CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- eclipse foundation netx duoNetX Duo's WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it...9.3 Critical
- eclipse foundation netx duoWhen NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session...8.3 High
- eclipse foundation netx duoNetX Secure TLS accepts an empty application-data record without verifying its message...6.3 Medium
- eclipse foundation netx duoThe `_nx_secure_x509_asn1_tlv_block_parse()` function parses ASN.1 TLV (tag-length-value) blocks...7.5 High
- eclipse foundation threadxAn unprivileged, memory-protected ThreadX module can have the kernel read and write memory at...8.5 High
- rochacbruno marmiteMarmite through 0.4.2 Unauthenticated API Access via Development Server8.7 High
- rochacbruno marmiteMarmite through 0.4.2 Path Traversal via Development Server8.7 High
- px4 px4-autopilotPX4 Autopilot through 1.17.0 Stack Exhaustion via tests file2 Command7.1 High
- px4 px4-autopilotPX4 Autopilot through 1.17.0 NULL Pointer Dereference via sd_stress7.1 High
- openclawOpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket6.0 Medium
- openclawOpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines6.0 Medium
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +8 more +10 moreLibsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth8.6 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreLibsoup: libsoup: heap buffer overflow during websocket client-frame masking8.6 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +14 more +16 moreLibsoup: libsoup: heap buffer overflow during websocket receive-buffer growth8.6 High
- gnome libsoup, red hat enterprise linux 10, enterprise linux 10.0 extended update support +5 more +7 moreLibsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding8.2 High
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.48.9 High
- red hat openshift virtualization 4Kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume6.5 Medium
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.49.5 Critical
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 moreJoomla Extension - balbooa.com - File meta data tampering in Balbooa Forms < 2.4.3.46.9 Medium
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.46.9 Medium
- balbooa forms, balbooa.com balbooa forms extension for joomla +1 moreJoomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.48.6 High
- electronElectron: <webview> can enable Node.js integration in Web Workers despite embedder restrictions8.3 High
- wikimedia foundation mediawiki - userpageviewtracker extensionUnauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters7.5 High
- electronElectron: File and HTTP protocol handlers allow cross-origin reads without corsEnabled7.4 High
- the wikimedia foundation mediawiki - wikibase extensionStored XSS on Wikibase Special:SetSiteLink via unescaped system message6.1 Medium
- electronElectron: Windows opened from a sandboxed top-level document do not inherit its sandbox restrictions8.2 High
- the wikimedia foundation mediawiki - centralauth extensionCentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)7.5 High
qemuAlpaquita,qemu-hweUbuntu +1 more[hw/net/virtio-net: strip trailing padding when caching RSC segment]No scoreqemuAlpaquita,qemu-hweUbuntu +1 more[hw/display/vga: fix text-mode OOB write after a graphics surface switch]No scoreqemuAlpaquita,qemu-hweUbuntu +1 more[virtio-balloon: fix free-page BH teardown on unrealize]No scoreqemuAlpaquita,qemu-hweUbuntu +1 more[io/channel-socket: do not treat a zero length write as an error]No scoreqemuAlpaquita,qemu-hweUbuntu +1 moreqemu-11.1.2-1.1 on GA mediaNo scoreqemuAlpaquita,qemu-hweUbuntu +1 more[hw/display/qxl: validate primary surface stride against width]No score- ollamaOllama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization8.5 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260905] - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.37.0 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.37.0 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.35.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.36.9 Medium
- wikimedia foundation mediawiki - wikiseo extensionStored XSS in WikiSEO author and image properties on action=info6.1 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.35.9 Medium
- joomla joomla\!, joomla! project cms, framework filter package +2 moreJoomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.37.1 High
- wikimedia foundation mediawiki - datatransfer extensionDataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)7.5 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260908] - Core - XSS in HTML Mail Templates in Joomla 4.0.0-5.4.8, 6.0.0-6.1.36.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.38.9 High
- electronElectron drops inherited HTML sandbox restrictions for popups opened through OpenURLFromTab8.2 High
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.35.1 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.36.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.35.9 Medium
- joomla joomla\!, joomla! project cms +1 moreJoomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.38.2 High
- joomla joomla\!, joomla! project cms, framework filter package +2 moreJoomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.37.1 High
- Show moreLoading…