Skip to content
OpenAdvisories

Archive

17 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /17 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-45140 Public exploit

    Chamilo LMS CStudio upload flow allows unauthenticated remote code execution

    Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or e…

    chamilo chamilo-lms chamilo/chamilo-lms Packagist
  • Critical 9.2
    CVE-2026-79752 Public exploit

    CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

    CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart, and FunctionsBuilder::dateAdd in src/Database/FunctionsBuilder.php accept user-c…

    cakephp cakephp cakephp/cakephp cakephp Ubuntu Packagist
  • Critical 10.0
    CVE-2026-92956 Public exploit

    vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming

    vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host…

    patriksimek vm2 vm2 npm
  • Critical 9.0
    CVE-2026-92935 Public exploit

    vm2 NodeVM Remote Code Execution via Array-Shaped Require

    vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' && requireOpts !== null`, so an array-shaped `require` value (for example `r…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2026-87796 Public exploit

    Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload

    The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This make…

    sh1zen Multi Uploader for Gravity Forms Web / CMS