Skip to content
OpenAdvisories

Archive

15 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /15 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-54337 Public exploit

    Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite

    Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue.

    ShaneIsrael fireshare
  • Critical 9.8
    CVE-2026-89026 Public exploit Scanner template

    Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

    The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to …

    Issabel Foundation Issabel Framework
  • Critical 9.4
    CVE-2026-77179 Public exploit

    Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback

    On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbit…

    Docker Docker Sandboxes
  • Critical 9.1
    CVE-2026-52824 Public exploit Scanner template

    Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover

    Kimai is an open-source time tracking application. Prior to 2.58.0, the official Docker image sets APP_SECRET to the public value change_this_to_something_unique in Dockerfile, and .docker/entrypoint.sh neither replaces nor rejects that value before Symfony u…

    Kimai Project kimai kimai/kimai Packagist
  • Critical 9.1
    CVE-2026-90847 Public exploit

    EFM ipTIME C200E System Setup iux_set.cgi os command injection

    A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exp…

    EFM ipTIME C200E
  • Critical 9.9
    CVE-2026-79303 Public exploit

    kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without …