Skip to content
OpenAdvisories

Archive

18 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /18 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-77396 Public exploit

    PJSIP: Heap buffer overflow in the AVI parser

    PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity…

    pjsip pjproject asterisk asterisk Debian Ubuntu
  • Critical 9.8
    CVE-2026-84383 Public exploit

    libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items

    libheif is a HEIF and AVIF file format decoder and encoder. From 1.22.0 until 1.23.2, a crafted HEIF, HEIC, or AVIF item graph using nested iden and auxl references can make HeifPixelImage::transfer_channel_from_image_as() append duplicate Alpha planes with d…

    strukturag libheif libheif Debian
  • High 7.5
    CVE-2026-93687 Public exploit

    braces through 3.0.3 Stack Overflow via Deeply Nested Patterns

    braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an u…

    micromatch braces langfuse-3-worker renovate Debian Ubuntu Azure Linux Wolfi
  • High 8.1
    CVE-2026-93659 Public exploit

    Concrete CMS Community Store before 2.7.8 Stored XSS

    Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manag…

    concretecms-community-store community_store
  • High 7.2
    CVE-2026-87915 Public exploit

    Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter

    The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via values[Name] Parameter in all versions up to, and including, 1.24.0 due to insufficient in…

    Daniel Iser Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder Web / CMS
  • Critical 9.8
    CVE-2026-13684 Public exploit

    An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-690…

    Synology DiskStation Manager (DSM)
  • High 7.5
    CVE-2026-75157 Public exploit

    Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression)

    Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authenticated user who could read a Dag could therefore delete that Dag's queued asset events, silently suppressing asset-trigger…

    Apache Software Foundation Apache Airflow
  • High 7.1
    CVE-2026-93485 Public exploit Scanner template

    WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.

    Automattic WordPress wordpress wordpress Web / CMS Debian Ubuntu
  • Medium 6.1
    CVE-2026-79294 Public exploit

    Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arb…