CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- unknown all in one files uploadAll in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update4.3 Medium
- unknown all in one files uploadAll in One Files Upload for WooCommerce 2.0.3 - 2.0.16 - Unauthenticated Stored XSS via SVG Upload8.8 High
- unknown audio player blockAudio Player Block 1.1.0 - 1.6.2 - Contributor+ Stored XSS via Audio Download URL6.8 Medium
- unknown embedpressEmbedPress 4.4.9 - 4.6.6 - Contributor+ Stored XSS via Elementor Widget showTitle Attribute6.8 Medium
- saad iqbal new user approveNew User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass5.3 Medium
- magazine3 schema & structured data for wp & ampSchema & Structured Data for WP & AMP < 1.67 - Editor+ Stored XSS via Taxonomy Term Fields3.5 Low
- solacewp solace extraSolace Extra < 1.7.2 - Unauthenticated Non-Published Post Content Disclosure via Preview Routes5.3 Medium
- unknown zella themeZella Theme < 2.6.3 - Unauthenticated Arbitrary File Upload9.8 Critical
- unknown user frontendWP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled5.3 Medium
- unknown user frontendWP User Frontend 3.5.29 - 4.3.11 - Unauthenticated Privilege Escalation via Registration Role Encryption7.4 High
- unknown fluentcart a new era of ecommerceFluentCart < 1.6.5 - Unauthenticated Guest Customer Account Takeover via Checkout Email6.5 Medium
- sourcecodester car driving school management systemSourceCodester Car Driving School Management System Master.php save_enrollment sql injection6.9 Medium
- pcre pcre2PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API...7.6 High
- sourcecodester online leave management systemSourceCodester Online Leave Management System page reports sql injection5.1 Medium
- zosmaai pi-llm-wikizosmaai pi-llm-wiki wiki_capture_source MCP tool index.ts os command injection9.4 Critical
- watchguard fireware, fireware os +1 moreFireware OS Pre-Authentication NULL Pointer Dereference Allows Remote Denial of Service8.7 High
- sourcecodester online reviewer management systemSourceCodester Online Reviewer Management System exam-delete.php sql injection6.9 Medium
- pexip infinityPexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation...9.8 Critical
- sourcecodester online reviewer management systemSourceCodester Online Reviewer Management System btn_functions.php sql injection6.9 Medium
- pexip infinityPexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in...7.7 High
- pexip infinityPexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation...7.5 High
- pexip infinityPexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation...7.8 High
- sourcecodester online reviewer management systemSourceCodester Online Reviewer Management System questions-view.php sql injection6.9 Medium
- pexip infinityPexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a...8.8 High
- pexip infinityPexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in...7.5 High
- 0xshariq github-mcp-server0xshariq github-mcp-server Git Remove MCP Tool github.ts child_process.exec os command injection5.3 Medium
- pexip infinityPexip Infinity before 41.0 is affected by improper input validation in the signaling...8.6 High
- wpshuffle frontend post submission manager lite – guest post and frontend submission formsFrontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)7.2 High
- pexip infinityPexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web...8.6 High
- pexip infinityPexip Infinity before 40.1 is affected by improper input validation in the signaling...7.5 High
- hkuds anytoolHKUDS AnyTool Execute Endpoint main.py subprocess.run os command injection6.9 Medium
- pexip infinityPexip Infinity before 41.1 is affected by improper input validation in the media implementation...7.5 High
- zte u30 airAn information disclosure vulnerability in ZTE U30 Air product5.3 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Guest Book buku_tamu.php kirim cross site scripting5.3 Medium
- pfu limited image scanner driver for linux (fi series), image scanner driver for linux (sp series) +1 moreImage Scanner Driver for Linux contains a link following vulnerability. An attacker who can log...5.2 Medium
- pfu limited image scanner driver for linux (fi series), image scanner driver for linux (sp series) +1 moreImage Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who...5.4 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Configuration sistem.php simpan improper authorization5.1 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure6.9 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement laporan_data_pasien.php detail authorization5.1 Medium
- gedelumbung hospitalmanagementgedelumbung HospitalManagement Endpoint data_galeri.php hapus path traversal5.1 Medium
- jknack handlebars.javaHandlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4,...7.5 High
- gosub-io gosub-engineUncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before...7.1 High
- gedelumbung hospitalmanagementgedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload5.3 Medium
- zetetic sqlcipherZetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function...2.1 Low
- beenuar aisocAiSOC 5.1.0 before 12.0.0 Missing Authentication on Realtime Service Internal Endpoints5.3 Medium
- beenuar aisocAiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR9.4 Critical
- beenuar aisocAiSOC 7.5.0 before 12.0.0 Authentication Bypass via Hard-coded JWT Secret8.7 High
- beenuar aisocAiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP7.1 High
- beenuar aisocAiSOC 9.0.0 before 12.0.0 Missing Authentication on Actions Service Response-Action API5.3 Medium
- nothings stbNothings stb Image Encoding stb_image_write.h stbi_write_tga_core integer overflow6.9 Medium
- Show moreLoading…