CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- mozilla firefox, thunderbird +1 moreUse-after-free in the Storage: IndexedDB component8.8 High
- mozilla firefox, thunderbird +1 moreUse-after-free in the DOM: Core & HTML component8.8 High
- mozilla firefox, thunderbird +1 moreUndefined behavior in the DOM: Streams component8.1 High
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the DOM: Content Processes component9.6 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: WebAssembly component8.8 High
- mozilla firefox, thunderbird +1 moreUse-after-free in the Networking: Cache component8.8 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking: JAR component4.3 Medium
- mozilla firefox, thunderbird +1 moreUse-after-free in the JavaScript: WebAssembly component8.8 High
- mozilla firefox, thunderbird +1 moreSandbox escape due to use-after-free in the DOM: Content Processes component9.6 Critical
- mozilla firefox, thunderbird +1 moreSandbox escape in the Security: Process Sandboxing component9.6 Critical
- mozilla firefox, thunderbird +1 moreUninitialized memory in the Storage: Quota Manager component8.1 High
- mozilla firefox, thunderbird +1 moreSandbox escape in the DOM: Navigation component9.6 Critical
- mozilla firefox, thunderbird +1 moreUse-after-free in the Widget component8.8 High
- mozilla firefox, thunderbird +1 moreIncorrect boundary conditions in the Audio/Video: Playback component8.1 High
- lxcLXC: lxc-copy host-context hostname update follows symlink6.8 Medium
- No product listedCross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3...5.4 Medium
- No product listedAn issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote...9.8 Critical
- trusted domain project opendkimTrusted Domain Project OpenDKIM Tag Tokenizer dkim.c dkim_process_set less trusted source6.9 Medium
- gz-yami mall4jmall4j through 4.0 Insufficient Session Expiration via Token Refresh5.3 Medium
- gz-yami mall4jmall4j through 4.0 Unrestricted File Upload in Admin File Endpoints2.1 Low
- gz-yami mall4jmall4j through 4.0 Missing Authorization in Admin User Address Endpoints7.1 High
- gz-yami mall4jmall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API5.3 Medium
- gz-yami mall4jmall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Number6.3 Medium
- gz-yami mall4jmall4j through 4.0 Missing Authentication in Product Review Deletion6.9 Medium
- gz-yami mall4jmall4j through 4.0 Missing Authentication in Password Update Endpoint9.3 Critical
- intelbras tip 125iIntelbras TIP 125i Básico sensitive information in source2.3 Low
- zephyrproject zephyrInteger underflow of net_buf length in the MCUmgr serial (SMP over console) transport leads to out-of-bounds read6.8 Medium
- zephyrproject zephyrNULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted5.9 Medium
- zephyrproject zephyrWild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error6.5 Medium
- ziroom zhome a0101Ziroom ZHOME A0101 set_passwd command injection9.4 Critical
- ziroom zhome a0101Ziroom ZHOME A0101 set_online_client command injection9.4 Critical
- ziroom zhome a0101Ziroom ZHOME A0101 set_online_client command injection9.4 Critical
- ziroom zhome a0101Ziroom ZHOME A0101 firstSetup_wifi command injection9.4 Critical
- nginxproxymanager nginx-proxy-managerNginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config7.1 High
- nginxproxymanager nginx-proxy-managerNginx Proxy Manager through 2.16.0 Missing Brute-Force Protection9.1 Critical
- cle-b httpdbghttpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL5.3 Medium
- amir20 dozzleDozzle before 11.1.2 Path Traversal via Log ZIP Download4.6 Medium
- ziroom zhome a0101Ziroom ZHOME A0101 firstLogin command injection9.4 Critical
- zoneminderZoneMinder before 1.38.4 Incorrect Authorization in frames API index5.3 Medium
- zoneminderZoneMinder before 1.38.4 Buffer Overflow via HTTP Camera Response8.3 High
- cotontiCotonti through 1.0.0 Cross-Site Request Forgery via User Group Deletion5.3 Medium
- siyuan-note siyuanSiYuan before v3.8.4 Information Disclosure via getCurrentAttrViewImages6.9 Medium
- siyuan-note siyuanSiYuan before v3.8.4 SQL Injection via Block Query Embed7.1 High
- zoneminderZoneMinder 1.37.x Path Traversal via files view7.1 High
- faststone image viewerFastStone Image Viewer PCX Decoder out-of-bounds5.3 Medium
- faststone image viewerFastStone Image Viewer TGA Image FSViewer.exe out-of-bounds5.3 Medium
- open source robotics foundation robot operating system 2 (ros 2)Unsafe use of eval() method in ros2 topic hz tool8.6 High
- @angular platform-server, angular +1 moreAngular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE8.7 High
- faststone image viewerFastStone Image Viewer 1bpp RLE Decoder out-of-bounds write5.3 Medium
- nestjs nestNest: Remote process termination via a deeply nested microservice message pattern7.5 High
- Show moreLoading…