CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.35.1 Medium
- wikimedia foundation mediawiki - eventbus extensionPrivate change tags exposed to anonymous users via revision-tags-change events7.5 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.37.0 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.35.9 Medium
- wikimedia foundation mediawiki - templatesandbox extensionTemplateSandbox does not check read permissions for the page being previewed9.1 Critical
- wikimedia foundation mediawiki - flow extensionFlow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS6.1 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreLibsoup: libsoup: heap buffer overflow during websocket message reassembly8.6 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreLibsoup: libsoup: heap buffer overflow from websocket pong signal type confusion8.6 High
- imagemagickImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder6.3 Medium
- sgl-project sglangSGLang through 0.5.20 Denial of Service via Duplicate bootstrap_room8.7 High
- libexpat, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 morelibexpat 2.7.2 through 2.8.5 Integer Overflow in expat_realloc8.2 High
- akauntingAkaunting before 2.1.31 OS Command Injection via app alias8.7 High
- yahoo serialize-javascriptSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies2.3 Low
- devolutions serverMissing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and...5.0 Medium
- devolutions serverCleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and...7.2 High
- nagios host, teamviewer full client +1 moreRemote Session Access Control Bypass Leading to Remote Code Execution8.8 High
- unopimUnoPim 2.0.0 before 2.0.1 and 2.1.0 before 2.1.1 Cache Poisoning via X-Forwarded-Host2.3 Low
- nagios host, teamviewer full client +1 moreLocal Privilege Escalation via Improper Link Resolution in Cloud Session Recording7.0 High
- nagios host, teamviewer full client +1 moreHeap-Based Buffer Overflow in TeamViewer Session Recording Playback Leads to Remote Code Execution7.8 High
- nagios host, teamviewer full client +1 moreTime-of-check Time-of-use (TOCTOU) Race Condition in TeamViewer Windows Installer Rollback Mechanism Leads to Local Privilege Escalation7.3 High
- nagios host, teamviewer full client +1 moreImproper Limitation of a Pathname to a Restricted Directory (Path Traversal) in TeamViewer Desktop Clients7.8 High
- devolutions serverMissing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier...5.4 Medium
- python urllib3urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory8.9 High
- devolutions serverMissing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and...6.5 Medium
- python urllib3urllib3: Chunked Deflate streaming can enter an infinite loop6.9 Medium
- opensslQUIC STREAM Fragment Metadata DoS7.5 High
- opensslPotential CPU DoS via O(n^2) Fragment Reassembly in QUIC5.3 Medium
- python urllib3urllib3: HTTPS proxy TLS configuration may be ignored or overridden7.6 High
- devolutions serverImproper access control in the partial connection API in Devolutions Server 2026.3.5.0 and...5.4 Medium
- thephpleague flysystemFlysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter3.5 Low
- devolutions serverImproper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5...4.3 Medium
- @socket.io cluster-engine, socketio socket.io +1 moreSocket.IO: Prototype Pollution via Unsafe Client Session Lookup7.5 High
- pallets werkzeugWerkzeug safe_join() allows Windows special device names6.3 Medium
- fumasoft fumeng cloudFumeng Cloud SQL Injection via AjaxMethod.ashx getEmpByname9.3 Critical
- aws gluontsGluonTS arbitrary command execution during model deserialization8.4 High
- nicotine-plusNicotine+: Decompression of peer messages can exhaust available memory8.7 High
- yonyou a6 oaSeeyon A6 OA Unauthenticated SQL Injection via downloadAtt.jsp8.7 High
- weblateorg weblateWeblate: Mercurial argument injection via repository filenames allows authenticated command execution8.5 High
- webminWebmin: Reflected XSS in the Configuration module9.6 Critical
- mahonelau kykmsmahonelau kykms SqlInjectionUtil QueryGenerator.java QueryGenerator.doMultiFieldsOrder sql injection6.9 Medium
- evbee dc 80Weak root password in EVbee DC 809.3 Critical
- evbee dc-80Sensitive information leak through hidden menu5.1 Medium
- macwarrior clipbucket-v5ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter7.0 High
- macwarrior clipbucket-v5ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter7.0 High
jwtHackageImproper parsing of fractional NumericDate from JWT exp claimsNo score- pardus pardus-parental-controlPardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py6.8 Medium
- opennmt ctranslate2CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization6.9 Medium
- opennmt ctranslate2CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin8.5 High
- nvidia bluefield ga, bluefield lts23, bluefield lts24 +4 more +6 moreNVIDIA ConnectX and Bluefield contain a vulnerability in a control register, where a user with VF...6.8 Medium
- canonical ubuntu pro for wslwsl-pro-service: Ubuntu Pro token exposed via process command-line arguments5.7 Medium
- Show moreLoading…