September 2026

12 results · Clear filters · Feed

• High 8.8
  CVE-2026-86950 Exploited Public exploit EPSS 26%

  An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 and iPadOS…

  Apple macOS iOS and iPadOS macOS iOS
  Sep 28, 2026

  KEV Sep 29, 2026
• High 7.2
  CVE-2026-96656 Exploited Public exploit

  Plex Media Server arbitrary file write

  Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without s…

  Plex Media Server
  Sep 23, 2026

  KEV Oct 20, 2026
• High 8.1
  CVE-2026-87902 Exploited Public exploit Scanner template EPSS 96%

  An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.p…

  WordPress WordPress wordpress wordpress Web / CMS Debian Ubuntu
  Sep 22, 2026

  KEV Sep 25, 2026
• High 7.8
  CVE-2026-87886 Exploited

  Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin…

  Acronis Acronis Backup plugin for cPanel & WHM Acronis Backup extension for Plesk Acronis Backup plugin for DirectAdmin
  Sep 17, 2026

  KEV Sep 16, 2026
• High 8.8
  CVE-2026-58704 Exploited

  In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (p…

  Google Android Android
  Sep 15, 2026

  KEV Sep 16, 2026
• High 8.8
  CVE-2026-87491 Exploited Public exploit

  Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code i…

  Google Chrome chromium chromium Browsers Debian Wolfi
  Sep 9, 2026

  KEV Sep 9, 2026
• High 7.8
  CVE-2026-81963 Exploited Public exploit

  Windows Update Stack Elevation of Privilege Vulnerability

  Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

  Microsoft Windows Server 2025 Windows Server 2025 (Server Core installation) Windows 11 Version 24H2 Windows
  Sep 8, 2026

  KEV Sep 8, 2026
• High 7.8
  CVE-2026-85880 Exploited

  Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

  Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

  Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  Sep 8, 2026

  KEV Sep 8, 2026
• High 8.8
  CVE-2026-67277 Exploited

  Kernel memory disclosure and denial of service in MikroTik RouterOS btest service

  RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail f…

  MikroTik RouterOS Network devices
  Sep 5, 2026

  KEV Sep 10, 2026
• High 8.8
  CVE-2026-85046 Exploited Public exploit

  Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside…

  Google Chrome chromium chromium Browsers Debian Wolfi
  Sep 3, 2026

  KEV Sep 4, 2026
• High 8.6
  CVE-2026-63219 Exploited

  Unauthenticated file upload via missing authorization on formatter upload endpoint

  GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenti…

  geonetwork core-geonetwork
  Sep 3, 2026
• High 7.8
  CVE-2026-83549 Exploited Public exploit

  Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerab…

  SonicWall SMA1000 Network devices
  Sep 1, 2026

  KEV Sep 2, 2026