Archive
September 2026
Vulnerabilities first published in this month (UTC), newest first.
15,012 results · Feed
-
Low 2.7
In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to acc…
-
Low 3.3
In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials …
-
Medium 4.3
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
-
High 7.7
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notificati…
-
Medium 5.9
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters
-
High 7.7
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from th…
-
Medium 4.8
In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation
-
Low 2.7
In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host
-
High 7.6
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrit…
-
Medium 4.7
In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible
-
Medium 5.4
In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only …
-
Medium 5.3
In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings
-
High 7.8
In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted proje…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export
-
High 8.1
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
-
High 8.8
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers …
-
High 8.8
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the …
-
High 7.3
AdithyaYelloju Restaurant-Management-System Unauthenticated Action Script delete1.php mysqli_query sql injection
A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli_query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a ma…
-
Critical 10.0CVE-2026-102427 Public exploit
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in th…
-
Medium 5.3CVE-2026-94545 Public exploit
Satori-generated SVG has improper escaping
Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output. This can allow crafted values to be interpreted as SVG ma…
-
High 8.1
OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path
OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.
-
Medium 5.6
OpenSave before 2.4.0-beta.1 Authentication Bypass via Spoofed Relay Sender
OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers…
-
Medium 4.3
bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount
bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. A…
-
High 7.5
LightLLM through 1.2.0 Missing Authentication on RL Control Routes
LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disr…
-
Critical 9.8
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Visual-Only RPyC Service
LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __r…
-
Medium 5.8
LightLLM through 1.2.0 Server-Side Request Forgery via multimodal endpoints
LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to perform server-side request forgery. Attackers can supply arbitrary URLs to fetch internal resources, with vision model …
-
Critical —
Next.js: Remote Code Execution in next/og ImageResponse
## Impact The Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image ge…
-
Critical 10.0CVE-2026-76570 Public exploit
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables < 1.21.1
Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values…
-
Medium 6.5
Nest: Unbounded memory growth in the NestJS TCP microservice transport
## Summary A peer that can open a TCP connection to a NestJS microservice using the built-in TCP transport can make the server process allocate memory without limit, on either side of the connection, until the process is killed by the OS or by its container m…
-
High 7.4
@nestjs/platform-fastify: Path-scoped middleware bypass via absolute-form request targets
| Field | Value | | --- | --- | | Ecosystem | npm | | Package | `@nestjs/platform-fastify` | | Affected versions | `>= 12.0.0, < 12.0.2` and `< 11.2.4` | | Patched versions | `12.0.2` and `11.2.4` (upgrade to `12.0.3` / `11.2.5`) | ### Summary On the Fastify …
-
High 8.2
Astro: Malformed port in the Host header can crash the Node adapter
Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught…
-
Medium 6.3
Astro: Netlify Image CDN allowlist bypass enables SSRF
Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for Netlify Image CDN remote-image allowlists without anchoring them to the beginning of the URL. Because Netlify evaluate…
-
High 7.5
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash
-
High 7.5
AJA HELO Plus < 2.1.7 Hardcoded AES Passphrase for Diagnostics Export Bundle
AJA HELO Plus firmware before 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware. Attacker…
-
Medium 6.3
GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow
A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools/dash_client.c of the component DASH Client. This manipulation causes buffer overflow. The attack is possible to be car…
-
Medium 6.2
MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph
MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was persisted without any server-side validation through the galaxy add, edit, and sync/import capture endpoints. The stored va…
-
Medium 6.2
MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local…
-
Critical 9.8CVE-2026-18782 Public exploit
SQL Injection in Trex Digital Manufacturing's Trex MES
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.