CVEs published September 13, 2026
132 CVEs were published on September 13, 2026: 6 critical, 26 high.
- Published
- 132
- Critical
- 6
- High
- 26
- Medium
- 89
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 61
Most affected products
- jaychouchannel Tourism-Management-System
- 5
- lenve vhr
- 5
- GPAC
- 4
- itsourcecode Sales and Inventory System
- 4
- SourceCodester School Registration and Fee System
- 4
- User Registration & Membership
- 4
- vvbbnn00 WARP-Clash-API
- 4
- CyberPanel
- 3
- Fengoffice Feng Office
- 3
- PHPGurukul Bank Locker Management System
- 3
Critical 6
- CVE-2026-90606Totolink A3002MU boa formIpv6Setup buffer overflowTotolink A3002MU
- CVE-2026-90605Totolink A3002MU boa formFilter buffer overflowTotolink A3002MU
- CVE-2026-81648CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX RouterCryptoPayment Gateway
- CVE-2026-90562LangBot before 4.10.11 Authentication Bypass via Weak Recovery Keylangbot-app LangBot
- CVE-2026-90561Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYGstrapi
- CVE-2026-90493Tonec Internet Download Manager Kernel Driver idmwfp.sys access controlTonec Internet Download Manager
High 26
- CVE-2026-15891NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gatewayzephyrproject zephyr
- CVE-2026-88802MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post DeletionMDJM Event Management · Mobile Events Manager
- CVE-2026-88793YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_serverYouTube Embed
- CVE-2026-85129Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings ImportHoo Companion
- CVE-2026-74933GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration OverwriteGenieWords
- CVE-2026-90783MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer WraparoundMoritz Bunkus MKVToolNix
- CVE-2026-90780SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Contentsipp
- CVE-2026-90779SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parametersipp
- CVE-2026-90778SIPp through 3.7.7 Buffer Overflow via SIP To Header Tagsipp
- CVE-2026-90777ESPnet before 202609 Remote Code Execution via Unsafe Deserializationespnet
- CVE-2026-90776Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsingnodemailer
- CVE-2026-90775PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule WeightPostGIS address_standardizer
- CVE-2026-90774rustypaste before 0.18.1 Path Traversal via filename headerorhun rustypaste
- CVE-2026-90772Amundsen Frontend through 4.3.0 Stored XSS via Descriptionamundsen-io amundsen-frontend
- CVE-2026-90770Spug through 3.4.0 Remote Code Execution via ping_checkopenspug spug
- CVE-2026-90769Open Notebook before 1.11.0 Server-Side Request Forgery via link-sourcelfnovo open-notebook
- CVE-2026-90768CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Checkkevoreilly CAPEv2
- CVE-2026-90767Froxlor before 2.3.12 SSH Key Injection via authorized_keysFroxlor
- CVE-2026-89080Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provider State DemotionReally Simple Security
- CVE-2026-86406User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership PurchaseUser Registration & Membership
- CVE-2026-80071User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to AdministratorUser Registration & Membership
- CVE-2026-90678An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5.HAProxy
- CVE-2026-90668The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackerUnrealIRCd
- CVE-2026-29811CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normalCyberPanel
- CVE-2026-36453Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1.Rhymix
- CVE-2026-37008CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVECrewAI
Medium, low and unrated 100
- CVE-2026-90604Totolink A3002MU Anchor Tag cross site scriptingTotolink A3002MU
- CVE-2026-90603Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted uploadAnil-matcha Open-Generative-AI
- CVE-2026-15892Heap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of servicezephyrproject zephyr
- CVE-2026-90602Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scriptingAnil-matcha Open-Generative-AI
- CVE-2026-90601getzep graphiti REST API main.py improper authenticationgetzep graphiti
- CVE-2026-90600itsourcecode Sales and Inventory System inv_edit1.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-90599Rizwan17 inventory-management-system process.php cross-site request forgeryRizwan17 inventory-management-system
- CVE-2026-90598jaygajera17 E-commerce-project-springBoot UserController.java UserController.updateUser authorizationjaygajera17 E-commerce-project-springBoot
- CVE-2026-90597itsourcecode Sales and Inventory System sup_edit1.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-90596embedded-graphics image_raw.rs new/bytes_per_row integer overflowembedded-graphics
- CVE-2026-90595wxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorizationwxiaoqi Spring-Cloud-Platform
