CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- apple ipados, macos, ios and ipados +2 more +4 moreAn out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in...8.8 High
- webkul bagistoWebkul Bagisto Invoice Mass Status Update state authorization5.1 Medium
- red hat enterprise linux 10, enterprise linux 10.2 extended update support, enterprise linux 6 +8 more +10 moreGcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if7.0 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 +5 more +7 moreFlatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin7.1 High
- google chromeInsufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55...4.3 Medium
- wind river vxworks 7VxWorks 7 Memory Resource leak5.5 Medium
- ordasoft book library, ordasoft.com book library (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.65.3 Medium
- deepseek deepseek-harnessDeepSeek deepseek-harness Bundle Patch profile.ts loadProfile path traversal2.3 Low
- ordasoft vehicle manager, ordasoft.com vehicle manager (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.85.3 Medium
- ordasoft book library, ordasoft.com book library (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.69.3 Critical
- ordasoft real estate manager, ordasoft.com real estate manager (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.95.3 Medium
- ordasoft real estate manager, ordasoft.com real estate manager (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.99.3 Critical
- meta platforms, inc moxygenIn moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read...7.5 High
- ordasoft vehicle manager, ordasoft.com vehicle manager (free) extension for joomla +1 moreJoomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.89.3 Critical
- deepseek-ai deepseek-harnessdeepseek-ai deepseek-harness dsh index.ts reliance on untrusted inputs in a security decision4.8 Medium
- code-projects matrimonial systemcode-projects Matrimonial System Profile Creation Endpoint create_profile processprofile_form sql injection5.3 Medium
- deepseek-ai deepseek-harnessdeepseek-ai deepseek-harness Code Mode Sandbox run_code sandbox5.3 Medium
- dannymcc bluehoodBluehood: Missing authentication on Bluehood API routes when web auth is enabled9.1 Critical
- stringer-rss stringerAuthenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer7.6 High
- beaugunderson ip-addressip-address: Address6.isLinkLocal() recognizes fe80::/64 rather than fe80::/10, allowing SSRF and trust-boundary bypass to on-link hosts6.3 Medium
- beaugunderson ip-addressip-address: isInSubnet() and isHostInSubnet() compare addresses of different families as if they shared an address space, allowing an allowlist check to admit an address outside its range6.3 Medium
- beaugunderson ip-addressip-address: Address6 builds a parse diagnostic proportional to the input with no length bound, allowing a single long string to stall or crash the process6.3 Medium
- beaugunderson ip-addressip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass6.9 Medium
- ag-ui-protocol ag-uiag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception5.3 Medium
- axiosAxios: Prototype Pollution Gadget in axios toFormData Options8.3 High
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated API generatedocs Host Command Injection8.6 High
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)8.6 High
- sangoma freepbx, freepbx security-reporting +1 moreAuthenticated Remote Code Execution via Path Traversal in FreePBX Backup Module8.6 High
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module8.7 High
- axiosAxios: Prototype pollution gadget in fetch adapter can alter outbound requests6.9 Medium
- sangoma freepbx, freepbx security-reporting +1 moreAuthenticated Command Injection in FreePBX UCP Interface8.6 High
- sangoma freepbx, freepbx security-reporting +1 moreFreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module7.7 High
- axiosAxios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF7.0 High
- axiosAxios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location8.2 High
- axiosAxios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection7.6 High
- ag-ui-protocol ag-uiag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup5.3 Medium
- axiosAxios: Header Injection via Inherited headers After Minimal Interceptor6.9 Medium
- red hat streams for apache kafka 2, streams for apache kafka 3, streamshub console for apache kafka® +2 moreStreamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers6.5 Medium
- axiosAxios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)8.2 High
- axiosAxios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method6.9 Medium
- axiosAxios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization8.2 High
- ag-ui-protocol ag-uiag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition5.3 Medium
- axiosAxios: Fetch Adapter Header Injection via Inherited FormData getHeaders6.9 Medium
- axiosAxios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls7.0 High
- ag-ui-protocol ag-uiag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption5.3 Medium
- kevva decompress@xhmikosr/decompress: Path traversal via symlink chain9.1 Critical
- watchguard apWatchGuard AP Authenticated Command Injection in Diagnostic CLI8.6 High
- watchguard apWatchGuard AP Command Injection in Internal Management API Allows Command Execution9.3 Critical
- watchguard apWatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access9.3 Critical
- red hat pen drive powered by red hat lightspeed, openshift container platform 4.19, openshift container platform 4.20 +2 more +4 moreKube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo7.1 High
- Show moreLoading…