Security Box Score — September 13, 2026

132 CVEs published, led by jaychouchannel (5).

132 CVEs published September 13, 2026: 5 critical, 27 high, 56 medium, 44 low; 0 in the KEV catalog at press time; 3 with a public exploit reference; 0 awaiting enrichment. Elevated volume. 25 rendered as box scores below; the remaining 107 in the results table.

Standings

League
	MTD	YTD	2025 same span	2025 full
CVEs published	5714	40599	—	—
KEV catalog size	1709

Publication counts reflect the record since May 20, 2026 (archive start); KEV figures are catalog-wide.

Prior-year comparisons begin when the archive covers a full year; archive begins May 20, 2026.

2607 disclosures carry no usable vendor attribution (upstream records marked n/a or unknown) and are excluded from the vendor tables. C/H/M/L = YTD disclosures by severity band. KEV = catalog entries all-time / YTD. KEV/100 = KEV additions YTD ÷ CVEs YTD × 100. Med CVSS / Med EPSS = medians over the vendor's YTD disclosures. Δ = this month-to-date minus the same day-span of last month.

Operating Systems & Platforms
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
linux	631	4714	491	2228	706	1	12	3	0.1	7.8	.0016	+215 ▲
microsoft	977	2876	189	1978	693	16	289	30	1.0	7.8	.0044	+538 ▲
google	361	2527	318	973	1110	120	79	8	0.3	7.5	.0025	+312 ▲
red hat	73	698	43	289	329	37	2	0	0.0	6.7	.0028	-58 ▼
apple	0	316	59	85	165	7	88	8	2.5	6.5	.0029	-2 ▼
freebsd	0	48	2	36	7	3	0	0	0.0	7.8	.0016	0
canonical	0	42	13	11	13	5	0	0	0.0	7.8	.0021	-11 ▼
suse	12	40	7	21	11	1	0	0	0.0	7.6	.0037	+7 ▲

Network & Infrastructure
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
cisco	12	96	24	46	26	0	57	14	14.6	7.5	.0041	-19 ▼
ubiquiti	0	59	36	22	1	0	3	3	5.1	9.1	.0049	0
palo alto networks	9	46	1	4	26	15	13	2	4.3	4.7	.0022	-3 ▼
fortinet	10	40	10	10	17	3	29	7	17.5	7.0	.0038	+3 ▲
netgear	2	34	0	0	27	7	0	0	0.0	4.3	.0025	-7 ▼
ivanti	10	24	10	12	2	0	25	5	20.8	8.8	.0146	+7 ▲
f5	7	24	6	14	3	1	4	1	4.2	8.7	.0047	+7 ▲
sonicwall	5	19	7	8	4	0	19	4	21.1	8.3	.0050	-5 ▼

Open Source Ecosystems
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
apache	32	541	117	228	181	13	33	2	0.4	7.5	.0049	-63 ▼
mozilla	35	222	80	79	63	0	9	0	0.0	8.1	.0029	+34 ▲
drupal	26	94	11	9	66	8	4	1	1.1	5.7	.0024	+26 ▲
gitlab	2	78	5	17	47	9	5	3	3.8	5.3	.0029	-11 ▼
github	3	20	1	10	9	0	0	0	0.0	7.3	.0044	-2 ▼
docker	0	9	0	6	3	0	0	0	0.0	7.2	.0016	-1 ▼
wordpress	0	5	1	3	1	0	2	2	40.0	8.8	.3120	-1 ▼
kubernetes	0	1	0	0	0	1	0	0	0.0	2.4	.0035	0

Enterprise Applications
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
oracle	0	2269	484	1170	519	96	28	4	0.2	7.8	.0034	0
adobe	170	776	57	343	366	10	20	4	0.5	7.5	.0023	+110 ▲
ibm	121	740	161	341	229	9	6	1	0.1	7.5	.0030	-53 ▼
progress	3	64	15	39	10	0	6	1	1.6	8.1	.0035	-13 ▼
solarwinds	0	23	17	3	3	0	10	4	17.4	9.1	.0058	0
veeam	0	19	6	10	3	0	1	0	0.0	8.6	.0032	-10 ▼
zohocorp	5	15	3	6	6	0	0	0	0.0	8.4	.0099	+1 ▲
atlassian	0	6	1	5	0	0	13	0	0.0	8.1	.0032	0

