Skip to content
OpenAdvisories

Archive

September 2026

Vulnerabilities first published in this month (UTC), newest first.

← August 2026 2026 / September October 2026 →
  1. 1480
  2. 2326
  3. 3349
  4. 4564
  5. 5133
  6. 692
  7. 7254
  8. 81568
  9. 9660
  10. 10387
  11. 11700
  12. 1295
  13. 13133
  14. 14782
  15. 151427
  16. 16873
  17. 171035
  18. 18512
  19. 19104
  20. 20107
  21. 21289
  22. 22457
  23. 23475
  24. 24556
  25. 25683
  26. 26245
  27. 27152
  28. 28316
  29. 29616
  30. 30642
All Critical High Medium Low Exploited only Public exploit

5,174 results · Clear filters · Feed

  • Medium 6.4
    CVE-2026-84721

    Automation-controller: automation-controller: email notification backend allows ssrf via user-controlled smtp host/port (internal port-scan oracle, smtp password exfil)

    A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without va…

    Red Hat Red Hat Ansible Automation Platform 2 Red Hat Ansible Automation Platform 2.7
  • Medium 6.5
    CVE-2026-84720

    Automation-controller: automation-controller: workflowjobnode.ancestor_artifacts lacks prevent_search, exposing no_log set_stats artifacts via orm-traversal count-oracle

    A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is the…

    Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.7
  • Medium 4.3
    CVE-2026-84718

    Automation-controller: automation-controller: client ip spoofing in audit/access logs via unrestricted x-forwarded-for trust

    A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted…

    Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.7
  • Medium 5.3
    CVE-2026-84717

    Automation-controller: automation-controller: unauthenticated 200-vs-403 oracle in bitbucket data center webhook receiver enumerates webhook-enabled job templates

    A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping events after it has already looked up the target template, causing the…

    Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.7
  • Medium 6.6
    CVE-2026-84716

    Automation-controller: automation-controller: instance install_bundle issues 10-year, non-revocable receptor mesh-ca certificates for caller-chosen (and case-variant impersonating) hostnames

    A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop node's install bundle, the controller signs an X.509 certificate with the receptor mesh certificate authority in which the C…

    Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.7
  • Medium 6.5
    CVE-2026-84713

    Automation-controller: automation-controller: notification.recipients/subject/error lack prevent_search, allowing zero-privilege cross-tenant recovery of notification recipient secrets via filter oracle

    A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on …

    Red Hat Red Hat Ansible Automation Platform 2 Red Hat Ansible Automation Platform 2.7
  • Medium 5.3
    CVE-2026-84712

    Automation-controller: automation-controller: unauthenticated /api/v2/ping/ discloses automation-mesh instance topology and instance-group membership

    A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory (node hostna…

    Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.7
  • Medium 5.3
    CVE-2026-93421

    Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

    Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/serv…

    mesop-dev mesop mesop PyPI
  • Medium 5.3
    CVE-2026-90900

    Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0

    Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissio…

    joomshaper.com Easy Store extension for Joomla Web / CMS
  • Medium 5.6
    CVE-2026-96548

    sfturing hosp_order jdbc.properties hard-coded credentials

    A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the a…

    sfturing hosp_order
  • Medium 4.4
    CVE-2026-96545

    Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader

    An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. T…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • Medium 4.1
    CVE-2026-71462

    Automation-controller: automation-controller-container: automation-controller: custom_venv_path setting provides filesystem path-existence oracle on control pod

    StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of arbitrary absolute paths on the controller-web pod. Tenant superuser can confirm /etc/tower/SECRET_KEY, k8s service-accou…

    Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.7
  • Medium 4.3
    CVE-2026-71461

    Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

    HostList.list() catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user triggers Django FieldError (leaking complete Host model relation graph including internal reverse accessors) or PostgreSQL DataError (leaking raw datab…

    Red Hat Red Hat Ansible Automation Platform 2 Red Hat Ansible Automation Platform 2.7
  • Medium 4.3
    CVE-2026-71460

    Automation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/

    /api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance counts) returned to any authenticated user. The superuser/auditor gate only covers project_base_dir/project_local_paths/…

    Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.7
  • Medium 6.9
    CVE-2026-92692

    Sulu: JCR-SQL2 injection via `categories` query parameter (unauthenticated)

    Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that conc…

    sulu sulu symfony sulu/sulu Ubuntu Packagist
  • Medium 6.5
    CVE-2026-95602

    WordPress YITH WooCommerce Request A Quote plugin < 4.46.1 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.

    Yith YITH WooCommerce Request A Quote Web / CMS
  • Medium 5.3
    CVE-2026-95600

    WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions.

    TrustedLogin TrustedLogin Connector
  • Medium 5.3
    CVE-2026-95592

    WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.

    Oleh RadiusTheme Team
  • Medium 6.5
    CVE-2026-95586

    WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions.

    themefic Ultimate Addons for Contact Form 7
  • Medium 6.5
    CVE-2026-95530

    WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions.

    PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager
  • Medium 6.5
    CVE-2026-95527

    WordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.

    Conekta Group Conekta Payment Gateway
  • Medium 6.5
    CVE-2026-95525

    WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability

    Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions.

    wedevs WP User Frontend
  • Medium 5.3
    CVE-2026-95524

    WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

    wedevs WP User Frontend
  • Medium 6.5
    CVE-2026-95523

    WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

    Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions.

    wedevs WP User Frontend
  • Medium 5.3
    CVE-2026-95514

    WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.

    netgsm Netgsm
  • Medium 6.5
    CVE-2026-94680

    WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

    RadiusTheme The Post Grid
  • Medium 6.5
    CVE-2026-94682

    WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions.

    SecondLineThemes Podcast Importer SecondLine
  • Medium 5.4
    CVE-2026-94679

    WordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

    WP ManageNinja Fluent Support
  • Medium 6.5
    CVE-2026-94671

    WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.

    RadiusTheme The Post Grid
  • Medium 6.5
    CVE-2026-94500

    WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.

    roxnor ElementsKit Elementor addons Lite
  • Medium 6.5
    CVE-2026-94498

    WordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

    appmysite AppMySite
  • Medium 6.5
    CVE-2026-94461

    WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

    Metaphor Creations Ditty
  • Medium 4.8
    CVE-2026-94457

    WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability

    Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.

    webfactory Captcha Code
  • Medium 6.5
    CVE-2026-94391

    WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.

    Rustaurius Ultimate FAQ
  • Medium 6.5
    CVE-2026-94168

    WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

    leap13 Premium Addons for Elementor
  • Medium 6.5
    CVE-2026-94118

    WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability

    Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.

    leap13 Premium Blocks – Gutenberg Blocks for WordPress Web / CMS
  • Medium 5.3
    CVE-2026-94080

    WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.

    WebWizards MarketKing
  • Medium 5.3
    CVE-2026-94079

    WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.

    WP User Manager WP User Manager
  • Medium 6.5
    CVE-2026-93772

    WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

    Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.

    Tomdever wpForo Forum
  • Medium 5.3
    CVE-2026-93623

    WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR) vulnerability

    Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.

    Jordy Meow AI Engine