Skip to content
OpenAdvisories

Archive

6 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /6 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

92 results · Feed

  • Medium 6.3
    CVE-2026-86164

    itsourcecode Sales and Inventory System trans_view.php sql injection

    A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/trans_view.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The e…

    itsourcecode Sales and Inventory System
  • Medium 6.3
    CVE-2026-86163

    itsourcecode Sales and Inventory System pro_del.php sql injection

    A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/pro_del.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The …

    itsourcecode Sales and Inventory System
  • High 7.3
    CVE-2026-86162

    SourceCodester Online Voting System ajax.php login sql injection

    A vulnerability was determined in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. T…

    SourceCodester Online Voting System
  • High 7.3
    CVE-2026-86161

    SourceCodester Online Voting System ajax.php delete_category sql injection

    A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the a…

    SourceCodester Online Voting System
  • Critical 9.8
    CVE-2026-75816 Public exploit

    Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

    The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the pre_update_value function lacking any capability or ownership check, and ActionP…

    shabti Frontend Admin by DynamiApps Web / CMS
  • High 7.5
    CVE-2026-18056

    HivePress Authentication <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator

    The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party i…

    HivePress HivePress Authentication Web / CMS
  • Critical 9.8
    CVE-2026-16310

    MemberDash <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter

    The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers t…

    LearnDash MemberDash Web / CMS
  • Critical 10.0
    CVE-2026-86218 Exploited Public exploit Scanner template EPSS 15%

    pre-authentication remote code execution

    N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

    N-able N-central
    KEV Sep 8, 2026
  • High 7.3
    CVE-2026-86160

    SourceCodester Online Voting System ajax.php delete_voting sql injection

    A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete_voting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely…

    SourceCodester Online Voting System
  • High 7.3
    CVE-2026-86159

    SourceCodester Online Voting System ajax.php save_user sql injection

    A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_user. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been pub…

    SourceCodester Online Voting System
  • Critical 9.1
    CVE-2026-86153

    Tenda CP3 Redirect.cpp SetRedirectEnable privileges management

    A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible.

    Tenda CP3
  • Critical 10.0
    CVE-2026-86152

    Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection

    A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched r…

    Tenda CP3