- CVE-2026-90594wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorizationwxiaoqi Spring-Cloud-Platform
- CVE-2026-90593embedded-graphics image_raw.rs draw_sub_image integer overflowembedded-graphics
- CVE-2026-90584TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resourcesTooTallNate Java-WebSocket
- CVE-2026-89050Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URLQuads Ads Manager for Google AdSense
- CVE-2026-90583kagisearch smallweb Query String Rendering sw.py index cross site scriptingkagisearch smallweb
- CVE-2026-90582evanchiu serverless-todo API Todo Endpoint index.js saveTodos resource consumptionevanchiu serverless-todo
- CVE-2026-90581cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injectioncym1102 nginxWebUI
- CVE-2026-90580FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgeryFlowiseAI Flowise
- CVE-2026-90579cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key missing authenticationcheshire-cat-ai Cheshire Cat AI
- CVE-2026-90578GPAC MP4Box list.c gf_list_count use after freeGPAC
- CVE-2026-90577GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflowGPAC
- CVE-2026-90576GPAC MP4Box base_scenegraph.c gf_node_list_add_child null pointer dereferenceGPAC
- CVE-2026-90575PHPGurukul Small CRM Login Success login.php unserialize deserializationPHPGurukul Small CRM
- CVE-2026-90574itsourcecode Sales and Inventory System emp_transac.php add sql injectionitsourcecode Sales and Inventory System
- CVE-2026-90573GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereferenceGPAC
- CVE-2026-90572davenardella snap7 s7_micro_client.cpp opUpload memory corruptiondavenardella snap7
- CVE-2026-90571Exrick xmall Order Printing order-print.jsp cross site scriptingExrick xmall
- CVE-2026-90570linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scriptinglinlinjava litemall
- CVE-2026-90569linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scriptinglinlinjava litemall
- CVE-2026-90568moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scriptingmoxi624 Mogu Blog
- CVE-2026-90567quequnlong shiyi-blog Search index.vue highlightKeyword cross site scriptingquequnlong shiyi-blog
- CVE-2026-90566Rizwan17 inventory-management-system Registration register.php createUserAccount improper authorizationRizwan17 inventory-management-system
- CVE-2026-90565Rizwan17 inventory-management-system dashboard.php access controlRizwan17 inventory-management-system
- CVE-2026-90564quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getChatMsgList cross site scriptingquequnlong shiyi-blog
- CVE-2026-90563maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scriptingmaliangnansheng bbs-springboot
- CVE-2026-90529DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scriptingDataEase
- CVE-2026-90528TDuckApp tduck-platform Form Write View index.vue cross site scriptingTDuckApp tduck-platform
- CVE-2026-90527quequnlong shiyi-blog Add Message API index.vue cross site scriptingquequnlong shiyi-blog
- CVE-2026-90526SourceCodester School Registration and Fee System save_class.php sql injectionSourceCodester School Registration and Fee System
- CVE-2026-90525itsourcecode Sales and Inventory System cust_pos_trans.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-90524jaychouchannel Tourism-Management-System Update Endpoint missing authenticationjaychouchannel Tourism-Management-System
- CVE-2026-90523jaychouchannel Tourism-Management-System User Register Endpoint UsersController.java privileges managementjaychouchannel Tourism-Management-System
- CVE-2026-90522jaychouchannel Tourism-Management-System Password Recovery UsersController.java resetPass password recoveryjaychouchannel Tourism-Management-System
- CVE-2026-90521jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java authorizationjaychouchannel Tourism-Management-System
- CVE-2026-90520jaychouchannel Tourism-Management-System Authorization Interceptor AuthorizationInterceptor.java improper authorizationjaychouchannel Tourism-Management-System
- CVE-2026-90782S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()Systerel S2OPC
- CVE-2026-90781alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()ALSA Project alsa-lib
- CVE-2026-90519PHPGurukul Bank Locker Management System add-locker-form.php unrestricted uploadPHPGurukul Bank Locker Management System
- CVE-2026-90518PHPGurukul Bank Locker Management System sidebar.php access controlPHPGurukul Bank Locker Management System
- CVE-2026-90517PHPGurukul Bank Locker Management System view-assign-locker.php authorizationPHPGurukul Bank Locker Management System
- CVE-2026-90516SourceCodester School Registration and Fee System pay_report.php sql injectionSourceCodester School Registration and Fee System
- CVE-2026-90515SourceCodester School Registration and Fee System delete_stud.php sql injectionSourceCodester School Registration and Fee System
- CVE-2026-90514SourceCodester School Registration and Fee System save_stud.php sql injectionSourceCodester School Registration and Fee System
- CVE-2026-90773procs through 0.14.12 Terminal Escape Sequence Injection via Commanddalance procs
- CVE-2026-90771joi before 17.13.8 and 18.2.9 Prototype Pollution via messageshapijs joi · joi
- CVE-2026-90513simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sendEmail missing authenticationsimalexan api-lambda-send-email-ses
- CVE-2026-90511GongShengyue OnlineBooks listSplit BooksServlet.java sql injectionGongShengyue OnlineBooks
- CVE-2026-90510dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey hard-coded keydromara orion-visor
- CVE-2026-90509dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard-coded credentialsdromara orion-visor
- CVE-2026-90508Chengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorizationChengdu Qilu Technology Ludashi
- CVE-2026-90507vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription access controlvvbbnn00 WARP-Clash-API
- CVE-2026-90506vvbbnn00 WARP-Clash-API Save Account Job race conditionvvbbnn00 WARP-Clash-API
- CVE-2026-90505vvbbnn00 WARP-Clash-API doUpdateLicenseKey race conditionvvbbnn00 WARP-Clash-API
- CVE-2026-90504vvbbnn00 WARP-Clash-API authorized missing authenticationvvbbnn00 WARP-Clash-API
- CVE-2026-90503Chengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 information disclosureChengdu Qilu Technology Ludashi
- CVE-2026-90502stilleshan ServerStatus Stats Generation main.cpp cross site scriptingstilleshan ServerStatus
- CVE-2026-90501lenve vhr HrMapper.xml HrInfoController.updateHr privileges managementlenve vhr
- CVE-2026-90500lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted uploadlenve vhr
- CVE-2026-90499lenve vhr Password Update pass HrInfoController.updatePass improper authorizationlenve vhr
- CVE-2026-90498lenve vhr vhr.sql default credentialslenve vhr
- CVE-2026-88995Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availability CheckBookit — Booking & Appointment Calendar
- CVE-2026-88912rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDORrtMedia for WordPress, BuddyPress and bbPress
- CVE-2026-88764Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPal Standard subsc_refSimple Membership
- CVE-2026-86407User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure via Membership Thank You PageUser Registration & Membership
- CVE-2026-80072User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Login Redirect ParametersUser Registration & Membership
- CVE-2026-77773Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entry Disclosure via formychat_get_gf_entryContact Form to Chat Apps | Click to Chat to Order
- CVE-2026-90497Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scriptingFengoffice Feng Office
- CVE-2026-90496Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimension_order sql injectionFengoffice Feng Office
- CVE-2026-90679Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not Forgejo
- CVE-2026-90495Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll sql injectionFengoffice Feng Office
- CVE-2026-90494restify node-restify static.js serveStatic path traversalnode-restify
- CVE-2026-90492webgjc web_robot web.py controller_recover os command injectionwebgjc web_robot
- CVE-2026-90491sanjevirau gsubs Electron index.js showQuerySuccessPage code injectionsanjevirau gsubs
- CVE-2026-90490lenve vhr MailReceiver deserializationlenve vhr
- CVE-2020-15875An issue was discovered in LibreNMS 1.65.LibreNMS
- CVE-2022-42917In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/FRRouting
- CVE-2024-53922An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920.Samsung Exynos 8890 firmware
- CVE-2025-45480Floodlight 71fe8a7 allows disruption of host communication via link spoofing.projectfloodlight Floodlight
- CVE-2025-63842A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user tRepetico web backend
- CVE-2025-64059Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor.getgrav Grav
- CVE-2025-70819Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../Zettlab D6 Ultra
- CVE-2025-70820Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.Zettlab D6 Ultra
- CVE-2026-29810CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.CyberPanel
- CVE-2026-29812CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.CyberPanel
- CVE-2026-35867A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2LB-LINK AC1900 firmware
- CVE-2026-36989A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php.LuxSoft LuxCal Web Calendar
- CVE-2026-38332TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length.cdcseacave TinyEXIF
- CVE-2026-52296FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.FFmpeg
- CVE-2026-52297FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libFFmpeg