Skip to content
OpenAdvisories

Archive

25 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /25 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-100382 Public exploit

    Unauthenticated remote code execution through wikitext in ExternalData

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection. This issue affects Mediawiki - ExternalData Extension: from * befo…

    Wikimedia Foundation Mediawiki - ExternalData Extension Web / CMS
  • Critical 9.1
    CVE-2026-42322 Public exploit

    Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

    Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uploaded logo content by MIME type but reuses the attacker-controlled extension from std_pgs_logo when constructing the sto…

    Piwigo Piwigo
  • Critical 9.8
    CVE-2026-14281 Public exploit

    Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter

    The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.8.6. This is due to missing permission enforcement on the publicly ac…

    101gen Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code Web / CMS
  • Critical 9.1
    CVE-2026-93399 Public exploit

    Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

    The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to …

    ladela Online Scheduling and Appointment Booking System – Bookly Web / CMS
  • Critical 9.1
    CVE-2026-89055 Public exploit

    Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter

    The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possi…

    ivole Customer Reviews for WooCommerce Web / CMS