Skip to content
OpenAdvisories

Archive

30 September 2026

Vulnerabilities first published on this day (UTC), newest first.

← August 2026 2026 / September /30 October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • High 7.4
    CVE-2026-103446 Public exploit

    WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

    Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.

    The Wikimedia Foundation MediaWiki WikiLambda extension Web / CMS
  • High 8.1
    CVE-2026-87004 Public exploit

    Tugtainer: OIDC id_token claims accepted without signature/audience/expiry verification

    Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, backend/modules/auth/providers/auth_oidc_provider.py decodes the id_token returned by the identity provider's token endpoi…

    Quenary tugtainer
  • High 7.6
    CVE-2026-19553 Public exploit

    SSLContext.wrap_bio() missing validation of server_hostname parameter

    ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be si…

    Python Software Foundation CPython tensorflow python3.4 Debian Ubuntu Azure Linux Alpine
  • High 7.2
    CVE-2026-103442 Public exploit

    MergeAccount PHP object injection via session-key substitution

    External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection. This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki CentralAuth extension Web / CMS
  • High 7.2
    CVE-2026-103441 Public exploit

    Unauthenticated arbitrary file deletion through Wikibase serialized entity parsing

    Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files. This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Wikibase extension Web / CMS
  • High 8.8
    CVE-2026-18783 Public exploit

    Missing Server-Side Authentication on REST API Endpoint in Trex Digital Manufacturing's Trex MES

    Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29.

    Trex Digital Smart Manufacturing Systems Trex MES
  • High 8.8
    CVE-2026-96838 Public exploit

    WordPress Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

    Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification <= 2.3.1 versions.

    YoOhw Studio Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification Web / CMS
  • High 7.8
    CVE-2026-62146 Public exploit

    Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket

    A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-si…

    Red Hat Red Hat OpenShift Container Platform 5 Red Hat OpenShift Container Platform 4.16 cri-o Azure Linux
  • High 7.2
    CVE-2026-97347 Public exploit

    Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header

    The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthentic…

    kazukiyanamoto Post Views Stats Counter Web / CMS