CVEs published September 5, 2026
131 CVEs were published on September 5, 2026: 18 critical, 38 high. 3 are now in CISA KEV.
- Published
- 131
- Critical
- 18
- High
- 38
- Medium
- 65
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 76
Most affected products
- xmlsoft libxml2
- 8
- The Tcpdump Group libpcap
- 7
- Mikrotik RouterOS
- 6
- WWBN AVideo
- 5
- Tenda CP3
- 4
- bookwyrm-social bookwyrm
- 3
- EmbedPress
- 3
- getgrav grav-plugin-api
- 3
- Accept Stripe Payments
- 2
- Bold Page Builder
- 2
Critical 18
- CVE-2026-86151Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injectionTenda CP3
- CVE-2026-86149Tenda CP3 NetCheckPing.cpp os command injectionTenda CP3
- CVE-2026-86148Tenda CP3 Kylin system.c SystemAsh os command injectionTenda CP3
- CVE-2026-86060SSH session privilege manipulation via a crafted username in Mikrotik RouterOSMikrotik RouterOS
- CVE-2026-67276SSH user impersonation possible in Mikrotik RouterOSMikrotik RouterOS
- CVE-2026-86190WWBN AVideo Broken Access Control via videoViewsInfo hash ParameterWWBN AVideo
- CVE-2026-86189WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.phpWWBN AVideo
- CVE-2026-86184Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Routelaradashboard
- CVE-2026-10196Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fieldsgetwpfunnels Mail Mint – Email Marketing, Newsletter, Email…
- CVE-2026-86124AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command ServerHKUDS AutoAgent
- CVE-2026-86123SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpointssqlchat
- CVE-2026-86121Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Controltrycua cua-computer-server
- CVE-2026-86119Webstudio through 0.296.0 SSRF via /cgi proxy routeswebstudio-is webstudio
- CVE-2026-86117Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matchingcoollabsio coolify
- CVE-2024-11080Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injectionpickplugins Post Grid
- CVE-2026-78362SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key AuthenticationSEO Flow by LupsOnline
- CVE-2026-83627Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Logwpmudev Hummingbird Performance – Cache & Page Speed Optimi…
- CVE-2026-13447MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgeryinspireui MStore API – Create Native Android & iOS Apps On…
High 38
- CVE-2026-67281Unauthenticated file read in Mikrotik RouterOSMikrotik RouterOS
- CVE-2026-67277Kernel memory disclosure and denial of service in MikroTik RouterOS btest serviceMikrotik RouterOS
- CVE-2026-86207Authentication bypass leads to unauthorised access to N-centralN-able N-central
- CVE-2026-6554infinte loop in libpcap before 1.10.7The Tcpdump Group libpcap
- CVE-2026-0799OOBR and OOBW in libpcap before 1.10.7The Tcpdump Group libpcap
- CVE-2026-86196Grav API Plugin before 1.0.20 Authentication Bypass via Host Headergetgrav grav-plugin-api
- CVE-2026-86195grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flaggetgrav grav-plugin-api
- CVE-2026-86193Grav API Plugin Authentication Bypass via Group-Inherited Supergetgrav grav-plugin-api
- CVE-2026-86192SiYuan before v3.8.2 Information Disclosure via Attribute-Viewsiyuan-note siyuan
- CVE-2026-86187WWBN AVideo Weak PRNG Password Generation via External LoginWWBN AVideo
- CVE-2026-86185Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification BypassBilibili Desktop
- CVE-2025-9049Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeoverscriptsbundle Nokri – Job Board WordPress Theme
- CVE-2026-86177Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Taskspterodactyl panel
- CVE-2026-86173MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawlermindsdb
- CVE-2026-86169Axolotl before 0.19.0 Remote Code Execution via Multipack Patchingaxolotl-ai-cloud axolotl
- CVE-2026-86116Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management APImetabase
- CVE-2026-86114Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpointsgetarcaneapp arcane
- CVE-2026-86113BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Recordsbookwyrm-social bookwyrm
- CVE-2026-86111BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statusesbookwyrm-social bookwyrm
- CVE-2026-81543Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege EscalationTyche Softwares Abandoned Cart Pro for WooCommerce
- CVE-2026-83625Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Headersupsysticcom Contact Form by Supsystic
- CVE-2026-15984QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field ParametersThemovation QuickCal
