CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- browserify pbkdf2pbkdf2 rehashes long passwords on every iteration, enabling denial of service6.3 Medium
- No product listedRebuild Login Endpoint login improper authentication6.9 Medium
- No product listedFastAdmin Database Management database.php unnecessary privileges8.5 High
- modsetter surfsenseMODSetter SurfSense circleback Endpoint circleback_webhook_route.py missing authentication6.9 Medium
- modsetter surfsenseMODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery5.3 Medium
- modsetter surfsenseMODSetter SurfSense MCP Connector Integration test command injection5.3 Medium
- limesurveyLimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations7.1 High
- netcore nap930Netcore NAP930 Backup/Restore backup_common.sh hard-coded key5.1 Medium
- netcore nap930Netcore NAP930 Network Tools CGI network_tools eval os command injection10.0 Critical
- bitwarden serverBitwarden Server 2025.6.0 < 2025.6.0 Authentication Bypass via SSO Identifier Truncation7.7 High
- raspap raspap-webguiRaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management8.7 High
- raspap raspap-webguiRaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection5.3 Medium
- htplugins ht contact form – drag & drop form builder for wordpressHT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field7.2 High
- raspap raspap-webguiRaspAP raspap-webgui SSID Processing WiFiManager.php writeWpaSupplicant os command injection5.1 Medium
- fast fac1203rFAST FAC1203R MmtAtePrase _tWlanTask stack-based overflow9.4 Critical
- trusted domain project opendmarcTrusted Domain Project OpenDMARC SPF Macro opendmarc_spf.c opendmarc_sp2_find_mailfrom_domain improper authentication6.9 Medium
- gestsupGestSup before 3.2.62 Stored XSS via Double-Decoded Email Subject in OAuth IMAP Connector5.3 Medium
- gestsupGestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter7.1 High
- gestsupGestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector5.3 Medium
- trusted domain project opendmarcTrusted Domain Project OpenDMARC Multi-Record Set opendmarc_policy_query_dmarc authentication spoofing6.9 Medium
- trusted domain project opendmarcTrusted Domain Project OpenDMARC opendmarc_policy.c integer overflow6.9 Medium
- trusted domain project opendmarcTrusted Domain Project OpenDMARC PSL Wildcard opendmarc_tld.c : opendmarc_get_tld origin validation5.3 Medium
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group5.7 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 +5 more +7 moreFlatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc7.1 High
- mozilla firefox, thunderbird +1 moreInformation disclosure in the Networking component4.3 Medium
- No product listedA stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK...8.8 High
- No product listedA stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK...8.8 High
- No product listedA stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK...9.8 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreParted: parted: heap-based buffer overflow via crafted fat32 filesystem image6.6 Medium
- opensslQUIC: Unbounded RETIRE_CONNECTION_ID Backlog7.5 High
- grafana enterprise, oss +1 moreOAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors6.0 Medium
- No product listedmetatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal...9.8 Critical
- No product listedmetatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP...9.1 Critical
- No product listedbytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql...9.1 Critical
- No product listedmbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool ...6.3 Medium
- No product listedmark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper...5.9 Medium
- No product listedImproper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier...5.3 Medium
- No product listedAn issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the...8.4 High
- No product listedKitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in...4.3 Medium
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreTiming Side-Channel in SM2 Signature Generation3.7 Low
- No product listedOpen GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other...9.8 Critical
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreUnauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS5.3 Medium
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreNULL Pointer Dereference in CMP Client Revocation Response Handling5.3 Medium
- opensslQUIC Connection-Level Flow Control is Not Enforced for Streams5.3 Medium
- opensslOut-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake7.5 High
- No product listedbasecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site...8.8 High
ruby-llmUbuntucrmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains polynomial-time...7.5 High- opensslNon-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V3.7 Low
- openssl, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreTiming Side-Channel in Scalar Multiplication for Non-NIST EC Curves3.7 Low
libpngAlpaquita,libpng1.6Debian,libpng16openSUSE +5 more +7 moreFix CVE(s): CVE-2026-466755.9 Medium- Show moreLoading…