Skip to content
OpenAdvisories

Archive

20 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /20 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

48 results · Clear filters · Feed

  • Medium 4.7
    CVE-2026-93966

    aiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injection

    A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command of the file backend/ops/host_tasks.py of the component TASK_RUN_COMMAND. Such manipulation of the argument command lea…

    aiyiyi121 SxDevOps
  • Medium 6.6
    CVE-2026-93965

    aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection

    A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpoint_or_command causes command injection. …

    aiyiyi121 SxDevOps
  • Medium 5.3
    CVE-2026-93964

    NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication

    A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authent…

    NginxProxyManager nginx-proxy-manager
  • Medium 6.3
    CVE-2026-93963

    itsourcecode Leave Management System controller.php sql injection

    A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/controller.php. The manipulation of the argument DEPTID leads to sql injection. The attack can be initiated…

    itsourcecode Leave Management System
  • Medium 5.3
    CVE-2026-93961

    Dromara UJCMS UserController UserController.java usernameExist improper authorization

    A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation…

    dromara UJCMS
  • Medium 5.4
    CVE-2026-86552 Public exploit

    A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP

    SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife application authentication credentials, an attacker can directly complete registration using any arbitrary email address via …

    ZTE SmartLife
  • Medium 4.3
    CVE-2026-93960

    Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication

    A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authenticatio…

  • Medium 4.3
    CVE-2026-93957

    olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison

    A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitatio…

    olivier-ls PHP-FTS