Skip to content
OpenAdvisories

Archive

9 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /9 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

660 results · Feed

  • Medium 6.1
    CVE-2026-7804

    Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter

    The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it po…

    woobewoo Product Filter for WooCommerce by WBW Web / CMS
  • High 7.2
    CVE-2026-17553

    Shopping Cart & eCommerce Store <= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec_ajax_save_page_default_options AJAX Action

    The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option(…

    levelfourstorefront Shopping Cart & eCommerce Store Web / CMS
  • Medium 4.3
    CVE-2026-81644

    DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect avail…

    Huawei HarmonyOS Network devices
  • Medium 4.0
    CVE-2026-49312

    Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect…

    Huawei HarmonyOS Network devices
  • High 8.6
    CVE-2026-49310

    Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerabilit…

    Huawei HarmonyOS Network devices
  • High 7.3
    CVE-2026-49314

    OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability …

    Huawei HarmonyOS Network devices
  • Medium 6.2
    CVE-2026-49311

    Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability…

    Huawei HarmonyOS Network devices
  • Medium 6.4
    CVE-2026-13709

    Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting

    The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output es…

    Iqonic Design Graphina – Charts and Graphs For Elementor Web / CMS
  • High 7.5
    CVE-2026-15406

    Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter

    The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for aut…

    Arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce Web / CMS
  • High 7.5
    CVE-2026-15667

    Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter

    The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for aut…

    Arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce Web / CMS
  • High 7.2
    CVE-2026-13359

    Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter

    The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sani…

    bestweblayout Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress Web / CMS
  • Medium 5.3
    CVE-2026-12956

    Eventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter

    The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check()…

    Arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce Web / CMS
  • High 8.8
    CVE-2026-76801

    FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation

    The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.1.10 via the value function. This is due to a trivially bypassable r…

    fireplugins FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment Web / CMS
  • High 8.1
    CVE-2026-87036

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium Comply
  • High 7.2
    CVE-2026-87021

    Tanium addressed an unauthorized code execution vulnerability in Comply.

    Tanium addressed an unauthorized code execution vulnerability in Comply.

    Tanium Comply
  • High 8.5
    CVE-2026-87023

    Tanium addressed a path traversal vulnerability in Comply.

    Tanium addressed a path traversal vulnerability in Comply.

    Tanium Comply
  • High 7.7
    CVE-2026-87084

    Tanium addressed a server-side request forgery vulnerability in Enforce.

    Tanium addressed a server-side request forgery vulnerability in Enforce.

    Tanium Enforce
  • High 8.3
    CVE-2026-87034

    Tanium addressed a SQL injection vulnerability in Comply.

    Tanium addressed a SQL injection vulnerability in Comply.

    Tanium Comply
  • Medium 5.4
    CVE-2026-87048

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium Comply
  • Medium 6.5
    CVE-2026-87073

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium Comply
  • High 7.1
    CVE-2026-87072

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium Comply
  • Medium 4.3
    CVE-2026-87032

    Tanium addressed an information disclosure vulnerability in Tanium Server.

    Tanium addressed an information disclosure vulnerability in Tanium Server.

    Tanium Tanium Server
  • Medium 4.3
    CVE-2026-87035

    Tanium addressed an information disclosure vulnerability in Comply.

    Tanium addressed an information disclosure vulnerability in Comply.

    Tanium Comply
  • Medium 5.4
    CVE-2026-87033

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium Comply
  • Medium 4.3
    CVE-2026-14892

    Tanium addressed an improper access controls vulnerability in Tanium Server.

    Tanium addressed an improper access controls vulnerability in Tanium Server.

    Tanium Tanium Server
  • Medium 4.3
    CVE-2026-87046

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium Comply
  • High 8.5
    CVE-2026-87030

    Tanium addressed a path traversal vulnerability in Comply.

    Tanium addressed a path traversal vulnerability in Comply.

    Tanium Comply
  • Medium 5.4
    CVE-2026-87025

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium Comply
  • High 8.1
    CVE-2026-87075

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium Comply
  • Medium 6.3
    CVE-2026-87047

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium Comply
  • Medium 6.6
    CVE-2026-14505

    Tanium addressed a path traversal vulnerability in Tanium Data Service.

    Tanium addressed a path traversal vulnerability in Tanium Data Service.

    Tanium Tanium Data Service
  • Medium 4.3
    CVE-2026-87019

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium Comply
  • Medium 5.4
    CVE-2026-87037

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium addressed an improper access controls vulnerability in Comply.

    Tanium Comply
  • High 7.0
    CVE-2026-87088

    Tanium addressed an unauthorized code execution vulnerability in Enforce.

    Tanium addressed an unauthorized code execution vulnerability in Enforce.

    Tanium Enforce
  • Medium 6.5
    CVE-2026-87724

    Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attacke…

    torprject Tor tor tor Debian Ubuntu
  • Medium 5.5
    CVE-2026-87083

    tile-ai tilelang Kernel Cache kernel_cache.py KernelCache._load_kernel_from_disk deserialization

    A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel_cache.py of the component Kernel Cache. Executing a manipulation can lead to deserialization. The a…

    tile-ai tilelang
  • Medium 6.5
    CVE-2026-87593

    Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive infor…

    Google Chrome chromium Browsers Debian
  • High 8.8
    CVE-2026-87430

    Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbi…

    Google Chrome chromium Browsers Debian
  • High 8.8
    CVE-2026-87544

    Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass syste…

    Google Chrome chromium Browsers Debian
  • Medium 5.4
    CVE-2026-87571

    Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging …

    Google Chrome chromium Browsers Debian