Skip to content
OpenAdvisories

Archive

19 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /19 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-93985

    OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE

    OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using co…

    Openpanel-dev openpanel
  • Critical 9.8
    CVE-2026-78030

    DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

    DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a …

    libdbi-perl libdbi-perl perl-DBI Debian Ubuntu Azure Linux
  • Critical 9.9
    CVE-2026-93742

    Totolink A3002MU formWsc command injection

    A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The ex…

    Toto Link A3002MU
  • Critical 9.8
    CVE-2026-86591

    Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route

    The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could lead to privilege escalation and a full s…

    Web / CMS
  • Critical 10.0
    CVE-2026-93741

    Totolink A3002MU formWlWds buffer overflow

    A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. Affected by this vulnerability is the function formWlWds of the file /boafrm/formWlWds. The manipulation of the argument submit-url results in buffer overflow. It is possible to launch…

    Toto Link A3002MU
  • Critical 9.1
    CVE-2026-89274 Public exploit

    WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

    The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because `WPRM_Metadata::sanitize_metadata()` recursively calls `do_shortcode()` on every scalar fiel…

    brechtvds WP Recipe Maker Web / CMS
  • Critical 9.1
    CVE-2026-92229 Public exploit

    Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

    The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that …

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • Critical 9.8
    CVE-2026-84434 Public exploit Scanner template

    Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field

    The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline and the file persistence pipeline, where …

    Gravity Forms Gravity Forms Web / CMS