Industrial & Embedded
Vendor	MTD	YTD	C	H	M	L	KEV	Med CVSS	Med EPSS	Δ
d-link	8	53	16	19	10	8	3	8.5	.0157	-7 ▼
siemens	14	51	6	33	9	3	0	7.3	.0018	-3 ▼
rockwell automation	18	43	5	32	6	0	0	8.6	.0029	+18 ▲
synology	0	27	3	6	15	3	0	5.6	.0025	-1 ▼
schneider electric	9	18	2	11	5	0	0	8.5	.0040	+9 ▲
hikvision	3	9	0	5	4	0	0	7.1	.0036	+3 ▲
hitachi energy	4	7	0	3	4	0	0	6.9	.0017	+4 ▲
abb	0	7	0	4	3	0	0	7.2	.0018	0

Other
Vendor	MTD	YTD	C	H	M	L	KEV	KEV YTD	KEV/100	Med CVSS	Med EPSS	Δ
dell	134	305	25	140	122	18	2	1	0.3	7.2	.0020	+122 ▲
sourcecodester	30	199	0	0	118	81	0	0	0.0	5.5	.0028	+17 ▲
spring	0	170	12	60	83	15	0	0	0.0	6.5	.0024	0
nvidia	32	166	20	117	29	0	0	0	0.0	7.8	.0029	+16 ▲
mongodb	50	148	4	87	53	4	1	0	0.0	7.1	.0026	+18 ▲
itsourcecode	28	144	0	0	36	108	0	0	0.0	2.1	.0026	+20 ▲
wwbn	89	129	21	43	65	0	0	0	0.0	6.9	.0024	+87 ▲
elastic	42	129	1	27	98	3	1	0	0.0	6.5	.0028	-6 ▼

Leaders (trailing 30 days unless noted)

Highest EPSS
CVE	EPSS	%ile	CVSS
CVE-2026-60004	.8678	99.7	9.8
CVE-2026-64849	.1641	96.8	9.3
CVE-2026-83549	.0851	94.7	7.8
CVE-2026-82329	.0767	94.2	9.8
CVE-2026-19478	.0581	92.7	9.1
CVE-2026-19586	.0570	92.6	9.3
CVE-2026-19490	.0560	92.5	9.3
CVE-2026-79756	.0515	91.9	8.7
CVE-2026-83548	.0467	91.2	10.0
CVE-2026-15748	.0461	91.2	9.8

Highest CVSS
CVE	CVSS	EPSS	Note
CVE-2026-83548	10.0	.0467	KEV
CVE-2026-75650	10.0	.0215	KEV
CVE-2026-86152	10.0	.0186
CVE-2026-76195	10.0	.0159
CVE-2026-76197	10.0	.0159
CVE-2026-69836	10.0	.0155
CVE-2026-82222	10.0	.0155
CVE-2026-82004	10.0	.0144
CVE-2026-85706	10.0	.0116	KEV
CVE-2026-87827	10.0	.0107

Most disclosures (vendor)
Vendor	CVEs
linux	1860
microsoft	1012
oracle	890
google	714
ibm	319
adobe	211
dell	188
red hat	159
splunk	110
wwbn	105

Most KEV additions (YTD)
Vendor	KEV
microsoft	30
cisco	14
apple	8
google	8
fortinet	7
ivanti	5
adobe	4
berriai	4
jfrog	4
oracle	4

Most-affected ecosystems
Ecosystem	Advisories
Maven	46
Packagist	38
npm	19
PyPI	15
RubyGems	2
Go	1
NuGet	1
crates.io	1

Fastest to KEV
CVE	Vendor	Days
CVE-2026-72529	TrueConf	0
CVE-2026-72530	TrueConf	0
CVE-2026-75650	Adobe	0
CVE-2026-83548	SonicWall	0
CVE-2026-83549	SonicWall	0
CVE-2026-85046	Google	0
CVE-2026-87491	Google	0
CVE-2026-64849	mlflow	1
CVE-2026-84869	ConnectWise	2
CVE-2026-86218	N-able	2

Longest unpatched (KEV due date passed)
CVE	Vendor	Due	Days over
CVE-2021-27104	n/a	2021-11-17	1761
CVE-2021-27102	n/a	2021-11-17	1761
CVE-2021-27101	n/a	2021-11-17	1761
CVE-2021-27103	n/a	2021-11-17	1761
CVE-2021-21017	Adobe	2021-11-17	1761
CVE-2021-28550	Adobe	2021-11-17	1761
CVE-2021-42013	Apache Software Foundation	2021-11-17	1761
CVE-2021-41773	Apache Software Foundation	2021-11-17	1761
CVE-2021-30858	Apple	2021-11-17	1761
CVE-2021-30860	Apple	2021-11-17	1761

Transactions

EXPLOIT PUBLISHED — CVE-2026-81578 (PaperCut MF/NG). Public exploit reference added.

