Skip to content
OpenAdvisories

Archive

2 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /2 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.6
    CVE-2026-84380 Public exploit

    HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

    HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setd…

    pydantic httpx2 httpx2 python-httpx2 Debian Ubuntu Wolfi PyPI
  • Medium 4.9
    CVE-2026-52832 Public exploit

    Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

    Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard exposes POST /api/functions without authentication by default (NOP auth mode). The spec.handler field (e.g., mymodule:myfunction) is parsed …

    nuclio nuclio github.com/nuclio/nuclio Go
  • Critical 9.8
    CVE-2026-20212 Public exploit

    Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability

    A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to execute code with root privileges. This vulnerability exists because TCP ports 43210 and 43211 are accessible in the de…

    Cisco Cisco NX-OS Software Network devices
  • Critical 9.8
    CVE-2026-81294 Public exploit

    WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability

    Unauthenticated Privilege Escalation in Authorizer <= 3.15.1 versions.

    Paul Ryan Authorizer
  • High 8.1
    CVE-2026-19219 Public exploit

    DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX

    In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders t…

    Progress Software Telerik UI for ASP.NET AJAX
  • High 8.1
    CVE-2026-80467 Public exploit

    Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action

    The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticate…

    Web / CMS
  • Critical 9.8
    CVE-2026-9055 Public exploit

    Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 - 9.6.2 - Unauthenticated Privilege Escalation to Administrator via 'externalId'

    The Booking for Appointments and Events Calendar – Amelia (Premium) plugin for WordPress is vulnerable to Privilege Escalation in versions 8.0 - 9.6.2. This is due to insufficient validation of the attacker-controlled 'type' parameter in the customer update e…

    melograno Booking for Appointments and Events Calendar – Amelia Web / CMS