CVEs published September 12, 2026
94 CVEs were published on September 12, 2026: 13 critical, 26 high. 1 is now in CISA KEV.
- Published
- 94
- Critical
- 13
- High
- 26
- Medium
- 52
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 42
Most affected products
- WWBN AVideo
- 17
- BEAR
- 3
- FlowiseAI Flowise
- 3
- Masteriyo LMS
- 3
- Rox Appointment Booking
- 3
- Xuxueli xxl-job
- 3
- Booking for Appointments and Events Calendar
- 2
- freeciv
- 2
- GitLab
- 2
- msgpack-java
- 2
Critical 13
- CVE-2026-90647ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in thKalkitech ASE2000 V2 Communication Test Set
- CVE-2026-90558sngrep through 1.8.4 Stack Buffer Overflow via SIP Headersirontec sngrep
- CVE-2026-78159The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocationstellarwp The Events Calendar
- CVE-2026-78006The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Executionstellarwp The Events Calendar
- CVE-2026-85681WP Component <= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option UpdateWP Component
- CVE-2026-84171WP Images Upload on Piclect <= 1.0 - Unauthenticated Arbitrary File UploadWP images upload on piclect
- CVE-2026-82845Masteriyo LMS < 3.4.1 - Subscriber+ PHP Object InjectionMasteriyo LMS
- CVE-2026-81402DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File UploadDS Ad Rotator
- CVE-2026-77006WebTotem Backups < 1.1.0 - Subscriber+ Arbitrary File Deletion via Path TraversalWebTotem Backups
- CVE-2026-77005Code Monkeys Proposals <= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path TraversalCODE MONKEYS PROPOSALS
- CVE-2026-75800Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponseFrontegg SAML SSO
- CVE-2026-85706Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabGitLab
- CVE-2026-87719Deserialization of Untrusted Data in GitLabGitLab
High 26
- CVE-2026-90651Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default.Socket Firewall
- CVE-2026-90648wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table fliWebAssembly wabt
- CVE-2026-90616In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated Flatpak
- CVE-2026-90560zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompressluben zstd-jni
- CVE-2026-90559snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompressxerial snappy-java
- CVE-2026-90556Freeciv before 3.2.6 Heap Buffer Overflow via worklist_loadfreeciv
- CVE-2026-15451MemberPress Corporate Accounts <= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account CreationMemberPress Corporate Accounts
- CVE-2026-90555vLLM before 0.28.0 Denial of Service via Audio Headervllm-project vLLM
- CVE-2026-90553vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processorvllm-project vLLM · vllm
- CVE-2026-90537WWBN AVideo Scheduler sendEmail Missing Authorization via TokenWWBN AVideo
- CVE-2026-90474MCPHub before 1.0.32 OAuth 2.0 Authentication Bypasssamanhappy mcphub
- CVE-2026-78175Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Executionthemeum Tutor LMS – eLearning and online course solution
- CVE-2026-85200GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusionninjew GEO my WP
- CVE-2026-16482rtMedia for WordPress, BuddyPress and bbPress <= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameterrtcamp rtMedia for WordPress, BuddyPress and bbPress
- CVE-2026-87888YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST RouteYayPricing
- CVE-2026-87842Zonify < 1.0.5 - Unauthenticated Account Login Token DisclosureZonify
- CVE-2026-87759Add User Autocomplete < 1.2 - Subscriber+ Privilege EscalationAdd User Autocomplete
- CVE-2026-84099IDB Ecommerce (wpStoreCart 5) <= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.phpwpstorecart
- CVE-2026-84047Album Cover Finder <= 0.7.0 - Unauthenticated SQLi via and_actionAlbum Cover Finder
- CVE-2026-81742BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget ManipulationBE REST Endpoints
- CVE-2026-81429Export & Import WPBakery Page Builder <= 1.0.2 - Stored XSS via CSRFExport & Import WPBakery Page Builder
- CVE-2026-81090Gpx2Graphics <= 0.3 - Arbitrary File Upload via CSRFGpx2Graphics
- CVE-2026-80494Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File DownloadYogeta WP Cloud
- CVE-2026-80491SAMO Forms <= 1.0.0 - Unauthenticated SQLiSAMO Forms
- CVE-2026-77752Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege EscalationTemporary Login Without Password
- CVE-2026-77705Amelia < 2.4.10 - Amelia Manager+ WordPress Account TakeoverBooking for Appointments and Events Calendar
Medium, low and unrated 55
- CVE-2026-90489Xuxueli xxl-job insert cross site scriptingXuxueli xxl-job
- CVE-2026-90488Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injectionXuxueli xxl-job
- CVE-2026-90487Xuxueli xxl-job JobGroupController.java privileges managementXuxueli xxl-job
- CVE-2026-90486openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgeryopenstatusHQ openstatus
- CVE-2026-79300SEP sesam before 5.2.0.24 mishandles User Authorization with MFA.SEP sesam
- CVE-2026-90485IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub_11838 null pointer dereferenceIOBit Uninstaller
