Archive
September 2026
Vulnerabilities first published in this month (UTC), newest first.
15,012 results · Feed
-
Medium 4.3
Kiteworks Core content injection
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. T…
-
High 7.2
Kiteworks Core SQL Injection
Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative reporting feature could allow an authenticated administrator to read sensitive data from the underlying database and to affe…
-
High 7.2
Kiteworks Email Protection Gateway path traversal
Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to a path traversal weakness in an administrative import function allowed an authenticated administrator to write files to arbitrary locations on the server. This could potentially be lever…
-
High 8.7
pypdf: Possible large memory usage when parsing font data
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to process entries beyond th…
-
High 8.7
pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and retain oversized values …
-
High 8.7
pypdf: Possible long runtimes/large memory usage when parsing indirect objects
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and pypdf/generic/_base.py t…
-
High 8.7
pypdf: Possible large memory usage when retrieving Roman page labels
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an application retrieves document p…
-
Critical 9.2
piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env
piscina is a node.js worker pool implementation. Prior to 4.9.4, 5.3.2, and 6.0.0-rc.5, Piscina stores ThreadPool.options in src/index.ts as a plain object that inherits from Object.prototype. Applications with a separate prototype-pollution primitive can the…
-
Medium 6.5
Mako: Path traversal via drive-letter URI on Windows in TemplateLookup
Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, which uses ntpath. A UR…
-
Medium 5.3
Improperly Stored Credentials
Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user.
-
Medium 4.3
garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception
A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the component Mailto Header Handler. This manipulation of the argument to causes uncaught exception. The attack may be ini…
-
High 8.2
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjac…
-
Critical 9.2
In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlate…
-
High 7.8
ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path
ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install crafted plugins that write arbitrary file…
-
High 7.5
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override
OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or agent access can supply these variable…
-
Medium 5.4
OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present
OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses URL risk evaluation enforced by canvas.navigate. Attackers with gateway or agent access can issue canvas.present to make…
-
High 8.8
OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set
OpenClaw Windows Node before 2026.7.1 contains an incomplete validation vulnerability in system.execApprovals.set that accepts wildcard-executable rules and abusable system binaries like mshta, rundll32, and certutil. Remote callers can add broad allow rules …
-
Medium 6.5
OpenClaw Windows Node before 2026.7.1 Denial of Service
OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport that allows connected gateways to exhaust node memory. Attackers can send an unending sequence of WebSocket continuation …
-
High 8.8
OpenClaw Windows Node before 2026.7.1 Authorization Bypass
OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command substitutions. Connected gateways or agent…
-
Medium 6.5
OpenClaw Windows Node before 2026.7.1-3 Missing Authorization
OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consent prompts. Attackers…
-
Medium 5.3
Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body
A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes…
-
High 7.2
WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability
Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions.
-
High 7.1
WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.
-
High 8.8
WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions.
-
Medium 6.5
WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability
Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole: from n/a through 4.2.14.
-
High 7.1
WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.
-
Critical 9.8
WordPress Nested Pages plugin <= 3.3.2 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions.
-
High 7.1
WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.
-
High 7.1
WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.
-
High 8.8
WordPress Schema & Structured Data for WP & AMP plugin <= 1.66 - PHP Object Injection vulnerability
Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions.
-
Medium 6.5
WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.
-
High 7.2
WordPress Page Builder by SiteOrigin plugin <= 2.36.0 - PHP Object Injection vulnerability
Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions.
-
High 7.1
WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.
-
Medium 6.5
WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.
-
Low 1.2CVE-2026-103440 Public exploit
pagetriagelist discloses suppressed reviewer usernames
Exposure of sensitive information through data queries vulnerability in The Wikimedia Foundation MediaWiki PageTriage extension allows Information Elicitation. This issue affects MediaWiki PageTriage extension: 1.46, 1.45, and 1.43.
-
Low 0.3
Various rawParams() and escaped() updates to prevent XSS in Wikibase extension
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikbase extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikbase extension: 1.46, 1.45, and 1.43.
-
Low 0.3
Various rawParams() and escaped() updates to prevent XSS in Wikistories extension
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki Wikistories extension allows Cross-Site Scripting (XSS). This issue affects MediaWiki Wikistories extension: 1.46, 1.45, and 1.43.
-
High 8.7CVE-2026-55224 Scanner template
MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall
MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the …
-
High 8.7
Taskcluster: Unauthenticated remote code execution in `web-server` via GraphQL `filter` argument (sift `$where`)
Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0, Taskcluster is vulnerable to unauthenticated RCE on Taskcluster deployments with an anonymous role that exposes the Gra…
-
Medium 5.3
yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve fi…