Search CVEs, research… / diras.sa

ARCHIVE

CVEs published in September 2026

Vulnerabilities added to CVE Radar in September 2026, newest first.

  1. CVE-2026-73373
    Joomla! CMS unrestricted SHTML upload allows remote code execution Joomla! Project Joomla! CMS ·
    CRITICAL 9.8
  2. CVE-2026-66682
    Abandoned Cart Pro for WooCommerce unauthenticated privilege escalation Tyche Softwares Abandoned Cart Pro for WooCommerce ·
    CRITICAL 9.8
  3. CVE-2026-77070
    N8n MongoDB node NoSQL injection lets attackers disclose or delete data n8n-io n8n ·
    • PATCH AVAILABLE
    CRITICAL 9.8
  4. CVE-2026-62834
    Azure Data Factory improper signature verification allows privilege elevation Microsoft Azure Data Factory ·
    • PATCH AVAILABLE
    CRITICAL 9.8
  5. CVE-2026-32558
    Affiliate Pro unauthenticated privilege escalation RedefiningTheWeb Affiliate Pro - Affiliate Program for WooCommerce & WordPress ·
    CRITICAL 9.8
  6. CVE-2026-63073
    OpenSSL CMP format-string denial of service OpenSSL OpenSSL ·
    • PATCH AVAILABLE
    CRITICAL 9.8
  7. CVE-2026-79090
    Chrome improper privilege management lets remote attacker bypass access Google Chrome ·
    • PATCH AVAILABLE
    CRITICAL 9.8
  8. CVE-2026-79152
    Chrome CustomTabs authorization bypass via co-installed app Google Chrome ·
    • PATCH AVAILABLE
    CRITICAL 9.8
  9. CVE-2026-65637
    Apache Tomcat improper input validation allows remote code execution Apache Software Foundation Apache Tomcat ·
    CRITICAL 9.8
  10. CVE-2026-16639
    Internationalization Single Sign-On authentication bypass Drupal Internationalization Single Sign-On ·
    • PATCH AVAILABLE
    CRITICAL 9.8
  11. CVE-2026-16641
    Commerce Elavon input validation flaw allows unauthenticated remote compromise Drupal Commerce Elavon ·
    CRITICAL 9.8
  12. CVE-2026-47890
    Spring Framework SSE stream corruption Spring Spring Framework ·
    CRITICAL 9.8
  13. CVE-2026-47891
    Spring Framework Aalto XML maxInMemorySize bypass Spring Spring Framework ·
    CRITICAL 9.8
  14. CVE-2026-59313
    Spring Framework stream corruption in SSE Spring Spring Framework ·
    CRITICAL 9.8
  15. CVE-2026-19286
    Langflow OSS A2A endpoint remote code execution IBM Langflow OSS ·
    • PoC PUBLIC
    • PATCH AVAILABLE
    CRITICAL 9.8
  16. CVE-2026-84129
    Firefox site-isolation navigation vulnerability allows remote code execution Mozilla Firefox ·
    CRITICAL 9.8
  17. CVE-2026-84135
    Firefox remote code execution via input-validation flaw Mozilla Firefox ·
    CRITICAL 9.8
  18. CVE-2026-84134
    Firefox information disclosure unauthenticated (CWE-200) Mozilla Firefox ·
    CRITICAL 9.8
  19. CVE-2026-84133
    Firefox site isolation bypass in DOM Push Subscriptions component Mozilla Firefox ·
    CRITICAL 9.8
  20. CVE-2026-84142
    Firefox memory corruption pre-auth remote code execution Mozilla Firefox ·
    CRITICAL 9.8
20 CVEs · page 8 of 23