Skip to content
OpenAdvisories

Archive

28 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /28 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.4
    CVE-2026-102334 Public exploit

    Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

    Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently gu…

    NginxProxyManager nginx-proxy-manager
  • High 8.1
    CVE-2026-93355 Public exploit

    LiteLLM Weak JWT Authentication via Email-Based User Lookup

    LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based fallback lookup in the JWT authentication flow without ver…

    BerriAI litellm
  • High 8.8
    CVE-2026-86950 Exploited Public exploit EPSS 26%

    An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS…

    Apple macOS iOS and iPadOS macOS iOS
    KEV Sep 29, 2026
  • High 8.8
    CVE-2026-86595 Public exploit

    SQLi in Iron Mountain's enVision

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This issue affects enVision: before 260655.

    Iron Mountain Archiving Services enVision
  • High 7.3
    CVE-2026-101053 Public exploit

    Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control

    A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The atta…

    Thinkware U3000