Key in mH-DEVELOPER6.3 Medium
- f&f filipowski mh-developerUndocumented access path in mH-DEVELOPER7.7 High
- thinkware u3000Thinkware U3000 TCP Service GET_STATUS information disclosure6.9 Medium
libcrux-kemcrates.ioHybrid Encapsulation from Seed Panics on Short Seed5.6 Medium- manageengine ddi centralAuthenticated Arbitrary File Write8.8 High
- thinkware u3000Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control6.9 Medium
- suse neuvectorOS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes8.8 High
- kubernetesKubernetes kubectl cp path traversal on Windows allows arbitrary file writes6.5 Medium
- rolantis information technologies agentisHTML Injection in Rolantis Information Technologies' Agentis6.1 Medium
- thinkware u3000Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control6.9 Medium
- elixir-mint mintMint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries6.3 Medium
- elixir-mint mintMint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size6.3 Medium
- elixir-mint mintHPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory8.2 High
- refly-ai reflyrefly-ai refly JWT Token app.config.ts hard-coded credentials6.9 Medium
- Show moreLoading…