CVEs published September 27, 2026
151 CVEs were published on September 27, 2026: 11 critical, 60 high. 2 are now in CISA KEV.
- Published
- 151
- Critical
- 11
- High
- 60
- Medium
- 66
- Low
- 14
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 107
Most affected products
- wolfSSL
- 11
- heymrun heym
- 10
- edgelesssys contrast · github.com/edgelesssys/contrast
- 9
- Citrix NetScaler ADC · Citrix NetScaler Gateway
- 8
- AzuraCast
- 7
- Project-MONAI MONAI · monai
- 7
- Red Hat Enterprise Linux
- 6
- mathurvishal CloudClassroom-PHP-Project
- 5
- nezhahq nezha
- 5
- svenbluege.de Event Gallery for Joomla
- 5
Critical 11
- CVE-2026-100886Seetong T8108/T8108P/T8116/T8232 Debug Service improper authenticationSeetong T8108 · Seetong T8108P +2
- CVE-2026-101090Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_urinezhahq nezha · github.com/nezhahq/nezha
- CVE-2026-101084obot before v0.21.1 Authorization Bypass via /mcp-connectobot-platform obot · github.com/obot-platform/obot
- CVE-2026-101065Obot Quickstart Docker Deployment Unauthenticated Admin Accessobot-platform obot
- CVE-2026-88773HTTP Request SmugglingCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2026-88772Memory overflow vulnerability leading to Remote Code Execution or Denial of ServiceCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2026-88771A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commandsCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2026-100741Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServerProgressive Robot hMailServer
- CVE-2026-100835Contrast before 1.16.0 Remote Attestation Relay Attackedgelesssys contrast
- CVE-2026-100721vm2 before 3.12.2 Authorization Bypass via Custom Resolverpatriksimek vm2 · vm2
- CVE-2026-100740D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds writeD-Link DIR-895L
High 60
- CVE-2026-101086Nezha Dashboard before 2.3.5 Task Type Validation Bypassnezhahq nezha
- CVE-2026-101085Nezha before 2.3.8 Denial of Service via Alert Rulenezhahq nezha
- CVE-2026-101064Obot before v0.23.0 Server-Side Request Forgery via MCPobot-platform obot · github.com/obot-platform/obot
- CVE-2026-101062Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registrationobot-platform obot · github.com/obot-platform/obot
- CVE-2026-96280Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systemsRed Hat Enterprise Linux
- CVE-2026-101060python-utcp before 1.1.4 SSRF via unvalidated HTTP redirectsuniversal-tool-calling-protocol python-utcp
- CVE-2026-101059utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypassuniversal-tool-calling-protocol python-utcp
- CVE-2026-101058python-utcp before 1.1.12 SSRF via Remote HTTP Manualuniversal-tool-calling-protocol python-utcp
- CVE-2026-101045Fleet Homebrew Cask OS Command Injection via Metadatafleetdm fleet
- CVE-2026-101044pacquet before 12.0.0-alpha.5 Path Traversal via lockfile aliaspnpm
- CVE-2026-101043pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settingspnpm
- CVE-2026-88778TCP Initial Sequence Number (ISN) predictionCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2026-88777Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ServiceCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2026-88776Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ServiceCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2026-101050Heym before 0.0.53 Authentication Bypass via Telegram Webhookheymrun heym
- CVE-2026-101049Heym before 0.0.53 Slack Webhook Signature Verification Bypassheymrun heym
- CVE-2026-101042Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identityparse-community parse-server · parse
- CVE-2026-88775Memory overflow vulnerability leading to unpredictable or erroneous behavior or Denial of ServiceCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2026-88774Feature policy bypass due to improper HTTP URL based expression usageCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2026-101032navi through 2.24.0 OS Command Injection via Cheatsheet Variablesdenisidoro navi
- CVE-2026-100872Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount OverwriteSylius
- CVE-2026-100871Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API AuthenticationSylius
- CVE-2026-100870Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host HeaderSylius
- CVE-2026-100869Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop APISylius
- CVE-2026-97164Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0svenbluege.de Event Gallery for Joomla
- CVE-2026-89102OCSP stapling v2 multi accepts non-CA chain certificates as issuerswolfSSL
- CVE-2026-89136Client accepts unsolicited RawPublicKey server certificate typewolfSSL
- CVE-2026-93302Trusted peer certificate match ignores public key, allowing forged CA cloneswolfSSL
- CVE-2026-96896Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_requestMalcure Malware Shield — Removal, Repair, Monitor
- CVE-2026-86609Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock SubscriptionDownload Manager
- CVE-2026-81655Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom FieldsAd Inserter
- CVE-2026-100865Heym before 0.0.53 Remote Code Execution via eval() Sandbox Escapeheymrun heym
- CVE-2026-100864heym before 0.0.91 Remote Code Execution via Expression Engineheymrun heym
- CVE-2026-100859Heym before 0.0.106 Credential Exfiltration via URL Overrideheymrun heym
- CVE-2026-100858heym before 0.0.109 Server-Side Request Forgery via Workflow Nodesheymrun heym
- CVE-2026-100857AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolationAzuraCast · azuracast/azuracast