- CVE-2026-18406SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payloadbrainstormforce SureForms – Contact Form Builder, AI Forms,…
- CVE-2026-19887Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callbackuscnanbu Welcart e-Commerce
- CVE-2026-78438W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutatorboldgrid W3 Total Cache
- CVE-2026-19769Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Keykstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2026-16649Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field ValueGravity Forms
- CVE-2026-77830Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label PlaceholderSpam protection, Honeypot, Anti-Spam by CleanTalk
- CVE-2026-84935HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu SettingsHT Menu
- CVE-2026-84934JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task OverrideJCH Optimize
- CVE-2026-82304Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data HandlerMusic Store
- CVE-2026-81404IPGP Visitors Origin < 1.6 - Reflected XSSIPGP Visitors Origin
- CVE-2026-77826RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience ValidationRegistrationMagic
- CVE-2026-19858JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic PresetJetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-77263iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Contentiubenda | All-in-one Compliance for GDPR / CCPA Cookie Cons…
- CVE-2026-77233iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewriteiubenda | All-in-one Compliance for GDPR / CCPA Cookie Cons…
- CVE-2026-86145PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching worksPCRE2
- CVE-2026-86140In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.xmlsoft libxml2
Medium, low and unrated 75
- CVE-2026-86150Tenda CP3 hostapd hard-coded credentialsTenda CP3
- CVE-2026-67279SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOSMikrotik RouterOS
- CVE-2026-67278TLS server impersonation possible in Mikrotik RouterOSMikrotik RouterOS
- CVE-2026-86206Access control filter bypass allows unauthorised access to APIsN-able N-central
- CVE-2026-18238OOBR in rpcap client in libpcap before 1.10.7The Tcpdump Group libpcap
- CVE-2026-18313rpcapd memory leak in libpcap before 1.10.7The Tcpdump Group libpcap
- CVE-2026-6244division by zero in libpcap before 1.10.7The Tcpdump Group libpcap
- CVE-2026-31911abort() in libpcap before 1.10.7 on an invalid BPF opcodeThe Tcpdump Group libpcap
- CVE-2026-31912OOBR in libpcap before 1.10.7The Tcpdump Group libpcap
- CVE-2026-82752Ash string length constraints count graphemes, so a combining-mark string of any size passes max_lengthash-project ash
- CVE-2026-86197Grav before 2.0.20 Cross-Site Scripting via Assets Sandboxgetgrav grav · getgrav/grav
- CVE-2026-86194Grav Form Plugin before 9.1.22 Cross-Page Form Executiongetgrav grav-plugin-form
- CVE-2026-86191SiYuan before v3.8.2 Private Attribute View Key Enumerationsiyuan-note siyuan
- CVE-2026-86188AVideo YPTSocket Plugin Unauthenticated Cross-Site ScriptingWWBN AVideo
- CVE-2026-86186AVideo API Rate Limit Bypass via Bot User-Agent HeaderWWBN AVideo
- CVE-2025-15647CDT before 1.4.5 Out-of-Bounds Read via opposedVertexIndartem-ogre CDT
- CVE-2025-15614ugrep before 7.6.0 Heap Buffer Over-read via .Z decompressionGenivia ugrep
- CVE-2026-15550Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init HookSaturday Drive Ninja Forms - Save Progress
- CVE-2026-12843LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST EndpointStellarWP LearnDash LMS
- CVE-2026-86178Pixelfed through 0.12.9 Unauthorized Story Access via APIpixelfed
- CVE-2026-86176NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIsnetbox-community netbox
- CVE-2026-86175NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIsnetbox-community netbox
- CVE-2026-86174Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Boardmakeplane plane
- CVE-2026-86122Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Serverrowboatlabs rowboat
- CVE-2026-86120APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guardapitable
- CVE-2026-86118gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpointsentriz gonic
- CVE-2026-86115Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Pathsimstudioai sim
- CVE-2026-86112BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpointsbookwyrm-social bookwyrm
- CVE-2026-76573Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attributesc0ttkclark Pods – Custom Content Types and Fields
- CVE-2026-75018Custom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parametersoutlawgt Custom Contact Forms