- CVE-2026-90557Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegamefreeciv
- CVE-2026-10148Booking for Appointments and Events Calendar – Amelia <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load_manually' Parametermelograno Booking for Appointments and Events Calendar – Am…
- CVE-2026-90554vLLM before 0.28.0 Denial of Service via audio extractionvllm-project vLLM
- CVE-2026-90552WWBN AVideo Missing Authorization via Playlists_schedules list.json.phpWWBN AVideo
- CVE-2026-90551WWBN AVideo Missing Authorization via video_from_program APIWWBN AVideo
- CVE-2026-90550WWBN AVideo Missing Authorization via mediaSession.json.phpWWBN AVideo
- CVE-2026-90549WWBN AVideo Missing Authorization via videosAndroid.json.php EndpointWWBN AVideo
- CVE-2026-90548WWBN AVideo Missing Authorization in ImageGallery list.json.phpWWBN AVideo
- CVE-2026-90547WWBN AVideo Missing Authorization via getBookmarks.json.phpWWBN AVideo
- CVE-2026-90546WWBN AVideo Missing Authorization via like.json.phpWWBN AVideo
- CVE-2026-90545WWBN AVideo Missing Authorization via commentAddNew.json.phpWWBN AVideo
- CVE-2026-90544WWBN AVideo Missing Authorization via videoAddViewCount.json.phpWWBN AVideo
- CVE-2026-90543WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.phpWWBN AVideo
- CVE-2026-90542WWBN AVideo Missing Authorization via remindMe.json.phpWWBN AVideo
- CVE-2026-90541WWBN AVideo Unauthenticated Information Disclosure via menus.json.phpWWBN AVideo
- CVE-2026-90540WWBN AVideo Missing Authorization via playListAddVideo.json.phpWWBN AVideo
- CVE-2026-90539WWBN AVideo Missing Authentication via menuItems.json.phpWWBN AVideo
- CVE-2026-90538WWBN AVideo Missing Authorization via playlistsFromUser.json.phpWWBN AVideo
- CVE-2026-90536WWBN AVideo Missing Authorization via adsInfo API EndpointWWBN AVideo
- CVE-2026-90535Flowise before 3.1.4 Denial of Service via text-to-speech/abortFlowiseAI Flowise
- CVE-2026-90534Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-methodFlowiseAI Flowise
- CVE-2026-90533Flowise before 3.1.4 Broken Access Control via organizationuserFlowiseAI Flowise
- CVE-2026-90473msgpack-java through 0.9.12 Integer Overflow via MAP32msgpack-java
- CVE-2026-90472msgpack-java through 0.9.12 Stack Overflow via Nested Arraysmsgpack-java
- CVE-2026-89172Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithmsMicrochip AN1044 · Microchip AN953 +1
- CVE-2026-11355DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actionsdesignthemes DT LMS – elearning, WordPress LMS Plugin
- CVE-2026-77161Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Nameegoi Smart Marketing SMS and Newsletters Forms
- CVE-2026-85198MPG <= 4.2.1 - Unauthenticated SQL Injection via URL Paththemeisle MPG – Multiple Page Generator, Bulk Landing Pages…
- CVE-2026-17585Royal Addons for Elementor <= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta_query LIKE Oracle in 'wpr_keyword' Parameterwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2026-87919Product XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via ShortcodeProduct XML Feed Manager for WooCommerce
- CVE-2026-87918WPBot < 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX ActionsWPBot
- CVE-2026-87916WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII DisclosureWPBot
- CVE-2026-87894Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDORRox Appointment Booking
- CVE-2026-87892Rox Appointment Booking < 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction BypassRox Appointment Booking
- CVE-2026-87891Rox Appointment Booking < 1.2.0 - Unauthenticated Holiday Schedule Modification via REST APIRox Appointment Booking
- CVE-2026-87797Client Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_noteSprout Invoices
- CVE-2026-86790WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box ShortcodeWP Highlight Box
- CVE-2026-84025BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDORBEAR
- CVE-2026-84024BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Meta Field Configuration Update via CSRFBEAR
- CVE-2026-84023BEAR - Bulk Editor and Products Manager Professional for WooCommerce < 1.2.2 - Taxonomy Term Modification via CSRFBEAR
- CVE-2026-82851Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDORMasteriyo LMS
- CVE-2026-82847Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course HighlightsMasteriyo LMS
- CVE-2026-78152SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person SchemaSureRank SEO
- CVE-2026-77753Temporary Login Without Password < 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application PasswordsTemporary Login Without Password
- CVE-2026-77689Amelia Pro 9.0 - 9.8 - Unauthenticated Payment BypassBooking for Appointments and Events Calendar
- CVE-2026-83532Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode AttributesCustom Menu Wizard Widget
- CVE-2026-90467aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addressescole aiosmtplib
- CVE-2026-89268QloApps through 1.7.0 Reflected XSS via List Filter ParametersWebkul QloApps
- CVE-2026-89267starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypassjowilf starlette-admin