# CVEs published 2026-09-12

94 CVEs were published on September 12, 2026: 13 critical, 26 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-90651](https://cve.now/CVE-2026-90651.md): Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. (CVSS 8.1, Socket Firewall)
- [CVE-2026-90489](https://cve.now/CVE-2026-90489.md): Xuxueli xxl-job insert cross site scripting (CVSS 5.1, Xuxueli xxl-job)
- [CVE-2026-90648](https://cve.now/CVE-2026-90648.md): wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table fli (CVSS 7.1, WebAssembly wabt)
- [CVE-2026-90488](https://cve.now/CVE-2026-90488.md): Xuxueli xxl-job GlueFactory.java GroovyClassLoader.parseClass code injection (CVSS 5.3, Xuxueli xxl-job)
- [CVE-2026-90487](https://cve.now/CVE-2026-90487.md): Xuxueli xxl-job JobGroupController.java privileges management (CVSS 5.3, Xuxueli xxl-job)
- [CVE-2026-90486](https://cve.now/CVE-2026-90486.md): openstatusHQ openstatus resolve-custom-domain-rewrite.ts server-side request forgery (CVSS 5.3, openstatusHQ openstatus)
- [CVE-2026-90647](https://cve.now/CVE-2026-90647.md): ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in th (CVSS 9.1, Kalkitech ASE2000 V2 Communication Test Set)
- [CVE-2026-79300](https://cve.now/CVE-2026-79300.md): SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. (CVSS 3.5, SEP sesam)
- [CVE-2026-90485](https://cve.now/CVE-2026-90485.md): IOBit Uninstaller IOCTL Dispatch IURegistryFilter.sys sub\_11838 null pointer dereference (CVSS 6.8, IOBit Uninstaller)
- [CVE-2026-90616](https://cve.now/CVE-2026-90616.md): In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated (CVSS 7.4, Flatpak)
- [CVE-2026-90560](https://cve.now/CVE-2026-90560.md): zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictDecompress (CVSS 8.8, luben zstd-jni)
- [CVE-2026-90559](https://cve.now/CVE-2026-90559.md): snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress (CVSS 8.7, xerial snappy-java)
- [CVE-2026-90558](https://cve.now/CVE-2026-90558.md): sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers (CVSS 9.3, irontec sngrep)
- [CVE-2026-90557](https://cve.now/CVE-2026-90557.md): Freeciv 3.1.0 through 3.2.5 Out-of-Bounds Read via Savegame (CVSS 6.9, freeciv)
- [CVE-2026-90556](https://cve.now/CVE-2026-90556.md): Freeciv before 3.2.6 Heap Buffer Overflow via worklist\_load (CVSS 8.5, freeciv)
- [CVE-2026-15451](https://cve.now/CVE-2026-15451.md): MemberPress Corporate Accounts \<= 1.5.39 - Authenticated (Subscriber+) Privilege Escalation via Mass Assignment in Sub-Account Creation (CVSS 8.8, MemberPress Corporate Accounts)
- [CVE-2026-10148](https://cve.now/CVE-2026-10148.md): Booking for Appointments and Events Calendar – Amelia \<= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'load\_manually' Parameter (CVSS 6.4, melograno Booking for Appointments and Events Calendar – Am…)
- [CVE-2026-90555](https://cve.now/CVE-2026-90555.md): vLLM before 0.28.0 Denial of Service via Audio Header (CVSS 7.1, vllm-project vLLM)
- [CVE-2026-90554](https://cve.now/CVE-2026-90554.md): vLLM before 0.28.0 Denial of Service via audio extraction (CVSS 6.9, vllm-project vLLM)
- [CVE-2026-90553](https://cve.now/CVE-2026-90553.md): vLLM before 0.28.0 Remote Code Execution via LlavaOnevision2 processor (CVSS 8.5, vllm-project vLLM · vllm)
- [CVE-2026-90552](https://cve.now/CVE-2026-90552.md): WWBN AVideo Missing Authorization via Playlists\_schedules list.json.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-90551](https://cve.now/CVE-2026-90551.md): WWBN AVideo Missing Authorization via video\_from\_program API (CVSS 6.9, WWBN AVideo)
- [CVE-2026-90550](https://cve.now/CVE-2026-90550.md): WWBN AVideo Missing Authorization via mediaSession.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-90549](https://cve.now/CVE-2026-90549.md): WWBN AVideo Missing Authorization via videosAndroid.json.php Endpoint (CVSS 6.9, WWBN AVideo)