- CVE-2026-100856AzuraCast before 0.23.6 Code Injection via Remote Relay PasswordAzuraCast · azuracast/azuracast
- CVE-2026-100855AzuraCast before 0.23.6 Missing Permission Check via /playAzuraCast · azuracast/azuracast
- CVE-2026-100853AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization BypassAzuraCast
- CVE-2026-100852AzuraCast before 0.23.8 Command Injection via Streamer UsernameAzuraCast
- CVE-2026-100851AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profileAzuraCast
- CVE-2026-100849AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPsAzuraCast
- CVE-2026-100848AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URLAzuraCast
- CVE-2026-100847AzuraCast before 0.23.8 DQL Injection via sortOrderAzuraCast
- CVE-2026-100846MONAI before 1.5.2 Remote Code Execution via Pickle DeserializationProject-MONAI MONAI · monai
- CVE-2026-100845MONAI before 1.6.0 Remote Code Execution via NumpyReaderProject-MONAI MONAI · monai
- CVE-2026-100844MONAI before 1.6.0 OS Command Injection via dataset_name_or_idProject-MONAI MONAI · monai
- CVE-2026-100843MONAI before 1.6.0 Remote Code Execution via algo_from_pickleProject-MONAI MONAI · monai
- CVE-2026-100842MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute ChainsProject-MONAI MONAI · monai
- CVE-2026-100841MONAI through 1.6.0 PersistentDataset Remote Code Execution via Pickle CacheProject-MONAI MONAI · monai
- CVE-2026-100840MONAI through 1.6.0 Remote Code Execution via bundle configurationProject-MONAI MONAI · monai
- CVE-2026-100839Contrast before 1.18.0 AML Injection Remote Code Executionedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2026-100838Contrast before 1.19.1 CopyFile Policy Symlink Subversionedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2026-100834http4k before 6.48.0.0 Digest Authentication Replay Protection Bypasshttp4k · org.http4k:http4k-security-digest
- CVE-2026-100833Contrast before 1.23.1 Image Substitution via Policy Generationedgelesssys contrast
- CVE-2026-100725http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStoragehttp4k · org.http4k:http4k-core
- CVE-2026-100722vm2 before 3.12.2 Host Process Termination via Construct Trappatriksimek vm2 · vm2
- CVE-2025-71426Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recoveryedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2025-71425Contrast before 1.8.1 Information Disclosure via Loggingedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2025-71423Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosureedgelesssys contrast · github.com/edgelesssys/contrast
Medium, low and unrated 80
- CVE-2026-100889Trusted Domain Project OpenDKIM Decoder util.c dkim_qp_decode off-by-oneTrusted Domain Project OpenDKIM
- CVE-2026-100888Trusted Domain Project OpenDKIM DKIM Signature Header Selection dkim-canon.c dkim_canon_selecthdrs out-of-bounds writeTrusted Domain Project OpenDKIM
- CVE-2026-100887amirsanni Mini-Inventory-and-Sales-Management-System Database Query Builder DB_query_builder.php order_by sql injectionamirsanni Mini-Inventory-and-Sales-Management-System
- CVE-2026-100885Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorizationKrayin laravel-crm
- CVE-2026-100884Krayin laravel-crm attachment-download Endpoint acl.php resource injectionKrayin laravel-crm
- CVE-2026-100883Krayin laravel-crm acl.php access controlKrayin laravel-crm
- CVE-2026-96284Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink followingRed Hat Enterprise Linux
- CVE-2026-100882Krayin laravel-crm Admin Settings Endpoint index.blade.php cross site scriptingKrayin laravel-crm
- CVE-2026-96282Flatpak: flatpak: extension metadata path traversal file existence oracleRed Hat Enterprise Linux
- CVE-2026-96283Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pullRed Hat Enterprise Linux
- CVE-2026-100881zhistaredu StarTraining application.yml cross site scriptingzhistaredu StarTraining
- CVE-2026-96281Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimesRed Hat Enterprise Linux
- CVE-2026-100880zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scriptingzhistaredu StarTraining
- CVE-2026-101089Nezha before 2.2.7 Information Disclosure via /api/v1/profilenezhahq nezha
- CVE-2026-101088Nezha before 2.3.1 Denial of Service via Concurrent Server Deletenezhahq nezha
- CVE-2026-101087Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6nezhahq nezha
- CVE-2026-101063Obot before v0.23.0 Authentication Bypass via Registry APIobot-platform obot · github.com/obot-platform/obot
- CVE-2026-100879zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorizationzhistaredu StarTraining
- CVE-2026-100878zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorizationzhistaredu StarTraining
- CVE-2026-100877mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scriptingmathurvishal CloudClassroom-PHP-Project
- CVE-2026-96279Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinksRed Hat Enterprise Linux
- CVE-2026-100876mathurvishal CloudClassroom-PHP-Project loginlinkstudent.php missing authenticationmathurvishal CloudClassroom-PHP-Project
- CVE-2026-100875mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-100874mathurvishal CloudClassroom-PHP-Project addnewstudent.php sql injectionmathurvishal CloudClassroom-PHP-Project
- CVE-2026-100873mathurvishal CloudClassroom-PHP-Project cross-site request forgerymathurvishal CloudClassroom-PHP-Project
- CVE-2026-101061utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypassuniversal-tool-calling-protocol python-utcp
- CVE-2026-101057utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URLuniversal-tool-calling-protocol python-utcp
