CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- jupyter notebook, jupyterlab, jupyterlab jupyterlite-core +2 moreJupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard8.1 High
- jupyterlab, jupyterlab jupyterlite-core +1 moreJupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)6.8 Medium
- steveukx git-jssimple-git: `VISUAL` editor environment variable is omitted from unsafe editor detection9.2 Critical
- risesoft-y9 workflow-enginerisesoft-y9 WorkFlow-Engine OAuth2 Resource Filter CustomHistoricProcessServiceImpl.java getByIdAndYear sql injection6.9 Medium
- simple-git project simple-git, steveukx git-js +1 moresimple-git unsafe-operation guard does not block trailer command configuration9.2 Critical
- simple-git project simple-git, steveukx git-js +1 moresimple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291)8.1 High
- simple-git project simple-git, steveukx git-js +1 moresimple-git allows command execution through unblocked Git configuration includes8.1 High
- eugeny russhRussh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path3.7 Low
- eugeny russhRussh: Missing X25519 zero-point validation in hybrid ML-KEM key exchange4.3 Medium
- eugeny russhrussh: Client-side channel-scoped Handler callbacks fire for channel IDs the client never opened7.5 High
- cthackers adm-zipadm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation7.1 High
- eugeny russhrussh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic3.7 Low
- eugeny russhRussh: Unbounded memory exhaustion via CHANNEL_OPEN flood during a client-stalled rekey6.5 Medium
- eugeny russh, rust pageant +1 morepageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)6.2 Medium
- electronElectron: Local race condition in Squirrel.Mac update installation on macOS6.7 Medium
- ibm iIBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service []7.8 High
- eclipse foundation threadx levelxOut-of-bounds Write via NAND Metadata Parsing at Mount in LevelX8.6 High
- eclipse foundation guix`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it...5.9 Medium
- eclipse foundation threadx netx duoFTP Passive Data Connection Not Bound to the Authenticated Control Peer6.0 Medium
- mobilitydbMobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization7.1 High
- ibm datastage on cloud pak for dataDataStage on Cloud Pak for Data has several vulnerabilities8.8 High
- phpcsstandards phpcsutilsPHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()8.6 High
- oauthlibOAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison6.8 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.2 High
- eclipse foundation threadx netx duoOut-of-bounds reads in NetX Secure client-side handshake parsing (ServerHello and HelloVerifyRequest)6.3 Medium
- oauthlibOAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation6.1 Medium
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.9.1 Critical
- eclipse foundation threadx netx duoUnbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read7.1 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.7.5 High
- eclipse foundation threadx netx duoOut-of-bounds Read from Unvalidated MSRP Attribute List Length7.1 High
- eclipse foundation threadx netx duoNULL pointer dereference when evicting the last MSRP attribute in a participant's list7.1 High
- eclipse foundation threadx netx duoNULL Pointer Dereference on MSRP Attribute Table Exhaustion7.1 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.1 High
- eclipse foundation threadx netx duoThe FTP client trusts arbitrary IP addresses in the PASV server response6.9 Medium
- google mcp toolbox for databasesPath Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases8.6 High
- eclipse foundation threadx netx duoTFTP client and server copy the ERROR packet message without bounding the read against the packet6.9 Medium
- eclipse foundation threadx netx duoDHCP client option walk drifts one byte per skipped option, reading past the received message and past the saved options buffer5.3 Medium
- python software foundation cpythonRace condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory5.9 Medium
- eclipse foundation threadx netx duoNetX Secure DTLS server issues predictable HelloVerifyRequest cookies, so a spoofed client can pass the return-routability check6.3 Medium
- eclipse foundation threadx netx duoOut-of-bounds read in the NetX Duo SNMP OID parser via a multi-byte BER length8.7 High
- eclipse foundation threadx netx duoA malformed Session header permanently orphans one packet-pool block per RTSP request8.7 High
- electronElectron: Sandboxed preload code cache can be poisoned by a compromised renderer7.8 High
- eclipse foundation threadx netx duomDNS string cache accepts a shorter name as a match for a longer stored one, so the known-answer encoder writes past the transmit packet7.1 High
- eclipse foundation threadx netx duoICMPv6 option validation accepts a trailing byte residue, sending the Router Advertisement, Neighbor Solicitation, Neighbor Advertisement and Redirect option walkers past the packet or into a permanen…7.1 High
- eclipse foundation threadx netx duoUnbounded DATA datagram in the NetX Duo TFTP server causes an out-of-bounds read and a permanent stall8.3 High
- eclipse foundation threadx netx duoOut-of-bounds read in the NetX Secure DTLS ClientHello parser6.3 Medium
- eclipse foundation threadxOut-of-bounds Read and Unverified Entry Pointers in the ThreadX Module Loader6.9 Medium
- eclipse foundation threadxAttacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_MODULE_MEMORY_PROTECTION`...8.5 High
- eclipse foundation threadxImproper validation of non-secure (NS) pointers in multiple TrustZone-M non-secure callable (NSC)...8.4 High
- eclipse foundation netx duoThe NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH message. Each malformed...8.2 High
- Show moreLoading…