- [CVE-2026-90548](https://cve.now/CVE-2026-90548.md): WWBN AVideo Missing Authorization in ImageGallery list.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-90547](https://cve.now/CVE-2026-90547.md): WWBN AVideo Missing Authorization via getBookmarks.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-90546](https://cve.now/CVE-2026-90546.md): WWBN AVideo Missing Authorization via like.json.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-90545](https://cve.now/CVE-2026-90545.md): WWBN AVideo Missing Authorization via commentAddNew.json.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-90544](https://cve.now/CVE-2026-90544.md): WWBN AVideo Missing Authorization via videoAddViewCount.json.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-90543](https://cve.now/CVE-2026-90543.md): WWBN AVideo Missing Authentication via socketMessageLiveOwner.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-90542](https://cve.now/CVE-2026-90542.md): WWBN AVideo Missing Authorization via remindMe.json.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-90541](https://cve.now/CVE-2026-90541.md): WWBN AVideo Unauthenticated Information Disclosure via menus.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-90540](https://cve.now/CVE-2026-90540.md): WWBN AVideo Missing Authorization via playListAddVideo.json.php (CVSS 5.3, WWBN AVideo)
- [CVE-2026-90539](https://cve.now/CVE-2026-90539.md): WWBN AVideo Missing Authentication via menuItems.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-90538](https://cve.now/CVE-2026-90538.md): WWBN AVideo Missing Authorization via playlistsFromUser.json.php (CVSS 6.9, WWBN AVideo)
- [CVE-2026-90537](https://cve.now/CVE-2026-90537.md): WWBN AVideo Scheduler sendEmail Missing Authorization via Token (CVSS 8.8, WWBN AVideo)
- [CVE-2026-90536](https://cve.now/CVE-2026-90536.md): WWBN AVideo Missing Authorization via adsInfo API Endpoint (CVSS 6.9, WWBN AVideo)
- [CVE-2026-90535](https://cve.now/CVE-2026-90535.md): Flowise before 3.1.4 Denial of Service via text-to-speech/abort (CVSS 6.3, FlowiseAI Flowise)
- [CVE-2026-90534](https://cve.now/CVE-2026-90534.md): Flowise before 3.1.4 Cross-Workspace Credential IDOR via node-load-method (CVSS 6.1, FlowiseAI Flowise)
- [CVE-2026-90533](https://cve.now/CVE-2026-90533.md): Flowise before 3.1.4 Broken Access Control via organizationuser (CVSS 6.0, FlowiseAI Flowise)
- [CVE-2026-90474](https://cve.now/CVE-2026-90474.md): MCPHub before 1.0.32 OAuth 2.0 Authentication Bypass (CVSS 7.6, samanhappy mcphub)
- [CVE-2026-90473](https://cve.now/CVE-2026-90473.md): msgpack-java through 0.9.12 Integer Overflow via MAP32 (CVSS 6.9, msgpack-java)
- [CVE-2026-90472](https://cve.now/CVE-2026-90472.md): msgpack-java through 0.9.12 Stack Overflow via Nested Arrays (CVSS 6.9, msgpack-java)
- [CVE-2026-89172](https://cve.now/CVE-2026-89172.md): Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms (CVSS 5.6, Microchip AN1044 · Microchip AN953 +1)
- [CVE-2026-11355](https://cve.now/CVE-2026-11355.md): DT LMS \<= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions (CVSS 5.3, designthemes DT LMS – elearning, WordPress LMS Plugin)
- [CVE-2026-77161](https://cve.now/CVE-2026-77161.md): Smart Marketing SMS and Newsletters Forms \<= 5.1.24 - Authenticated (Subscriber+) SQL Injection via Parameter Name (CVSS 6.5, egoi Smart Marketing SMS and Newsletters Forms)
- [CVE-2026-78175](https://cve.now/CVE-2026-78175.md): Tutor LMS \<= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution (CVSS 8.8, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2026-78159](https://cve.now/CVE-2026-78159.md): The Events Calendar \<= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation (CVSS 9.8, stellarwp The Events Calendar)
- [CVE-2026-78006](https://cve.now/CVE-2026-78006.md): The Events Calendar \<= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution (CVSS 9.8, stellarwp The Events Calendar)
