Skip to content
OpenAdvisories

Archive

22 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /22 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-89282 Public exploit

    CVE-2026-89282

    The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability through its default install directory on C:\, which inherits write access for Authenticated Users.

    Apache HTTP Server Project Apache Lounge Windows Windows
  • High 8.6
    CVE-2026-77262 Public exploit

    MCP Atlassian: Path Traversal / Arbitrary File Read in confluence_upload_attachment MCP tool (incomplete fix of CVE-2026-27825)

    MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, confluence_upload_attachment accepts an attacker-controlled file_path and does not apply the path restriction added for the earlier download …

    sooperset mcp-atlassian mcp-atlassian PyPI
  • High 8.4
    CVE-2026-83603 Public exploit

    Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE

    Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/collectors/utils/ndsudo.c accepts a caller-controlled --socket_path from the low-privileged netdata service account. The …

    netdata netdata netdata netdata Debian Ubuntu
  • High 8.1
    CVE-2026-87902 Exploited Public exploit Scanner template EPSS 96%

    An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.p…

    WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
    KEV Sep 25, 2026
  • Critical 9.8
    CVE-2026-94127 Exploited Public exploit EPSS 27%

    BIG-IP APM OAuth vulnerability

    When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Dep…

    F5 BIG-IP Network devices
    KEV Sep 22, 2026
  • Critical 9.8
    CVE-2026-95675 Public exploit

    D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface

    D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without v…

    D-Link DAP-1360 Network devices
  • Critical 9.8
    CVE-2026-93616 Exploited Public exploit Scanner template EPSS 92%

    Directory Traversal and File upload allows execution of arbitrary script on the Management Server

    A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

    Check Point Quantum Security Management Network devices
    KEV Sep 22, 2026
  • Medium 6.9
    CVE-2026-25262 Public exploit

    Write-what-where Condition in Primary Bootloader

    Memory corruption while processing a crafted ELF file in the Primary Bootloader.

    Qualcomm Snapdragon
  • Critical 9.8
    CVE-2026-19658 Public exploit

    Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter

    The Give Tributes plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.3.1 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain i…

    Liquid Web Give Tributes Web / CMS
  • Critical 9.8
    CVE-2026-13355 Public exploit

    Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter

    The Meta Box AIO plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 3.11.0. This is due to a chained flaw: the populate_via_query_string() function in the mb-frontend-submission component unconditiona…

    Meta Box Meta Box Frontend Submission Web / CMS