- CVE-2026-101056Cloudreve before 4.16.1 Authentication Bypass via Cached Context Hintcloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-101051Cloudreve before 4.16.1 Path Traversal via Remote Downloadcloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-101048Cloudreve before 4.17.0 SSRF via Admin.Read OAuth scopecloudreve · github.com/cloudreve/Cloudreve/v4 +2
- CVE-2026-101047Fleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLsfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-101046Fleet before 4.89.0 SQL Injection via ORDER BY Activity Endpointsfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2026-101041Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeovervulnerability-lookup
- CVE-2026-101033KitchenOwl through 0.7.10 IDOR via unchecked category IDTomBursch kitchenowl
- CVE-2026-100868Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridgepenpot · @penpot/mcp
- CVE-2026-100867spaceship-prompt through 4.22.5 Terminal Escape Sequence Injectionspaceship-prompt
- CVE-2026-100866onefetch through 2.28.1 Terminal Escape Sequence Injectiono2sh onefetch
- CVE-2026-100748Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0svenbluege.de Event Gallery for Joomla
- CVE-2026-100747Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0svenbluege.de Event Gallery for Joomla
- CVE-2026-100749Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0svenbluege.de Event Gallery for Joomla
- CVE-2026-97165Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0svenbluege.de Event Gallery for Joomla
- CVE-2026-15442Heap use-after-free on read during bidirectional (D)TLS shutdownwolfSSL
- CVE-2026-89133NameConstraints not enforced across unconstrained intermediate CAwolfSSL
- CVE-2026-89134Subject CN name-constraint check bypassed when non-DNS SAN presentwolfSSL
- CVE-2026-89135Failed X509_verify_cert leaves unverified CA in shared CertManagerwolfSSL
- CVE-2026-93304(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchangewolfSSL
- CVE-2026-94417CRL check skipped when OCSP enabled and certificate has no OCSP URLwolfSSL
- CVE-2026-94418Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFYwolfSSL
- CVE-2026-94419Client session cache reference poisoning allows resumption with wrong serverwolfSSL
- CVE-2026-97319PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player BlockPowerPress Podcasting plugin by Blubrry
- CVE-2026-97227NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data DeletionNextScripts: Social Networks Auto-Poster
- CVE-2026-96899Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_scriptOptima Express IDX
- CVE-2026-96897Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cacheOptima Express IDX
- CVE-2026-96895WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block AttributesWP YouTube Lyte
- CVE-2026-92995Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_fileVerge3D Publishing and E-Commerce
- CVE-2026-92436Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDORMailchimp for WooCommerce
- CVE-2026-89006WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed ImportWPeMatico RSS Feed Fetcher
- CVE-2026-89003WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign PreviewWPeMatico RSS Feed Fetcher
- CVE-2026-89001WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign SettingsWPeMatico RSS Feed Fetcher
- CVE-2026-89000WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign RunWPeMatico RSS Feed Fetcher
- CVE-2026-86841Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced OptionsOnline Scheduling and Appointment Booking System
- CVE-2026-86839Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOROnline Scheduling and Appointment Booking System
- CVE-2026-85002EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block AttributesEmbedPress
- CVE-2026-82841UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration NoticeUpdraftPlus: WP Backup & Migration Plugin
- CVE-2026-84069WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.phpWebFacing™
- CVE-2026-100746coollabsio Coolify GitHub App Setup redirect missing authenticationcoollabsio Coolify
- CVE-2026-100745Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflowEdimax BR-6428nC
- CVE-2026-100837Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matchingedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2026-100836Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContaineredgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2026-100863Heym before 0.0.91 SSRF via image fetching and IPv6 validationheymrun heym
- CVE-2026-100862heym before 0.0.91 Multiple Secrets Plaintext Storageheymrun heym
- CVE-2026-100861heym before 0.0.105 SSRF via credential-controlled base URLsheymrun heym
- CVE-2026-100860heym before 0.0.105 Authentication Bypass via Redis Nodeheymrun heym
- CVE-2026-100854AzuraCast before 0.23.6 Metadata Injection via Liquidsoap APIAzuraCast · azuracast/azuracast
- CVE-2026-100850AzuraCast before 0.23.8 SSRF and Local File Read via Remote PlaylistAzuraCast
- CVE-2026-100724http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxyhttp4k · org.http4k:http4k-core
- CVE-2026-100723vm2 before 3.12.2 Memory Disclosure via zlib Buffer Poolpatriksimek vm2 · vm2
- CVE-2025-71424Edgeless Systems Contrast before 1.9.1 Insecure Volume Mountedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2025-71422Contrast before 1.12.1 Insecure LUKS2 Persistent Storageedgelesssys contrast · github.com/edgelesssys/contrast
- CVE-2026-100744coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorizationcoollabsio Coolify