Skip to content
OpenAdvisories

Archive

11 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /11 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.8
    CVE-2026-89754 Public exploit

    mm/pagewalk: fix stale walk->action escaping walk_pmd_range()

    In the Linux kernel, the following vulnerability has been resolved: mm/pagewalk: fix stale walk->action escaping walk_pmd_range() If ->pmd_entry() sets walk->action = ACTION_AGAIN, the pmd_none() check is retried. The PMD entry may be cleared at the point of …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2026-89633 Public exploit

    smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

    In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against bu…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2026-81000 Public exploit

    net: tun: bound receive headroom

    In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request fro…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2026-72708 Public exploit

    SPIP < 4.4.18 Unauthenticated Blind SQL Injection via sitemap.xml.html

    SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open…

    SPIP SPIP spip spip Debian Ubuntu
  • High 7.5
    CVE-2026-89013 Public exploit Scanner template

    Dolibarr 23.0.4 < 24.0.1 Authorization Bypass via hashp Parameter in document.php

    Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files through the document storage endpoints by supplying a crafted hashp parameter value. Attackers can send a request with h…

    Dolibarr dolibarr
  • Medium 6.5
    CVE-2026-89012 Public exploit

    Dolibarr 24.0.0 < 24.0.1 SQL Filter Denylist Bypass via sqlfilters Parameter

    Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows authenticated attackers to recover protected database fields by supplying uppercase variants of denylist-protected field na…

    Dolibarr dolibarr
  • Medium 5.9
    CVE-2026-81861 Public exploit

    CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information…

    Schneider Electric SCADAPack 57x SCADAPack 47xi SCADAPack 47x ICS / OT
  • High 8.8
    CVE-2026-38056 Public exploit

    ST Engineering iDirect iQ-Series Terminals Missing Authorization

    A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastructure as the primary, and often sole c…

    ST Engineering iDirect Evolution iQ‑Series terminals 9-Series Terminals 3315-Series terminals