Skip to content
OpenAdvisories

Archive

24 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /24 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-13249 Public exploit

    Unauthenticated RCE Arbitrary File Upload Honeywell PD45 Industrial Printer version F10.19.010040

    An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attack…

    Honeywell PD45 Industrial Printer ICS / OT
  • Critical 10.0
    CVE-2026-61732 Public exploit

    Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

    Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring…

    BitterSecurity Decepticon decepticon-sdk decepticon-core PyPI
  • High 8.8
    CVE-2026-94609 Public exploit

    authentik: Privilege Escalation to Superuser via Group Hierarchy

    authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group withou…

    goauthentik authentik
  • Medium 5.5
    CVE-2026-96873 Public exploit

    Reflected XSS in CirrusSearch debug explain output

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Mediawiki - CirrusSearch extension allows Reflected XSS. This issue affects Mediawiki - CirrusSearch extension through 1.46.0.

    The Wikimedia Foundation Mediawiki - CirrusSearch Extension Web / CMS
  • Medium 5.5
    CVE-2026-92680 Public exploit

    Araxis Merge insufficiently protected credentials

    Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and un…

    Araxis Merge
  • High 8.6
    CVE-2026-96515 Public exploit

    Command Injection Vulnerability in Netlink ICT HG323RW Router

    This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by uploading and executing a …

    Netlink ICT Pvt Netlink ICT HG323RW Router
  • Critical 9.8
    CVE-2026-12227 Public exploit Scanner template

    Visual Composer Website Builder <= 45.16.0 - Unauthenticated Local File Inclusion via 'vcv-template' Parameter

    The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `vcv-template` parameter. This makes it possible for unauthenticated attackers to include and execute arbitrar…

    Visual Composer Visual Composer Website Builder Web / CMS
  • Low 2.7
    CVE-2026-93661 Public exploit

    Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR

    The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to t…

    Web / CMS
  • Critical 9.1
    CVE-2026-51994 Public exploit

    mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadat…