Skip to content
OpenAdvisories

Archive

8 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /8 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 8.7
    CVE-2026-86076 Public exploit

    n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScript Execution

    n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind t…

    n8n-io n8n n8n npm
  • High 7.8
    CVE-2026-49881 Public exploit

    In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in th…

    Google Android Android
  • High 8.8
    CVE-2026-28618 Public exploit

    In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote co…

    Google Android Android
  • High 8.8
    CVE-2026-28609 Public exploit

    In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to r…

    Google Android Android
  • High 7.8
    CVE-2026-81963 Exploited Public exploit

    Windows Update Stack Elevation of Privilege Vulnerability

    Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 24H2 Windows
    KEV Sep 8, 2026
  • High 7.8
    CVE-2026-69328 Public exploit

    Windows Storage Elevation of Privilege Vulnerability

    Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 8.6
    CVE-2026-80097 Public exploit

    Microsoft Authenticator Elevation of Privilege Vulnerability

    Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.

    Microsoft Microsoft Authenticator for Android Android
  • High 7.1
    CVE-2026-69451 Public exploit

    Windows Management Instrumentation Elevation of Privilege Vulnerability

    Use after free in Windows Management Instrumentation allows an authorized attacker to elevate privileges over a network.

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • High 7.2
    CVE-2026-74239 Public exploit

    XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows

    XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by …

    XenForo XenForo
  • High 7.5
    CVE-2026-73316 Public exploit

    XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider

    XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid web…

    XenForo XenForo
  • High 8.6
    CVE-2026-73315 Public exploit

    XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler

    XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate…

    XenForo XenForo
  • High 7.5
    CVE-2026-73314 Public exploit

    XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook

    XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value. Whe…

    XenForo XenForo
  • High 7.4
    CVE-2026-73312 Public exploit

    XenForo < 2.3.13 Refresh Token Replay via Expired Access Token

    XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit th…

    XenForo XenForo
  • High 7.4
    CVE-2026-73311 Public exploit

    XenForo < 2.3.13 OAuth2 Authorization Code Reuse

    XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code. Attackers can exploit the failure to invalidate or mark authorization …

    XenForo XenForo
  • High 7.4
    CVE-2026-73309 Public exploit

    XenForo < 2.3.13 Authentication Bypass via OAuth2 Token Endpoint

    XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters. Attackers can explo…

    XenForo XenForo
  • High 7.5
    CVE-2026-78837 Public exploit

    A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensiti…