Skip to content
OpenAdvisories

Archive

6 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /6 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.1
    CVE-2026-86283 Public exploit

    MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

    MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The CollectionsController::view() action correctly resolved collect…

    MISP MISP
  • High 7.5
    CVE-2026-86259 Public exploit

    OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

    OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parame…

    THU-MAIC OpenMAIC
  • Critical 9.8
    CVE-2026-75816 Public exploit

    Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

    The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionP…

    shabti Frontend Admin by DynamiApps Web / CMS
  • Critical 10.0
    CVE-2026-86218 Exploited Public exploit Scanner template EPSS 15%

    pre-authentication remote code execution

    N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

    N-able N-central
    KEV Sep 8, 2026