Skip to content
OpenAdvisories

Archive

21 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /21 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-61628 Public exploit

    nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

    nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as anonymous (unauthenticated) and creates a user with full ReadWrite admin permissions. Because the handler uses a check-t…

    lucasdillmann nginx-ignition github.com/lucasdillmann/nginx-ignition Go
  • High 8.8
    CVE-2026-94129 Public exploit

    BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where

    A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability affects the function sub_1105C of the file BS_RVSIO64.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress results in write-what-where c…

    BioStar VALKYRIE AURORA
  • High 8.8
    CVE-2026-94128 Public exploit

    BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where

    A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.sys of the component IOCTL Handler. The manipulation of the argument AssociatedIrp leads to write-what-where condition. …

    BioStar VIVID LED DJ