Skip to content
OpenAdvisories

Archive

30 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /30 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-55494 Public exploit

    Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset

    Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated access to Docker management APIs when AGENT_SECRET is not configured. The Agent uses request signatures to protect its …

    Quenary tugtainer
  • Critical 9.4
    CVE-2026-102489 Exploited Public exploit EPSS 50%

    Undisclosed RCE in Zammad v6.3 and higher

    Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in version 7.0.0 to version 7.1.2, but not exploitable due to changes in the underlying framework.

    zammad zammad
    KEV Oct 2, 2026
  • Critical 9.2
    CVE-2026-19445 Public exploit

    Use-after-free of a server-side SSLContext when sni_callback switches contexts

    A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original …

    Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Alpine
  • Critical 10.0
    CVE-2026-102427 Public exploit

    Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16

    Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in th…

    ordasoft.com OrdaSoft Joomla CCK Web / CMS
  • Critical 10.0
    CVE-2026-76570 Public exploit

    Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1

    Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values…

    joomcode.com JCTables extension for Joomla Web / CMS
  • Critical 9.8
    CVE-2026-18782 Public exploit

    SQL Injection in Trex Digital Manufacturing's Trex MES

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.

    Trex Digital Smart Manufacturing Systems Trex MES
  • Critical 9.4
    CVE-2026-93903 Public exploit

    LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case"…

    litespeedtech LiteSpeed Web Server
  • Critical 9.8
    CVE-2026-76504 Exploited Public exploit EPSS 39%

    Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability

    A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling …

    Cisco Cisco Catalyst SD-WAN Manager Network devices
    KEV Sep 30, 2026
  • Critical 10.0
    CVE-2026-96349 Public exploit

    WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability

    Unauthenticated Remote Code Execution (RCE) in SiteSkite <= 2.1.8 versions.

    SiteSkite SiteSkite
  • Critical 9.0
    CVE-2026-103056 Public exploit

    AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR

    AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated us…

    beenuar AiSOC