- CVE-2026-85414Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attributefooplugins Gallery : FooGallery
- CVE-2026-75586Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameterunitecms Unlimited Elements For Elementor
- CVE-2026-4361Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' ParameterElegant Themes Divi
- CVE-2026-3853Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode ParameterElegant Themes Divi
- CVE-2026-14975WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' ParameterJoomUnited WP File Download
- CVE-2026-18843Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview ParameterThe Beaver Builder Team Beaver Builder Plugin
- CVE-2026-84937YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajaxVideo Player for YouTube
- CVE-2026-84936EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database BloatEmbedPress
- CVE-2026-84931Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme AttributeJoli Table Of Contents
- CVE-2026-84930CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via titleTag Block AttributeCatFolders Document Gallery & PDF Library
- CVE-2026-84927EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews ModificationEmbedPress
- CVE-2026-84926EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST RouteEmbedPress
- CVE-2026-84901Eventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing AuthorizationEventin
- CVE-2026-84899VikWidgetsLoader < 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class_suffixVikWidgetsLoader
- CVE-2026-84898Eventin < 4.1.21 - Contributor+ LFI via Event Layout MetaEventin
- CVE-2026-84896King Addons for Elementor < 51.1.77 - Contributor+ Stored XSS via Magazine Grid WidgetKing Addons for Elementor
- CVE-2026-84745The Events Calendar < 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST APIThe Events Calendar
- CVE-2026-84225Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDORKirki
- CVE-2026-84221Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field IDKirki
- CVE-2026-84022Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element AttributesBold Page Builder
- CVE-2026-84021Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_icon URLBold Page Builder
- CVE-2026-83544Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps AttributeGreenshift
- CVE-2026-83543Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST EndpointGreenshift
- CVE-2026-82846Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom FieldsMasteriyo LMS
- CVE-2026-81424Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDORAccept Stripe Payments
- CVE-2026-81423Accept Stripe Payments < 2.1.4 - Open Redirect via IPN HandlerAccept Stripe Payments
- CVE-2026-81348My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and SitemapMy Private Site
- CVE-2026-78150Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDORSmart Post
- CVE-2026-78149Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_password Disclosure via sp_handle_post_idSmart Post
- CVE-2026-19861JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification EmailsJetFormBuilder — Dynamic Blocks Form Builder
- CVE-2026-15247Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/DeletionSearch Atlas SEO
- CVE-2025-15694Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSSJoli Table Of Contents
- CVE-2025-15693JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path TraversalJCH Optimize
- CVE-2026-18404Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-boxquadlayers Social Chat – Click To Chat App Button
- CVE-2025-14945Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributesnetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2026-8625Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTMLdearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, P…
- CVE-2026-83628Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stagejfarthing84 Theme My Login
- CVE-2026-8623Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attributedearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, P…
- CVE-2026-86144In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags.xmlsoft libxml2
- CVE-2026-86143In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacksxmlsoft libxml2
- CVE-2026-86142In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.xmlsoft libxml2
- CVE-2026-86141xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculatexmlsoft libxml2
- CVE-2026-86139In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.xmlsoft libxml2
- CVE-2026-86138In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.xmlsoft libxml2
- CVE-2026-86137In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.xmlsoft libxml2