Skip to content
OpenAdvisories

Archive

10 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /10 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 8.8
    CVE-2026-79987 Public exploit

    Low-privilege RCE through element-search eager loading

    A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker.

    craftcms cms
  • Critical 9.8
    CVE-2026-88899 Public exploit

    knowns before 0.31.0 External Control of Agent Working Directory via x-opencode-directory Header

    knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.

    knowns-dev knowns
  • High 8.8
    CVE-2026-88009 Public exploit

    Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging

    Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.57, and 3.7.13, Traefik accepts a rootless HTTP/1 request target that Go stores in URL.Opaque while leaving URL.Path empty. The rewriteRequestBuilder path evaluates routing, path sa…

    traefik traefik traefik-3.6 github.com/traefik/traefik Wolfi Go
  • High 7.0
    CVE-2026-88008 Public exploit

    Traefik: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') and Incorrect Authorization

    Traefik is an open source HTTP reverse proxy and load balancer. From 2.11.26 until 2.11.57 and 3.7.13, Traefik forwards a client-supplied Connection header requesting Upgrade, the Upgrade: h2c token, and HTTP2-Settings to a shared backend. If the backend acce…

    traefik traefik traefik-3.6 github.com/traefik/traefik Wolfi Go
  • Critical 9.8
    CVE-2026-88877 Public exploit

    Traefik v3.7.0 Authentication Bypass via from-to-www-redirect

    Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotatio…

    traefik traefik
  • High 8.3
    CVE-2026-88861 Public exploit

    Capgo AAL1 Session MFA Bypass via Direct RBAC Authorization

    Capgo (Cap-go/capgo.app) contains an authentication bypass affecting all versions (no patched version available at time of publication). The Edge authorization path allows a password-only Supabase aal1 session to exercise privileged RBAC permissions even when…

    Capgo capgo.app
  • Low 2.4
    CVE-2026-0303 Public exploit

    Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File

    A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.

    Palo Alto Networks Checkov by Prisma Cloud Network devices
  • High 7.5
    CVE-2026-77771 Public exploit

    miniOrange 2FA (Free & Pro) - 2FA Bypass via Session-Scoped OTP Lockout

    The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing…

    Web / CMS
  • Critical 10.0
    CVE-2026-77770 Public exploit

    miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

    The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary o…

    Web / CMS
  • Critical 9.8
    CVE-2026-57967 Public exploit

    Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

    An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache Activ…

    Apache Software Foundation Apache ActiveMQ Artemis Apache Artemis
  • Critical 9.8
    CVE-2026-18351 Public exploit

    Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter

    The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6.0 via the elementor_file_upload function. This is due to insufficient file type validation in the is_file_t…

    add-ons.org Drag and Drop File Upload for Elementor Forms Web / CMS
  • High 7.5
    CVE-2025-57231 Public exploit Scanner template

    Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local fil…

  • Medium 5.4
    CVE-2026-36392 Public exploit

    FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can injec…