Skip to content
OpenAdvisories

Archive

20 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /20 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-94097

    Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection

    A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remot…

    Netcore NBR200V2
  • Critical 9.9
    CVE-2026-94096

    Netcore NBR200V2 LAN IP Configuration network_tools command injection

    A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command in…

    Netcore NBR200V2
  • Critical 9.9
    CVE-2026-94095 Public exploit

    Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection

    A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to c…

    Netcore NBR200V2
  • Critical 10.0
    CVE-2026-94089

    D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow

    A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffe…

    D-Link DIR-868L Network devices
  • Critical 9.4
    CVE-2026-88857

    Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

    Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filena…

    ordasoft.com OrdaSoft Joomla Gallery free extension for Joomla OrdaSoft Joomla Gallery extension for Joomla Web / CMS
  • Critical 9.3
    CVE-2026-88854 Public exploit

    Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

    Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with $input->getVar(), whic…

    ordasoft.com OrdaSoft Joomla Gallery extension for Joomla OrdaSoft Joomla Gallery free extension for Joomla Web / CMS
  • Critical 9.4
    CVE-2026-88856

    Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

    Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions updateOSGallery(), reached via task=update_osgallery, read a JSON request body and called the value of a…

    ordasoft.com OrdaSoft Joomla Gallery extension for Joomla OrdaSoft Joomla Gallery free extension for Joomla Web / CMS
  • Critical 9.8
    CVE-2026-90817 Public exploit Scanner template

    An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import proc…

    Vanderbilt University REDCap
  • Critical 10.0
    CVE-2026-94003

    Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow

    A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be init…

    Comfast CF-N1-S
  • Critical 9.4
    CVE-2026-94084

    Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.…

    OISF suricata suricata suricata Debian Ubuntu
  • Critical 9.4
    CVE-2026-94083

    Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 stat…

    OISF suricata suricata suricata Debian Ubuntu
  • Critical 9.1
    CVE-2026-93958 Public exploit

    D-Link R95 DHMAPI ssi system os command injection

    A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotel…

    D-Link R95 Network devices