Daily vulnerability intelligence for defenders – fresh CVEs with exploitability signals, patch status, and action-oriented priorities from 22+ sources.

CVEs published

Get CVEs that hit your stack — not 200/day

Pick your technologies, get a weekly digest by email. Free, no spam.

React Python Postgres +200 more

React Next.js Python Postgres AWS +200 more

Trending Now See all

Critical Watch See all

Weekly Report See all

Actively Exploited Critical RCE and File-Read Flaws Dominate the Week Sep 07 – Sep 14, 2026

Actively Exploited Edge and Browser Flaws Anchor This Week's Risk Aug 31 – Sep 07, 2026

Web App RCE and Privilege Escalation Dominate; Zero KEV This Week Aug 24 – Aug 31, 2026

Actively Exploited RCE in Entra, MLflow, TrueConf Anchor This Week's Risk Aug 17 – Aug 24, 2026

Actively Exploited Unpatched RCE and Privilege Flaws Lead the Week Aug 10 – Aug 17, 2026

Weekly Vulnerability Briefing: Unpatched Critical RCE Dominates Findings Aug 03 – Aug 10, 2026

Actively Exploited KEVs and Widespread PoC-Available RCE Flaws Lead Week Jul 27 – Aug 03, 2026

Autel & Check Point Flaws Drive 1,096 Unpatched Critical/High Count Jul 20 – Jul 27, 2026

ICT Providers at Risk

View all

Last 30 days

Upcoming Zero-Day Disclosures 598 568 overdue

View all

to view ZDI disclosures

Attack Technique Trend

Prediction based on ZDI Disclosures & CVE data · 30 days

Analytics

Vendor Today – Quick Filter

Techniques

results

Sort:

Base Score

Vector String

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

Integrity (I)

Availability (A)

0 | 3.9| 6.9| 8.9| 10

NONE LOW MEDIUM HIGH CRITICAL

CVSS Filter – CVEs match

No CVEs match the selected criteria

Incoming 1

Pre-NVD – not yet scored

CVE-2026-3865 Kubernetes

ZDI Disclosures – Sep 17 10 2d

View all

MATE Desktop

Adobe

Cisco

Cisco

dnsmasq

Bosch Rexroth

GStreamer

Docker

Browse older vulnerabilities in Archive

Live Feed auto-refresh 60s

Vulnerability Intelligence — September 15, 2026

46 CVEs tracked today. 1 Critical, 8 High, 25 Medium, 9 Low.

CVE-2026-90711 CRITICAL CVSS 9.1
Trust-boundary spoofing in the proxy-addr Node.js module (versions 1.1.0 through 2.0.7), the library that backs Express req.ip and req.ips, lets unauthenticated clients forge their apparent source address. When an operator declares a trusted-proxy subnet in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g. ::ffff:10.0.0.0/8 rather than the correct /104), proxy-addr silently accepts it but trusts every IPv4 address on the internet, so the direct socket peer becomes trusted at hop 0 and any client can set an arbitrary X-Forwarded-For header. This is a fail-open regression introduced in 1.1.0, fixed in 2.0.8; no public exploit identified at time of analysis, and it is not in CISA KEV.

Authentication Bypass Node.js Proxy Addr
CVE-2026-91778 HIGH CVSS 7.2
Incorrect authorization validation in Octopus Server permits authenticated users holding certain scoped permission sets to execute arbitrary scripts on deployment workers, including the built-in worker that runs directly within the Octopus Server process. The flaw bypasses the permission check that should gate script execution, allowing a user to operate outside their authorized scope without possessing the required authorisation. No public exploit has been identified and the CVE is not in CISA KEV, but the low authentication barrier - any user with some scoped permissions - makes this a meaningful privilege-escalation risk in CI/CD environments where Octopus Server routinely holds deployment credentials and infrastructure access.

Authentication Bypass Octopus Server Octopus Deploy
CVE-2026-91752 HIGH CVSS 8.7
Stack-based buffer overflow in GNU libextractor before 1.15 allows remote, unauthenticated attackers to crash any application that uses libextractor to extract metadata from a crafted StarOffice document. The vulnerability resides in the process_star_office function, which allocates a variable-length stack array sized from attacker-controlled OLE2 stream data - enabling up to 4 MB of forced stack allocation, exhausting stack space and causing a process crash. A publicly available exploit exists (referenced as libextractor-ole2-rce on GitHub), and a vendor patch has been released in version 1.15, though no CISA KEV listing has been identified at time of analysis.

Buffer Overflow Libextractor
CVE-2026-91751 HIGH CVSS 7.2
Path traversal in Flextype CMS through 1.0.0-alpha.3 allows API token holders to escape the designated entries directory and read, create, or overwrite arbitrary files accessible to the web server process. The Entries REST API accepts unsanitized id and new_id parameters and passes them directly into filesystem operations, permitting traversal sequences such as '../../' to resolve paths outside the intended content tree. No public exploit code has been identified and no CISA KEV listing exists, but the vulnerability is mechanically straightforward for any actor already possessing a valid API token.

