Skip to content
OpenAdvisories

Archive

5 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /5 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-86060 Exploited Public exploit

    SSH session privilege manipulation via a crafted username in Mikrotik RouterOS

    RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticate…

    MikroTik RouterOS Network devices
    KEV Sep 10, 2026
  • High 8.7
    CVE-2026-67281 Public exploit

    Unauthenticated file read in Mikrotik RouterOS

    RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that…

    MikroTik RouterOS Network devices
  • Medium 6.9
    CVE-2026-67279 Exploited Public exploit

    SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

    RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the…

    MikroTik RouterOS Network devices
    KEV Sep 25, 2026
  • Critical 9.2
    CVE-2026-67276 Exploited Public exploit

    SSH user impersonation possible in Mikrotik RouterOS

    RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker …

    MikroTik RouterOS Network devices
  • Critical 9.8
    CVE-2026-10196 Public exploit

    Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields

    The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' f…

    getwpfunnels Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails Web / CMS
  • Critical 9.8
    CVE-2026-13447 Public exploit

    MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

    The Mstore Api plugin for WordPress is vulnerable to Authentication Bypass via JWT Forgery in versions up to, and including, 4.20.0 This is due to missing cryptographic signature verification in the FirebasePhoneAuthHelper::verify_id_token() function, which d…

    inspireui MStore API – Create Native Android & iOS Apps On The Cloud Android iOS Web / CMS