CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to...4.7 Medium
- apache xmlschemaApache XMLSchema: Denial of service through cyclic schema definitions in the schema walker7.5 High
- apache xmlschemaApache XMLSchema: Denial of service through deeply nested schema structures7.5 High
- apache xmlschemaApache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes7.5 High
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to...6.4 Medium
- mypresta google merchant center feedUnauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module9.3 Critical
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an...3.0 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages7.1 High
- qt for mcusOut-of-bounds read vulnerability in string formatting impacts Qt for MCUs8.8 High
- artifex ghostscriptLocal Privilege Escalation in Ghostscript for Windows7.0 High
- hewlett packard enterprise hpe oneviewHPE OneView - URL Redirect vulnerability4.3 Medium
- denx software engineering das u-bootOut-of-bounds write in Das U-Boot9.0 Critical
- hewlett packard enterprise hpe oneviewHPE OneView - Cross-site scripting vulnerability8.2 High
- apache apache-airflow-providers-teradata, apache software foundation airflow teradata provider +1 moreApache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag6.3 Medium
- apache apache-airflow-providers-snowflake, apache software foundation airflow snowflake provider +1 moreApache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain6.3 Medium
- apache apache-airflow-providers-teradata, apache software foundation airflow teradata provider +1 moreApache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs6.5 Medium
- apache apache-airflow-providers-google, apache software foundation airflow google provider +1 moreApache Airflow Google provider: Google Drive query injection via unescaped file and folder names4.3 Medium
- hewlett packard enterprise hpe oneviewHPE OneView - Cross-site scripting vulnerability8.2 High
- hitachi energy asset suiteAsset Suite allows unauthenticated users to access PropertiesReloadServlet, CacheFlushServlet,...5.1 Medium
- hitachi energy asset suiteAsset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used...8.5 High
- gitlabMissing Authorization in GitLab3.7 Low
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabIncorrect Authorization in GitLab4.3 Medium
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- hitachi energy rtu500 series cmu firmwareAn improper authorization vulnerability in the RTU500’s web application allows an authenticated...6.5 Medium
- hitachi energy rtu500 series cmu firmwareA directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500...9.1 Critical
- red hat enterprise linux 6Dash: dash: heap out-of-bounds write in conv_escape via undersized unicode escape reservation4.0 Medium
- red hat enterprise linux 6Dash: dash: super-polynomial backtracking in pmatch when libc fnmatch is disabled5.5 Medium
- hitachi energy rtu500 series cmu firmwareAn authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500...9.1 Critical
- flowring technology corp agentflow 4.0Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）7.1 High
- apache karafApache Karaf: Authorization bypass in JMX MBean lifecycle operations8.8 High
- apache karafApache Karaf: config:install missing ACL entry allows privilege escalation to admin6.3 Medium
- flowring technology corp agentflow 4.0Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type9.3 Critical
- apache karafApache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create9.8 Critical
- apache karafApache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation9.8 Critical
- flowring technology corp agentflow 4.0Flowring Agentflow 4.0 - Exposed Dangerous Method or Function8.7 High
- flowring technology corp agentflow 4.0Flowring Agentflow 4.0 - SQL Injection9.3 Critical
- flowring technology corp agentflow 4.0Flowring Agentflow 4.0 - SQL Injection9.3 Critical
- octopus deploy serverIn affected versions of Octopus Server, an authenticated user with permissions to edit an...8.7 High
- dassault systèmes geovia geospatial data managerCode Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x9.9 Critical
- progress software progress® telerik® fiddler® everywhereMissing Authentication in the local .NET backend of Progress Telerik Fiddler Everywhere7.7 High
- progress software progress® telerik® fiddler® everywhereExposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere5.6 Medium
- realjerrytang tacomallrealjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization6.9 Medium
- coolbeans1212 mateishomepage-websitecoolbeans1212 MateisHomePage-Website users.php cross site scripting5.3 Medium
- codecanyon rocket lmsCodeCanyon Rocket LMS Student Profile Image Upload cross site scripting5.1 Medium
- mwasikz robo-cafe-rmsmwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting5.1 Medium
- mwasikz robo-cafe-rmsmwasikz robo-cafe-rms manage-food.php unrestricted upload5.1 Medium
- owen2345 camaleon cmsowen2345 Camaleon CMS Media Crop media_controller.rb crop authorization5.3 Medium
- shell-quoteshell-quote `quote()` command injection via a line terminator in a token after a `{ comment }` token9.2 Critical
- No product listedREBUILD file-editor-save authorization6.9 Medium
- Show moreLoading…