Path Traversal Flextype
CVE-2026-91750 HIGH CVSS 7.1
WeKnora's URL-based document ingestion endpoint (POST /api/v1/knowledge-bases/:id/knowledge/url) allows authenticated users to reach internal network resources and cloud metadata services by supplying a public URL that redirects to private addresses, bypassing the Go-side SSRF filter applied only to the initial submitted URL. Versions 0.5.2 through 0.6.x are affected; the Python/Playwright web scraper layer followed HTTP redirects without re-invoking SSRF validation, a gap the Go service handler did not share. No public exploit or CISA KEV listing exists at time of analysis, but the redirect-bypass technique is well-documented and accessible to any authenticated user.

SSRF Weknora
CVE-2026-91001 HIGH CVSS 8.6
Stack-based buffer overflow in the D-Link DI-8400 router (firmware 16.07) allows authenticated remote attackers to overwrite stack memory via oversized input to any of eight parameters - serv, user, host, wild, mx, bmx, cust, or ip - handled by the ddns_asp() function at the /ddns.asp DDNS configuration endpoint. Successful exploitation can yield arbitrary code execution on the device, giving an attacker full control over the router. A public exploit script exists on GitHub (ddns_asp.py), and no vendor-released patch has been identified at time of analysis.

Buffer Overflow D-Link Stack Overflow Di 8400
CVE-2026-90847 HIGH CVSS 8.5
OS command injection in EFM ipTIME C200E firmware 1.094 allows an authenticated remote attacker with administrative privileges to execute arbitrary operating system commands via a crafted request to the iux_set.cgi endpoint in the System Setup component. A public proof-of-concept exploit, including a video demonstration, has been disclosed. No patch has been confirmed at time of analysis. No public exploit identified at time of analysis as confirmed active exploitation (CISA KEV status absent), though the POC lowers the bar for exploitation significantly.

Command Injection Iptime C200E
CVE-2026-88262 HIGH CVSS 8.7
Insufficient session expiration in bizwell xClick groupware allows authentication bypass through replay of session tokens that should have been invalidated after logout or timeout. Affecting versions R2, R3, and R3.1, the flaw enables an attacker who has obtained a victim's session token to continue using it with full account-level access even after the legitimate session should have ended, carrying high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 8.7. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog.

Authentication Bypass Xclick
CVE-2026-75983 HIGH CVSS 7.5
Privilege escalation to full administrator equivalence in the Eventin event management plugin for WordPress allows any authenticated user who controls the user ID 1 account - regardless of their currently assigned role - to bypass every WordPress capability check and achieve remote code execution via the built-in plugin and theme editors. The flaw is rooted in PermissionManager::manage_permissions() unconditionally returning the always-true 'exist' capability primitive for all capability evaluations when the requesting user ID equals 1, granting blanket access to manage_options, edit_plugins, edit_themes, promote_users, and update_core. Exploitation is conditional on user ID 1 having been demoted to a lower-privilege role as a hardening measure; default installations where user ID 1 retains administrator rights are not impacted. No public exploit has been identified at time of analysis.

WordPress Privilege Escalation RCE Wordpress Plugin Arraytics
CVE-2026-91819 MEDIUM CVSS 6.9
CSRF protection bypass in MISP ≤2.5.45 allows a network-adjacent attacker to forge authenticated state-changing requests against any MISP action that reads parameters from the URL. The bypass exploits CakePHP's method-override processing: submitting `_method=GET` (or an equivalent non-write verb via `X-HTTP-Method-Override`) causes CakePHP to empty the parsed request body before MISP's `BetterSecurityComponent` evaluates whether to run `_validatePost()` and `_validateCsrf()`. Because `hasData` is false after body-clearing, both protections are silently skipped entirely. No public exploit has been identified at time of analysis, but the mechanism is straightforward to weaponize by anyone who can lure an authenticated MISP user to a crafted page.

CSRF Misp
CVE-2026-91087 MEDIUM CVSS 5.5
Use-after-free in GPAC's LASeR scene graph command processing subsystem allows remote attackers to corrupt heap memory by supplying a crafted media file, potentially leading to process crash or code execution. Affected are GPAC builds up to commit f1219cde; the flaw stems from direct node-pointer assignment without proper reference counting in the LASeR decoder and scene graph command application paths. A public proof-of-concept exploit is confirmed available; vendor-released patch exists at commit e34f4ba and release abi-16.24.

Denial Of Service Use After Free Memory Corruption Gpac
CVE-2026-91002 MEDIUM CVSS 5.5
Unauthenticated access to the `/blacklist` endpoint of Maltrail (versions up to 3.0.1) allows any remote caller to retrieve source IP addresses of events that matched the operator's BLACKLIST rules, exposing internal network hosts flagged by the threat detection system. The oversight - a missing session check on one endpoint while all sibling endpoints (`/events`, `/counts`, `/hunt`, `/meta`, `/geo`) correctly required authentication - was confirmed by the vendor and patched in version 3.1 the same day it was reported. A public proof-of-concept exploit is available, making exploitation trivially scriptable against exposed instances.

