Archive
September 2026
Vulnerabilities first published in this month (UTC), newest first.
139 results · Clear filters · Feed
-
High 7.9CVE-2026-85649 Public exploit
(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the …
-
High 7.5CVE-2026-85612 Public exploit
OpenPanel before 2.3.0 SSRF via favicon and og endpoints
OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation. Attackers can force the API to fetch arbitrar…
-
High 7.1CVE-2022-35499 Public exploit
In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injec…
-
High 8.1CVE-2026-78839 Public exploit
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploadin…
-
High 8.3CVE-2026-85048 Public exploit
Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the…
-
High 7.5CVE-2026-85045 Public exploit
Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside…
KEV Sep 4, 2026 -
High 8.8CVE-2026-71963 Public exploit
Hermes Agent 0.18.2 - 0.21.0 RCE via git core.fsmonitor Config Injection
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an at…
-
High 7.7CVE-2026-85168 Public exploit
n8n before 1.123.73 Remote Code Execution via Git Node
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-d…
-
High 8.8CVE-2026-84770 Public exploit
WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.
-
High 8.1CVE-2026-19219 Public exploit
DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor file browser may allow an attacker who has obtained certain application encryption key material to alter the folders t…
-
High 8.1CVE-2026-80467 Public exploit
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticate…
-
High 7.8
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…
KEV Sep 2, 2026 -
High 8.8CVE-2026-71981 Public exploit
Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter
Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can p…
-
High 7.7CVE-2026-84361 Public exploit
Composer: Perforce source URL permits P4PORT `rsh:` command execution
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4…
-
High 8.3CVE-2026-8712 Public exploit
Wyoming < 1.10.2 SSRF via uri Query Parameter
Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to force outbound connections to arbitrary targets by supplying a malicious `uri` query parameter to the HTTP API. Attackers c…
-
High 7.5CVE-2026-19952 Public exploit
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated atta…
-
High 8.7CVE-2026-65643 Public exploit
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
-
High 7.5CVE-2026-51788 Public exploit
An issue in cleverange_auth v.0.1.10 allows a remote attacker to cause a denial of service via the account_verification…