Skip to content
OpenAdvisories

Archive

4 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /4 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.9
    CVE-2026-48019 Public exploit

    CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

    Laravel is a web application framework. Prior to versions 12.60.0 and 13.10.0, a CRLF injection vulnerability in Laravel's email validation, in combination with how Symfony Mailer and Symfony Mime handle certain character sequences, may allow an unauthenticat…

    laravel framework laravel/framework php-laravel-framework Debian Packagist
  • High 8.1
    CVE-2026-85625 Public exploit

    sift 17.1.3 Prototype Pollution Remote Code Execution via $where

    sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key including $where. The $where operation compiles a string value into a function using new Function unless CSP_ENABLED is …

    crcn sift.js
  • High 7.9
    CVE-2026-85649 Public exploit

    (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the …

    chewkeanho software-actualizer
  • High 7.5
    CVE-2026-85612 Public exploit

    OpenPanel before 2.3.0 SSRF via favicon and og endpoints

    OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrar…

    Openpanel-dev openpanel
  • High 7.1
    CVE-2022-35499 Public exploit

    In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injec…

  • High 8.1
    CVE-2026-78839 Public exploit

    An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploadin…