Skip to content
OpenAdvisories

Archive

23 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /23 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-96652 Exploited Public exploit Scanner template EPSS 12%

    Plex Media Server SSRF

    Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

    Plex Media Server
    KEV Oct 20, 2026
  • Medium 5.3
    CVE-2026-73858 Public exploit

    Solspace Freeform: Limited Twig template injection via submitted field values

    Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated at…

    solspace craft-freeform solspace/craft-freeform Packagist
  • Medium 5.4
    CVE-2026-80444 Public exploit

    Unauthenticated Open Redirect Vulnerability in Abis Technology's AVESİS

    URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This issue affects AVESİS: from 202608201331 before 202608240351.

    Abis Technology Ltd. Co. AVESİS
  • Medium 6.8
    CVE-2026-88997 Public exploit

    JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key

    The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitra…

    Web / CMS