EXPLOIT PUBLISHED — CVE-2026-82078 (PaperCut MF/NG). Public exploit reference added.

DUE DATE PASSED — CVE-2025-25249 (Fortinet FortiSwitchManager). CISA remediation deadline was September 12, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-19490 (NetScaler ADC). CISA remediation deadline was September 12, 2026; still in catalog.

DUE DATE PASSED — CVE-2026-20079 (Cisco Secure Firewall Management Center (FMC)). CISA remediation deadline was September 12, 2026; still in catalog.

RESCORED — CVE-2025-25252 (Fortinet FortiOS). CVSS 4.3 → 6.5 (NVD).

RESCORED — CVE-2026-52295 (FFmpeg). CVSS 6.2 → 2.9 (NVD).

RESCORED — CVE-2026-90488 (Xuxueli xxl-job). CVSS 5.3 → 2.1 (NVD).

RESCORED — CVE-2026-90489 (Xuxueli xxl-job). CVSS 5.1 → 2 (NVD).

PATCH SHIPPED — CVE-2025-69130 (Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme). Fixed in Entrepreneur - Booking for Small Businesses WordPress Theme 3.1.5.

PATCH SHIPPED — CVE-2026-18369 (Red Hat Certificate System 10.4 EUS for RHEL-8). Fixed in Red Hat Certificate System 10.4 EUS for RHEL-8 8060020260814202723.07fb4edf.

Yesterday's Results

How to read these box scores · glossary

132 CVEs published. 25 box scores, 107 table rows — nothing truncated.

CVE-2026-81648CRITICAL

Unknown CryptoPayment Gateway — CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  C  H  H  H   10.0      —      —     —

AFFECTED
  Product                Versions  Fixed
  CryptoPayment Gateway  1.2.1 –   —

TIMELINE
  Aug 27  Reserved by CNA
  Sep 13  Published (CNA: WPScan)

CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-90605CRITICAL

Totolink A3002MU boa formFilter buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    9.4      —      —     —

AFFECTED
  Product  Versions             Fixed
  A3002MU  Hh-B20211125.1046 –  —

TIMELINE
  Sep 12  Reserved by CNA
  Sep 13  Published (CNA: VulDB)

CWE-120, CWE-119 · CNA: VulDB · CVSS v4.0 · 6 references

CVE-2026-90606CRITICAL

Totolink A3002MU boa formIpv6Setup buffer overflow

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    9.4      —      —     —

AFFECTED
  Product  Versions             Fixed
  A3002MU  Hh-B20211125.1046 –  —

TIMELINE
  Sep 12  Reserved by CNA
  Sep 13  Published (CNA: VulDB)

CWE-120, CWE-119 · CNA: VulDB · CVSS v4.0 · 6 references

CVE-2026-90561CRITICAL

Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   L   P   H   H   N    9.3      —      —     —

AFFECTED
  Product  Versions  Fixed
  strapi   4.0.0 –   —

TIMELINE
  Sep 12  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-79 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-90562CRITICAL

langbot-app LangBot — LangBot before 4.10.11 Authentication Bypass via Weak Recovery Key

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   H   P   N   N   H   H   H    9.2      —      —     —

AFFECTED
  Product  Versions   Fixed
  LangBot  4.0.8.1 –  —

TIMELINE
  Sep 12  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-331 · CNA: VulnCheck · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-74933HIGH

Unknown GenieWords — GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8      —      —     —

AFFECTED
  Product     Versions  Fixed
  GenieWords  1.5.27 –  —

TIMELINE
  Aug 17  Reserved by CNA
  Sep 13  Published (CNA: WPScan)

CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-85129HIGH

Unknown Hoo Companion — Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8      —      —     —

AFFECTED
  Product        Versions  Fixed
  Hoo Companion  1.0.2 –   —

TIMELINE
  Sep 3   Reserved by CNA
  Sep 13  Published (CNA: WPScan)

CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-88793HIGH

Unknown YouTube Embed — YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8      —      —     —

AFFECTED
  Product        Versions  Fixed
  YouTube Embed  10.0 –    —

TIMELINE
  Sep 10  Reserved by CNA
  Sep 13  Published (CNA: WPScan)

CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-90668HIGH

UnrealIRCd UnrealIRCd — The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request head…

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7      —      —     —

AFFECTED
  Product     Versions  Fixed
  UnrealIRCd  6.0.5 –   —

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: mitre)

CWE-770 · CNA: mitre · CVSS v4.0 · 2 references · NVD status: Received

CVE-2026-90770HIGH

openspug spug — Spug through 3.4.0 Remote Code Execution via ping_check

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   L   N   H   H   H    8.7      —      —     —

AFFECTED
  Product  Versions     Fixed
  spug     unspecified  —

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-78 · CNA: VulnCheck · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-90774HIGH

orhun rustypaste — rustypaste before 0.18.1 Path Traversal via filename header

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   N   H   N    8.7      —      —     —

AFFECTED
  Product     Versions     Fixed
  rustypaste  unspecified  —

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-22 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-90776HIGH

Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7      —      —     —

AFFECTED
  Product     Versions  Fixed
  nodemailer  9.1.0 –   10.0.5

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-407 · CNA: VulnCheck · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-90777HIGH

ESPnet before 202609 Remote Code Execution via Unsafe Deserialization

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   P   H   H   H    8.7      —      —     —

AFFECTED
  Product  Versions     Fixed
  espnet   unspecified  202609

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-502 · CNA: VulnCheck · CVSS v4.0 · 6 references · NVD status: Received

CVE-2026-90778HIGH

SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7      —      —     —

AFFECTED
  Product  Versions     Fixed
  sipp     unspecified  —

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-120 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-90779HIGH

SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7      —      —     —

AFFECTED
  Product  Versions     Fixed
  sipp     unspecified  —

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-121 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-90780HIGH

SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Content

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   N   N   N   N   H    8.7      —      —     —

AFFECTED
  Product  Versions     Fixed
  sipp     unspecified  —

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-120 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-90768HIGH

kevoreilly CAPEv2 — CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   L   N   H   H   N    8.6      —      —     —

AFFECTED
  Product  Versions     Fixed
  CAPEv2   unspecified  —

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-862 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-90493HIGH

Tonec Internet Download Manager Kernel Driver idmwfp.sys access control

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   L   L   N   L   N   H   H   H    8.5      —      —     —

AFFECTED
  Product                    Versions         Fixed
  Internet Download Manager  6.42 Build 63 –  —

TIMELINE
  Sep 12  Reserved by CNA
  Sep 13  Published (CNA: VulDB)

CWE-266, CWE-284 · CNA: VulDB · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-90783HIGH

Moritz Bunkus MKVToolNix — MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   L   L   N   N   P   H   H   H    8.5      —      —     —

AFFECTED
  Product     Versions     Fixed
  MKVToolNix  unspecified  1495126138e086080f0163bee27fafbdf956a1d0

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-680 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-90769HIGH

lfnovo open-notebook — Open Notebook before 1.11.0 Server-Side Request Forgery via link-source

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   L   N   H   N   N    8.3      —      —     —

AFFECTED
  Product        Versions     Fixed
  open-notebook  unspecified  —

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-918 · CNA: VulnCheck · CVSS v4.0 · 5 references · NVD status: Received

CVE-2026-90772HIGH

amundsen-io amundsen-frontend — Amundsen Frontend through 4.3.0 Stored XSS via Description

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS   EPSS   %ile   KEV
   N   L   N   L   P   H   L   N    8.3      —      —     —

AFFECTED
  Product            Versions     Fixed
  amundsen-frontend  unspecified  —

TIMELINE
  Sep 13  Reserved by CNA
  Sep 13  Published (CNA: VulnCheck)

CWE-79 · CNA: VulnCheck · CVSS v4.0 · 4 references · NVD status: Received

CVE-2026-37008HIGH

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a…

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   L   H   N   N  C  H  H  L    8.1      —      —     —

AFFECTED
  Product  Versions     Fixed
  CrewAI   unspecified  —

TIMELINE
  Apr 6   Reserved by CNA
  Sep 13  Published (CNA: mitre)

CWE-424 · CNA: mitre · CVSS v3.1 · 3 references · NVD status: Received

CVE-2026-29811HIGH

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same co…

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   L   N  C  N  H  N    7.7      —      —     —

AFFECTED
  Product     Versions     Fixed
  CyberPanel  unspecified  —

TIMELINE
  Mar 4   Reserved by CNA
  Sep 13  Published (CNA: mitre)

