Skip to content
OpenAdvisories

Archive

28 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /28 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-102268 Public exploit

    PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

    PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…

    jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  • Critical 9.8
    CVE-2026-96760 Public exploit

    Authlib library contains a signature‑verification bypass vulnerability

    Authlib (v1.8.0 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and wit…

    authlib authlib open-webui python-authlib Debian Ubuntu Wolfi PyPI
  • Critical 9.3
    CVE-2026-101110 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function called protectInjectionWithoutQuote(),…

    ordasoft.com Book Library (Free) extension for Joomla Web / CMS
  • Critical 9.3
    CVE-2026-100752 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full …

    ordasoft.com Real Estate Manager (Free) extension for Joomla Web / CMS
  • Critical 9.3
    CVE-2026-101108 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing…

    ordasoft.com Vehicle Manager (Free) extension for Joomla Web / CMS
  • Critical 9.1
    CVE-2026-101894 Public exploit

    @xhmikosr/decompress: Path traversal via symlink chain

    The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a cra…

    XhmikosR kevva decompress decompress npm
  • Critical 9.6
    CVE-2026-88804 Public exploit Scanner template

    Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher

    An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 befo…

    SUSE Rancher
  • Critical 9.8
    CVE-2026-82384 Public exploit

    Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

    Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing,…

    Apache Software Foundation Apache Roller