CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- faststone image viewerFastStone Image Viewer TGA Image out-of-bounds write5.3 Medium
- netcore power13Netcore POWER13 ubus routerd.passwd_set password recovery6.9 Medium
- flarum frameworkLaravel: XSS in Debug Page Information3.1 Low
- juliangruber brace-expansionbrace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion7.5 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files3.6 Low
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: world-writable temporary child repositories in system-helper cache path3.9 Low
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: world-readable oci authentication token in system-helper cache path3.2 Low
- juliangruber brace-expansionbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service5.3 Medium
- juliangruber brace-expansionbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion7.5 High
- jpadilla pyjwtPyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header5.3 Medium
- wind river systems inc vxworks 7VxWorks 7 Memory allocation5.5 Medium
- jpadilla pyjwtPyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion6.5 Medium
- ziroom zhome a0101Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection9.4 Critical
- facebook proxygenIn proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams ...7.5 High
- facebook proxygenIn proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction:...5.3 Medium
- facebook proxygenIn proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its...7.3 High
- jpadilla pyjwtPyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set5.9 Medium
- jpadilla pyjwtPyJWT accepts public JWK containers as HMAC secrets7.4 High
- jpadilla pyjwtPyJWT BOM Bypass7.4 High
- jpadilla pyjwtPyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard7.4 High
- eleveo quality managementEleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure5.3 Medium
- jpadilla pyjwtPyJWT: ReDoS vulnerability when calling the `is_pem_format` function.4.4 Medium
curlUbuntucurl regressionNo score- jpadilla pyjwtPyJWT: Non-canonical signature segments enable raw-token revocation bypass4.8 Medium
- jpadilla pyjwtPyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard9.1 Critical
- jpadilla pyjwtPyJWT: PyJWKClient follows redirects when fetching JWKS7.4 High
- jpadilla pyjwtPyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation7.4 High
- invoiceplaneInvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)7.0 High
- wind river inc vxworks 7VxWorks Memory Allocation5.5 Medium
- invoiceplaneInvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery8.7 High
- eleveo call recording softwareEleveo Call Recording Software User Management userAddAction.do ldap injection5.3 Medium
- jpadilla pyjwtPyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)5.3 Medium
- jpadilla pyjwtPyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)5.3 Medium
- rhukster dom-sanitizerDOMSanitizer - Incomplete data: URL Sanitization in DOMSanitizer::isDangerousUrl() Allows Base64-Encoded Payloads to Bypass href and xlink:href Validation4.7 Medium
- grpc grpc-node@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized7.4 High
- eleveo call recording softwareEleveo Call Recording Software Query Builder searchAction.do access control5.3 Medium
- zephyrproject zephyrOut-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)3.7 Low
- zephyrproject zephyrOut-of-bounds write in the IEEE 802.15.4 L2 transmit path for oversized non-6LoWPAN frames6.3 Medium
- zephyrproject zephyrOut-of-bounds write in the ADI MAX32 ADC driver due to incorrect adc_sequence buffer size validation7.8 High
- zephyrproject zephyrOut-of-bounds write in the NXP MCUX LPADC ADC driver due to missing adc_sequence buffer size validation7.8 High
- zephyrproject zephyrMissing write validation of user-supplied handle pointer in the RTIO syscall verifier allows arbitrary kernel write7.8 High
- brainstorm force convertplusConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter8.8 High
- grpc grpc-node@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages3.7 Low
- wind river systems inc vxworks 7VxWorks 77.8 High
- eleveo quality managementEleveo Quality Management QMBODownload information disclosure5.3 Medium
- authlibAuthlib library contains a signature‑verification bypass vulnerability9.8 Critical
- grpc grpc-node@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches6.5 Medium
- eleveo quality managementEleveo Quality Management Questionnaire Audio Upload Scorecard.jsp path traversal5.3 Medium
- berriai litellmLiteLLM Weak JWT Authentication via Email-Based User Lookup7.6 High
- eleveo call recording softwareEleveo Call Recording Software Play Audio audio.jsp cross site scripting5.1 Medium
- Show moreLoading…