Skip to content
OpenAdvisories

Archive

September 2026

Vulnerabilities first published in this month (UTC), newest first.

← August 2026 2026 / September October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30639
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Low 1.2
    CVE-2026-103585 Public exploit

    attacker-controlled javascript license URL via XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearch extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki MediaSearch extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki MediaSearch extension Web / CMS
  • Low 1.1
    CVE-2026-103584 Public exploit

    attacker-controlled javascript license URL via XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMetadata extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki CommonsMetadata extension: 1.46, 1.45, …

    The Wikimedia Foundation MediaWiki CommonsMetadata extension Web / CMS
  • Low 1.2
    CVE-2026-103440 Public exploit

    pagetriagelist discloses suppressed reviewer usernames

    Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki PageTriage extension Web / CMS
  • Low 1.1
    CVE-2026-103437 Public exploit

    ReadingLists imported metadata permits JavaScript URL XSS

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45.

    The Wikimedia Foundation MediaWiki ReadingLists extension Web / CMS
  • Low 1.2
    CVE-2026-103445 Public exploit

    Stored XSS through PageForms #autoedit redirect links

    Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Page_Forms extension allows Stored XSS. This issue affects MediaWiki Page_Forms extension: 1.46, 1.45, and 1.43.

    The Wikimedia Foundation MediaWiki Page_Forms extension Web / CMS
  • Low 2.3
    CVE-2026-96874 Public exploit

    Stored XSS in Cargo Drilldown tab names

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Low 2.7
    CVE-2026-93661 Public exploit

    Events Manager < 7.4.5 - Contributor+ Arbitrary Ticket Overwrite via IDOR

    The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to t…

    Web / CMS
  • Low 2.9
    CVE-2026-96872 Public exploit

    WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

    Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki -…

    The Wikimedia Foundation MediaWiki WikiLambda extension Web / CMS
  • Low 3.7
    CVE-2026-93528 Public exploit

    NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page

    The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key.

    Web / CMS
  • Low 2.4
    CVE-2026-0303 Public exploit

    Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File

    A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file.

    Palo Alto Networks Checkov by Prisma Cloud Network devices
  • Low 3.8
    CVE-2026-73318 Public exploit

    XenForo < 2.3.13 Missing Authorization via force-agreement Controller

    XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permi…

    XenForo XenForo
  • Low 2.7
    CVE-2026-73317 Public exploit

    XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

    XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job clas…

    XenForo XenForo