CVEs published in September 2026
14,845 vulnerabilities, 1,524 critical, 36 exploited.
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification...6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed...8.2 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template...4.9 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed...2.7 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose...3.3 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other...7.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule...5.9 Medium
- jetbrains hubIn JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send...7.7 High
- jetbrains riderIn JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user...4.8 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by...2.7 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was...4.7 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only...7.6 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible...5.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a...5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF...4.3 Medium
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was...7.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was...8.1 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute...8.8 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code...8.8 High
- adithyayelloju restaurant-management-systemAdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection6.9 Medium
- ordasoft joomla cck, ordasoft.com ordasoft joomla cck +1 moreJoomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.1610.0 Critical
- vercel satori, next +1 moreSatori-generated SVG has improper escaping5.3 Medium
- liquid-co opensaveOpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path8.6 High
- liquid-co opensaveOpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender6.3 Medium
- mlogclub bbs-gobbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount5.3 Medium
- modeltc lightllmLightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service9.3 Critical
- modeltc lightllmLightLLM through 1.2.0 Missing Authentication on RL Control Routes8.7 High
- modeltc lightllmLightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints6.9 Medium
- vercel next.jsNext.js: Denial of Service in App Router using Server Actions8.2 High
- joomcode jc tables, joomcode.com jctables extension for joomla +1 moreJoomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.110.0 Critical
- withastro astroAstro: Malformed port in the Host header can crash the Node adapter8.2 High
- @astrojs netlify, withastro astro +1 moreAstro: Netlify Image CDN allowlist bypass enables SSRF6.3 Medium
- eclipse foundation netx duoMQTT WebSocket setter ABI mismatch may disclose memory or cause a crash7.5 High
- aja video systems helo plusAJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle8.7 High
gpacUbuntuGPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow5.3 Medium- mispMISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph6.2 Medium
multipath-toolsSUSESecurity update for multipath-toolsNo score- mispMISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field6.2 Medium
- trex digital smart manufacturing systems inc. mesSQL Injection in Trex Digital Manufacturing's Trex MES9.8 Critical
- artifex ghostscriptArtifex Ghostscript Pdfwrite gdevpsfx.c type1_callsubr stack-based overflow5.3 Medium
- trex digital smart manufacturing systems inc. mesMissing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES8.8 High
- wp hosting as pay with vipps for woocommerceWordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability5.3 Medium
- red hat assisted installer for red hat openshift container platform 2, openshift container platform 4.13, openshift container platform 4.15 +2 more +4 moreOc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction7.3 High
- jeff starr user submitted postsWordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.27 - SQL Injection vulnerability7.6 High
- blosc c-blosc2Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow6.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreParted: parted: denial of service via heap buffer overflow during fat16 resize5.5 Medium
- Show moreLoading…