Authentication Bypass Information Disclosure Maltrail
CVE-2026-90881 MEDIUM CVSS 5.5
Unauthenticated information disclosure in D-Link DIR-882 routers (firmware up to 20260814) allows remote attackers to retrieve sensitive data by sending crafted requests to the /HNAP1/dllog.cgi CGI binary endpoint. The vulnerability resides in the main() function of the dllog.cgi component, which fails to properly restrict output before returning it to the caller. A public proof-of-concept exists, per the GitHub reference, which also links this endpoint to quick VPN settings disclosure - suggesting credentials or configuration material may be exposed. No public KEV listing and no vendor patch have been identified at time of analysis.

Information Disclosure D-Link Dir 882
CVE-2026-90879 MEDIUM CVSS 5.5
SQL injection in zyx0814 FilePress up to version 3.0.1 allows remote unauthenticated attackers to manipulate database queries via the orderby and order parameters in dzz/publish/search.php. The Publish Module's search endpoint accepts unsanitized user-controlled sorting parameters directly into a SQL ORDER BY clause, enabling blind or time-based data extraction. A publicly available proof-of-concept exploit exists; the vendor has not responded to the coordinated disclosure report as of the time of analysis.

PHP SQLi Filepress
CVE-2026-90856 MEDIUM CVSS 5.5
Improper privilege assignment in SourceCodester College Notes Gallery Management System 1.0 allows unauthenticated remote attackers to self-assign elevated roles during account registration by manipulating the `role` parameter in signup.php. An attacker who registers with a crafted request can gain administrative access to the application without authorization. A public exploit has been disclosed, lowering the bar for exploitation significantly.

PHP Privilege Escalation
CVE-2026-90855 MEDIUM CVSS 5.5
SQL injection in SourceCodester/katojkalemba Online Food Ordering System 1.0 allows remote unauthenticated attackers to manipulate the `id` parameter in `/web/order.php` to inject arbitrary SQL, achieving partial read and write access to the underlying database. The CVSS 4.0 vector carries an E:P modifier confirming public exploit code is available, lowering the barrier to exploitation significantly. No vendor patch has been identified at time of analysis, and no CISA KEV listing exists.

PHP SQLi Online Food Ordering System
CVE-2026-90854 MEDIUM CVSS 5.5
SQL injection in SourceCodester Online Food Ordering System 1.0 allows any unauthenticated remote attacker to manipulate the database through the unsanitized `ID` parameter of `/web/category-foods.php`. A public exploit has been released, enabling database extraction, record modification, or deletion without any authentication. No vendor patch has been identified at time of analysis.

PHP SQLi Online Food Ordering System
CVE-2026-90852 MEDIUM CVSS 5.5
Use-after-free in zstd-jni's Dictionary Sharing component allows remote attackers to corrupt native heap memory through the ZstdCompressCtx.loadDict() and ZstdDecompressCtx.loadDict() APIs in versions up to 1.5.7-13. The defect is a logic inversion in shared-lock accounting: the code releases the reference count on the incoming dictionary parameter rather than on the previously held dictionary reference, causing the old native buffer to remain referenced after it can be freed by another thread. A public proof-of-concept exists via GitHub issue #404, and vendor released a confirmed fix in version 1.5.7-14.

Denial Of Service Java Use After Free Memory Corruption Zstd Jni
CVE-2026-90846 MEDIUM CVSS 5.5
SQL injection in PHPGurukul Daily Expense Tracker System 1.1 exposes the unauthenticated forgot-password endpoint `/dets/forgot-password.php`, where the `email` and `contactno` parameters are passed unsanitized to backend SQL queries. Any remote, unauthenticated attacker can exploit this to read or manipulate the underlying database. A public proof-of-concept exploit has been disclosed on GitHub, lowering the skill threshold for exploitation; no KEV listing exists at time of analysis.

PHP SQLi Daily Expense Tracker System
CVE-2026-90844 MEDIUM CVSS 5.5
SQL injection in PHPGurukul Daily Expense Tracker System 1.1 allows unauthenticated remote attackers to manipulate the email parameter in the pre-authentication login form at /dets/index.php, enabling authentication bypass or database content extraction. A public exploit is available on GitHub, removing any meaningful skill barrier to exploitation. No vendor-released patch has been identified; the CVSS 4.0 score of 5.5 with all impacts rated Low reflects the application's narrow data scope rather than a general downgrade of the SQL injection risk class.

PHP SQLi Daily Expense Tracker System

Track CVEs for your stack Sign up free →

Today's Vulnerabilities Vulnerabilities