CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- No product listedPMWeb encryptionhelper.dll information disclosure6.9 Medium
- polybase payyPayy: agg_agg trailing message slots are unconstrained and allow forged burn messages8.7 High
- leshchenko1979 fast-mcp-telegramSSRF via DNS-resolution gap in _validate_url_security (file download by URL)7.1 High
- networkupstools nutNetwork UPS Tools: A PWN Request in make-dist workflow can execute PR-controlled code with write-scoped GITHUB_TOKEN8.2 High
- No product listedPMWeb downloader.aspx path traversal6.9 Medium
- d-link di-8400D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow9.4 Critical
python-setuptoolsTuxCareUpdate of python-setuptoolsNo score- tencent ai-infra-guardTencent AI-Infra-Guard File Access dir_actions.py startsWith path traversal2.4 Low
- suse rancherUnauthenticated update of public UI settings leading to stored cross-site scripting in Rancher9.6 Critical
- suse rancherSession Not Revoked Server-Side on Logout in Rancher8.1 High
- langflow-ai langflowLangflow Code Execution via eval() in Component Input Schema2.1 Low
- sailpoint technologies identityiqSailPoint IdentityIQ Improper Form Validation Vulnerability9.6 Critical
- agentverus agentverus-scanneragentverus agentverus-scanner context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision2.4 Low
- suse rancher, rancher fleet +1 moreFleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters8.8 High
- deepseek-ai deepseek-harnessdeepseek-ai deepseek-harness Landlock Backend profiles.ts isolation4.8 Medium
pythonTuxCare,python-debugTuxCare,python-develTuxCare +4 more +6 moreUpdate of pythonNo score- marcoscamara01 ecommerce templateMissing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service6.9 Medium
- the gnu c library glibcOne-byte overread in strncasecmp on Power83.7 Low
postgresqlTuxCare,postgresql-contribTuxCare,postgresql-develTuxCare +9 more +11 moreUpdate of postgresqlNo score- netcore nr289-geNetcore NR289-GE boa_temp process_request missing authentication10.0 Critical
microcode_ctlTuxCareUpdate of microcode_ctlNo score- unslothai unsloth, unsloth-zoo +1 moreUnsloth Zoo Code Injection via model_type in config.json8.6 High
glib2TuxCare,glib2-develTuxCare,glib2-docTuxCare +3 more +5 moreUpdate of glib2No score- netcore nr289-geNetcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection10.0 Critical
- suse rancher, rancher fleet +1 moreFleet applies namespace labels and annotations without the bundle's service account privileges6.5 Medium
- netcore nr289-geNetcore NR289-GE Location Time location_time.cgi system os command injection10.0 Critical
- enterprisedb warehousepgWarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation8.7 High
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint3.7 Low
- netcore nr289-geNetcore NR289-GE Authentication boa password-check stack-based overflow9.3 Critical
- extegrity exam4macOS Exam4 Local Privilege Escalation via Command Injection7.8 High
- dell live optics collectorDell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded...5.6 Medium
- dell boot optimized server storage (boss)Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip...6.8 Medium
- dell boot optimized server storage (boss)Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip...5.1 Medium
- suse rancher, rancher fleet +1 moreUnauthenticated GitRepo Spec Mutation via Fleet Git Webhook Receiver5.4 Medium
- dell boot optimized server storage (boss)Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip...7.0 High
- suse rancher, rancher fleet +1 moreCross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet7.1 High
- netcore nr289-geNetcore NR289-GE CGI Dispatcher boa improper authentication6.9 Medium
code-ollamanpmcode-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)7.8 High- innotim software, telecommunications and consultancy trade ltd. co. logsign siemDefault Admin Credentials in Innotim Software's Logsign SIEM9.8 Critical
- innotim software, telecommunications and consultancy trade ltd. co. logsign siemPath Traversal in Innotim Software's Logsign SIEM7.1 High
- innotim software, telecommunications and consultancy trade ltd. co. logsign siemCode Injection in Innotim Software's Logsign SIEM8.8 High
tzdataTuxCare,tzdata-javaTuxCare +1 moreUpdate of tzdataNo score- netcore nr289-geNetcore NR289-GE CGI ap_ip.cgi system os command injection10.0 Critical
sqliteTuxCare,lemonTuxCare,sqlite-develTuxCare +2 more +4 moreUpdate of sqliteNo score- acrel electric unet web serviceAcrel Electric Unet Web Service Upload Endpoint upload unrestricted upload5.3 Medium
sqliteTuxCare,lemonTuxCare,sqlite-develTuxCare +2 more +4 moreUpdate of sqliteNo score- suse rancher, rancher fleet +1 morePath traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory6.5 Medium
- canonical lxdLXD client recursive file pull allows directory escape via malicious VM agent5.8 Medium
- canonical lxdArbitrary file write on LXD host via symlink in migration stream9.9 Critical
- canonical lxdIncorrect authorization in LXD storage volume API allows reading volumes from other projects7.7 High
- Show moreLoading…