- [CVE-2026-85198](https://cve.now/CVE-2026-85198.md): MPG \<= 4.2.1 - Unauthenticated SQL Injection via URL Path (CVSS 6.5, themeisle MPG – Multiple Page Generator, Bulk Landing Pages…)
- [CVE-2026-17585](https://cve.now/CVE-2026-17585.md): Royal Addons for Elementor \<= 1.7.1066 - Unauthenticated Sensitive Information Exposure via Unfiltered meta\_query LIKE Oracle in 'wpr\_keyword' Parameter (CVSS 5.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2026-85200](https://cve.now/CVE-2026-85200.md): GEO my WP \<= 4.5.5.3 - Unauthenticated Local File Inclusion (CVSS 7.5, ninjew GEO my WP)
- [CVE-2026-16482](https://cve.now/CVE-2026-16482.md): rtMedia for WordPress, BuddyPress and bbPress \<= 4.7.11 - Unauthenticated SQL Injection via 'compare' Parameter (CVSS 7.5, rtcamp rtMedia for WordPress, BuddyPress and bbPress)
- [CVE-2026-87919](https://cve.now/CVE-2026-87919.md): Product XML Feed Manager for WooCommerce \< 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode (CVSS 4.9, Product XML Feed Manager for WooCommerce)
- [CVE-2026-87918](https://cve.now/CVE-2026-87918.md): WPBot \< 8.5.7 - Unauthenticated AI Provider API Abuse via Multiple AJAX Actions (CVSS 5.3, WPBot)
- [CVE-2026-87916](https://cve.now/CVE-2026-87916.md): WPBot 8.4.9 - 8.5.9 - Unauthenticated Chat Visitor PII Disclosure (CVSS 5.3, WPBot)
- [CVE-2026-87894](https://cve.now/CVE-2026-87894.md): Rox Appointment Booking 1.0.9 - 1.2.2 - Unauthenticated Customer PII Disclosure via IDOR (CVSS 5.3, Rox Appointment Booking)
- [CVE-2026-87892](https://cve.now/CVE-2026-87892.md): Rox Appointment Booking \< 1.2.0 - Unauthenticated Price Manipulation and Payment Method Restriction Bypass (CVSS 5.3, Rox Appointment Booking)
- [CVE-2026-87891](https://cve.now/CVE-2026-87891.md): Rox Appointment Booking \< 1.2.0 - Unauthenticated Holiday Schedule Modification via REST API (CVSS 6.5, Rox Appointment Booking)
- [CVE-2026-87888](https://cve.now/CVE-2026-87888.md): YayPricing \< 3.5.7 - Subscriber+ Stored XSS via save\_page\_data REST Route (CVSS 8.0, YayPricing)
- [CVE-2026-87842](https://cve.now/CVE-2026-87842.md): Zonify \< 1.0.5 - Unauthenticated Account Login Token Disclosure (CVSS 7.5, Zonify)
- [CVE-2026-87797](https://cve.now/CVE-2026-87797.md): Client Invoicing by Sprout Invoices \< 20.8.16 - Subscriber+ Private Note Overwrite via si\_edit\_private\_note (CVSS 4.3, Sprout Invoices)
- [CVE-2026-87759](https://cve.now/CVE-2026-87759.md): Add User Autocomplete \< 1.2 - Subscriber+ Privilege Escalation (CVSS 8.8, Add User Autocomplete)
- [CVE-2026-86790](https://cve.now/CVE-2026-86790.md): WP Highlight Box \<= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode (CVSS 6.8, WP Highlight Box)
- [CVE-2026-85681](https://cve.now/CVE-2026-85681.md): WP Component \<= 2.2.4 - Unauthenticated Privilege Escalation via Arbitrary Blog Option Update (CVSS 9.8, WP Component)
- [CVE-2026-84171](https://cve.now/CVE-2026-84171.md): WP Images Upload on Piclect \<= 1.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, WP images upload on piclect)
- [CVE-2026-84099](https://cve.now/CVE-2026-84099.md): IDB Ecommerce (wpStoreCart 5) \<= 5.0.7 - Unauthenticated PHP Object Injection via bundled wpsc-membership-pro paypal.php (CVSS 8.1, wpstorecart)
- [CVE-2026-84047](https://cve.now/CVE-2026-84047.md): Album Cover Finder \<= 0.7.0 - Unauthenticated SQLi via and\_action (CVSS 8.6, Album Cover Finder)
- [CVE-2026-84025](https://cve.now/CVE-2026-84025.md): BEAR - Bulk Editor and Products Manager Professional for WooCommerce \< 1.2.2 - Authenticated Product Download URL and Meta Disclosure via IDOR (CVSS 2.2, BEAR)
- [CVE-2026-84024](https://cve.now/CVE-2026-84024.md): BEAR - Bulk Editor and Products Manager Professional for WooCommerce \< 1.2.2 - Meta Field Configuration Update via CSRF (CVSS 4.3, BEAR)
- [CVE-2026-84023](https://cve.now/CVE-2026-84023.md): BEAR - Bulk Editor and Products Manager Professional for WooCommerce \< 1.2.2 - Taxonomy Term Modification via CSRF (CVSS 6.5, BEAR)
- [CVE-2026-82851](https://cve.now/CVE-2026-82851.md): Masteriyo LMS 1.14.0 - 3.4.0 - Instructor+ Arbitrary Post Disclosure via IDOR (CVSS 2.7, Masteriyo LMS)
- [CVE-2026-82847](https://cve.now/CVE-2026-82847.md): Masteriyo LMS \< 3.4.1 - Instructor+ Stored XSS via Course Highlights (CVSS 6.8, Masteriyo LMS)
- [CVE-2026-82845](https://cve.now/CVE-2026-82845.md): Masteriyo LMS \< 3.4.1 - Subscriber+ PHP Object Injection (CVSS 9.9, Masteriyo LMS)
- [CVE-2026-81742](https://cve.now/CVE-2026-81742.md): BE REST Endpoints \<= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation (CVSS 8.8, BE REST Endpoints)
- [CVE-2026-81429](https://cve.now/CVE-2026-81429.md): Export & Import WPBakery Page Builder \<= 1.0.2 - Stored XSS via CSRF (CVSS 7.1, Export & Import WPBakery Page Builder)
- [CVE-2026-81402](https://cve.now/CVE-2026-81402.md): DS Ad Rotator \<= 0.8 - Unauthenticated Arbitrary File Upload (CVSS 9.8, DS Ad Rotator)
- [CVE-2026-81090](https://cve.now/CVE-2026-81090.md): Gpx2Graphics \<= 0.3 - Arbitrary File Upload via CSRF (CVSS 7.2, Gpx2Graphics)
- [CVE-2026-80494](https://cve.now/CVE-2026-80494.md): Yogeta WP Cloud \<= 1.0 - Unauthenticated Arbitrary File Download (CVSS 8.6, Yogeta WP Cloud)
- [CVE-2026-80491](https://cve.now/CVE-2026-80491.md): SAMO Forms \<= 1.0.0 - Unauthenticated SQLi (CVSS 8.6, SAMO Forms)
- [CVE-2026-78152](https://cve.now/CVE-2026-78152.md): SureRank 1.6.2 - 1.10.0 - Unauthenticated Author Email Disclosure via Person Schema (CVSS 5.3, SureRank SEO)
- [CVE-2026-77753](https://cve.now/CVE-2026-77753.md): Temporary Login Without Password \< 1.9.9 - Authenticated Temporary Access Revocation Bypass via Application Passwords (CVSS 5.5, Temporary Login Without Password)
- [CVE-2026-77752](https://cve.now/CVE-2026-77752.md): Temporary Login Without Password 1.5 - 1.9.8 - Multisite Subsite Admin+ Network Super Admin Privilege Escalation (CVSS 7.2, Temporary Login Without Password)
- [CVE-2026-77705](https://cve.now/CVE-2026-77705.md): Amelia \< 2.4.10 - Amelia Manager+ WordPress Account Takeover (CVSS 7.2, Booking for Appointments and Events Calendar)
- [CVE-2026-77689](https://cve.now/CVE-2026-77689.md): Amelia Pro 9.0 - 9.8 - Unauthenticated Payment Bypass (CVSS 5.3, Booking for Appointments and Events Calendar)
- [CVE-2026-77006](https://cve.now/CVE-2026-77006.md): WebTotem Backups \< 1.1.0 - Subscriber+ Arbitrary File Deletion via Path Traversal (CVSS 9.6, WebTotem Backups)
- [CVE-2026-77005](https://cve.now/CVE-2026-77005.md): Code Monkeys Proposals \<= 1.0.1 - Subscriber+ Arbitrary File Deletion via Path Traversal (CVSS 9.6, CODE MONKEYS PROPOSALS)
- [CVE-2026-75800](https://cve.now/CVE-2026-75800.md): Frontegg SAML SSO \<= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse (CVSS 9.8, Frontegg SAML SSO)
- [CVE-2026-83532](https://cve.now/CVE-2026-83532.md): Custom Menu Wizard \<= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes (CVSS 6.8, Custom Menu Wizard Widget)
- [CVE-2026-85706](https://cve.now/CVE-2026-85706.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (CVSS 10.0, KEV, GitLab)
- [CVE-2026-87719](https://cve.now/CVE-2026-87719.md): Deserialization of Untrusted Data in GitLab (CVSS 9.9, GitLab)
- [CVE-2026-90467](https://cve.now/CVE-2026-90467.md): aiosmtplib before 5.1.3 ESMTP Parameter Injection via unvalidated addresses (CVSS 6.3, cole aiosmtplib)
- [CVE-2026-89268](https://cve.now/CVE-2026-89268.md): QloApps through 1.7.0 Reflected XSS via List Filter Parameters (CVSS 5.1, Webkul QloApps)
- [CVE-2026-89267](https://cve.now/CVE-2026-89267.md): starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass (CVSS 5.3, jowilf starlette-admin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.