Skip to content
OpenAdvisories

Archive

28 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /28 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 7.4
    CVE-2026-102334 Public exploit

    Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

    Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently gu…

    NginxProxyManager nginx-proxy-manager
  • Critical 9.1
    CVE-2026-102268 Public exploit

    PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard

    PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mix…

    jpadilla pyjwt open-webui kserve-storage-controller Debian Ubuntu Azure Linux Wolfi PyPI
  • Critical 9.8
    CVE-2026-96760 Public exploit

    Authlib library contains a signature‑verification bypass vulnerability

    Authlib (v1.8.0 and below) contains a signature verification bypass vulnerability. The JsonWebSignature.deserialize_json() method accepts a JSON Serialization JWS object and returns the payload as successfully verified without checking for a signature and wit…

    authlib authlib open-webui python-authlib Debian Ubuntu Wolfi PyPI
  • High 8.1
    CVE-2026-93355 Public exploit

    LiteLLM Weak JWT Authentication via Email-Based User Lookup

    LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without ver…

    BerriAI litellm
  • High 8.8
    CVE-2026-86950 Exploited Public exploit EPSS 26%

    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS…

    Apple macOS iOS and iPadOS macOS iOS
    KEV Sep 29, 2026
  • Critical 9.3
    CVE-2026-101110 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function called protectInjectionWithoutQuote(),…

    ordasoft.com Book Library (Free) extension for Joomla Web / CMS
  • Critical 9.3
    CVE-2026-100752 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full …

    ordasoft.com Real Estate Manager (Free) extension for Joomla Web / CMS
  • Critical 9.3
    CVE-2026-101108 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

    Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate anonymous-reachable frontend entry points (category listing…

    ordasoft.com Vehicle Manager (Free) extension for Joomla Web / CMS
  • Critical 9.1
    CVE-2026-101894 Public exploit

    @xhmikosr/decompress: Path traversal via symlink chain

    The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a cra…

    XhmikosR kevva decompress decompress npm
  • Critical 9.6
    CVE-2026-88804 Public exploit Scanner template

    Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher

    An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6, 2.13 before 2.13.10, 2.12 before 2.12.14 and 2.11 befo…

    SUSE Rancher
  • High 8.8
    CVE-2026-86595 Public exploit

    SQLi in Iron Mountain's enVision

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This issue affects enVision: before 260655.

    Iron Mountain Archiving Services enVision
  • High 7.3
    CVE-2026-101053 Public exploit

    Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control

    A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The atta…

    Thinkware U3000
  • Critical 9.8
    CVE-2026-82384 Public exploit

    Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint

    Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor extension types that are deserialized during request parsing,…

    Apache Software Foundation Apache Roller
  • Medium 5.3
    CVE-2026-100903 Public exploit

    ООО НПО Ритм GEOritm REST API obj-groups missing authentication

    A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be …