Skip to content
OpenAdvisories

Archive

23 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /23 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.8
    CVE-2026-86583 Public exploit

    Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields

    The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cell…

    carazo Import and export users and customers Web / CMS
  • High 8.1
    CVE-2026-19125 Public exploit

    EthPress <= 2.3.5 - Unauthenticated Authentication Bypass

    The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification …

    lynn999 EthPress – Web3 Login Web / CMS
  • High 7.8
    CVE-2026-96889 Public exploit

    Librsvg: use-after-free when xml includes have duplicated entities

    A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that …

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux crates.io
  • High 8.8
    CVE-2026-93349 Public exploit

    Frictionless OS Command Injection via explore Console Command

    Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attacke…

    frictionlessdata frictionless-py
  • High 7.2
    CVE-2026-96656 Exploited Public exploit

    Plex Media Server arbitrary file write

    Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without s…

    Plex Media Server
    KEV Oct 20, 2026
  • High 7.8
    CVE-2026-96512 Public exploit

    Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

    A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps that omit the trailing 'Z' timezone indicator, the time evaluation relies on the TZ environment variable inherited from the calling user. Bec…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 10 Linux Debian Ubuntu Azure Linux Alpine