CVEs published in September 2026
14,844 vulnerabilities, 1,524 critical, 36 exploited.
- openclaw windows nodeOpenClaw Windows Node before 2026.7.1 Authorization Bypass8.7 High
- openclaw windows nodeOpenClaw Windows Node before 2026.7.1-3 Missing Authorization7.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body5.3 Medium
- themehigh extra product options for woocommerce | custom product addons and fieldsWordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability7.2 High
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- 10web photo gallery by 10webWordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability8.8 High
- wpmu dev brandaWordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability7.1 High
- optimoleWordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability6.5 Medium
- hook & filter nested pagesWordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability9.8 Critical
- boldgrid post and page builder by boldgridWordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability7.1 High
- magazine3 schema & structured data for wp & ampWordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability8.8 High
- sayontan photonic gallery & lightbox for flickr, smugmug & othersWordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability7.1 High
- crocoblock jetengineWordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- gpriday page builder by siteoriginWordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability7.2 High
- villatheme curcyWordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability7.1 High
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability6.5 Medium
- the wikimedia foundation mediawiki pagetriage extensionpagetriagelist discloses suppressed reviewer usernames1.2 Low
- the wikimedia foundation mediawiki wikbase extensionVarious rawParams() and escaped() updates to prevent XSS in Wikibase extension0.3 Low
- the wikimedia foundation mediawiki wikistories extensionVarious rawParams() and escaped() updates to prevent XSS in Wikistories extension0.3 Low
- taskclusterTaskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)8.7 High
- yii2-starter-kityii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download6.9 Medium
- yii2-starter-kityii2-starter-kit through 4.2.0 Debug and Gii Module Exposure9.3 Critical
- yii2-starter-kityii2-starter-kit through 4.2.0 Unrestricted File Upload RCE8.7 High
- denoland denoDeno 2.7.0 through 2.9.7 Command Injection via node:child_process9.2 Critical
- corvusoft restbedrestbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering8.7 High
- corvusoft restbedrestbed through 5.0.0 Denial of Service via Unbounded Header Buffering8.7 High
- the wikimedia foundation mediawiki readinglists extensionReadingLists imported metadata permits JavaScript URL XSS1.1 Low
- mozilla thunderbirdHeap buffer overflow opening large email6.1 Medium
- the wikimedia foundation mediawiki wikilambda extensionWikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments7.4 High
- pollen-robotics reachy-mini-osReachy Mini Wireless: Local Privilege Escalation via Unrestricted sudo systemctl Grant7.8 High
- the wikimedia foundation mediawiki page forms extensionStored XSS through PageForms #autoedit redirect links1.2 Low
- quenary tugtainerTugtainer: OIDC id_token claims accepted without signature/audience/expiry verification8.1 High
- quenary tugtainerTugtainer: Authenticated SSRF via arbitrary notification URLs in test_notification endpoint9.1 Critical
- quenary tugtainerTugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset9.8 Critical
- quenary tugtainerTugtainer: OIDC login remains accessible when OIDC_ENABLED is false9.4 Critical
- vllmvllm-project vLLM Gemma4UnifiedParser gemma4.rs denial of service6.9 Medium
org.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-98906 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-978773 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-845849 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-758882 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-677785 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-652915 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-582928 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-572912 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-511225 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-495603 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-473893 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-448914 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-439774 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo scoreorg.bouncycastle:bcprov-jdk18onRoot,io.root.org.bouncycastle:bcprov-jdk18onRoot +1 moreAIKIDO-2026-391408 in org.bouncycastle:bcprov-jdk18on - Patched by RootNo score- Show moreLoading…