CWE-1025 · CNA: mitre · CVSS v3.1 · 1 reference · NVD status: Received

CVE-2026-15891HIGH

zephyrproject zephyr — NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5      —      —     —

AFFECTED
  Product  Versions  Fixed
  zephyr   4.1.0 –   —

TIMELINE
  Jul 15  Reserved by CNA
  Sep 13  Published (CNA: zephyr)

CWE-476 · CNA: zephyr · CVSS v3.1 · 2 references · NVD status: Received

CVE-2026-86406HIGH

Unknown User Registration & Membership — User Registration & Membership < 5.2.8 - Subscriber+ Privilege Escalation via Membership Purchase

  AV  AC  PR  UI  S  C  I  A   CVSS   EPSS   %ile   KEV
   N   H   L   N  U  H  H  H    7.5      —      —     —

AFFECTED
  Product                         Versions  Fixed
  User Registration & Membership  4.4.6 –   —

TIMELINE
  Sep 7   Reserved by CNA
  Sep 13  Published (CNA: WPScan)

CWE-269 · CNA: WPScan · CVSS v3.1 · 1 reference · NVD status: Received

Remainder (ranked, continued)
CVE	CVSS	EPSS %ile	Vendor	Product	CWE	Title
CVE-2026-88802	7.5	—	Unknown	MDJM Event Management	—	MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary P…
CVE-2026-89080	7.5	—	Unknown	Really Simple Security	CWE-287	Really Simple Security < 9.8.1 - Unauthenticated 2FA Bypass via Email Provide…
CVE-2026-90678	7.5	—	HAProxy	HAProxy	CWE-130	An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 throug…
CVE-2026-36453	7.4	—	Rhymix	Rhymix	CWE-425	Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1.…
CVE-2026-80071	7.2	—	Unknown	User Registration & Membership	CWE-269	User Registration & Membership < 5.2.8 - Author+ Privilege Escalation to Admi…
CVE-2026-90767	7.1	—	froxlor	Froxlor	CWE-93	Froxlor before 2.3.12 SSH Key Injection via authorized_keys
CVE-2026-90775	7.1	—	PostGIS	address_standardizer	CWE-125	PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated…
CVE-2026-90494	6.9	—	restify	node-restify	CWE-22	restify node-restify static.js serveStatic path traversal
CVE-2026-90513	6.9	—	simalexan	api-lambda-send-email-ses	CWE-287	simalexan api-lambda-send-email-ses API Gateway Endpoint template.yml SES.sen…
CVE-2026-90593	6.9	—	n/a	embedded-graphics	CWE-189	embedded-graphics image_raw.rs draw_sub_image integer overflow
CVE-2026-90596	6.9	—	n/a	embedded-graphics	CWE-189	embedded-graphics image_raw.rs new/bytes_per_row integer overflow
CVE-2026-90601	6.9	—	getzep	graphiti	CWE-287	getzep graphiti REST API main.py improper authentication
CVE-2026-90603	6.9	—	Anil-matcha	Open-Generative-AI	CWE-284	Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload
CVE-2022-42917	6.7	—	FRRouting	FRRouting	CWE-367	In FRRouting FRR before 8.5, the service user (usually frr) can escalate its …
CVE-2025-70819	6.3	—	Zettlab	D6 Ultra	CWE-24	Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in …
CVE-2026-90771	6.3	—	hapijs	joi	CWE-1321	joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
CVE-2026-90782	6.0	—	Systerel	S2OPC	CWE-476	S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_it…
CVE-2026-36989	5.8	—	LuxSoft	LuxCal Web Calendar	CWE-89	A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rss…
CVE-2024-53922	5.7	—	Samsung	Exynos 8890 firmware	CWE-1284	An issue was discovered in the buffer queue driver in Samsung Automotive Proc…
CVE-2026-90495	5.5	—	Fengoffice	Feng Office	CWE-74	Fengoffice Feng Office Legacy API CompanyWebsite.class.php instance->findAll …
CVE-2026-90498	5.5	—	lenve	vhr	CWE-1392	lenve vhr vhr.sql default credentials
CVE-2026-90504	5.5	—	vvbbnn00	WARP-Clash-API	CWE-287	vvbbnn00 WARP-Clash-API authorized missing authentication
CVE-2026-90509	5.5	—	dromara	orion-visor	CWE-259	dromara orion-visor ExposeApiAspect.java ExposeApiAspect.beforeExposeApi hard…
CVE-2026-90510	5.5	—	dromara	orion-visor	CWE-320	dromara orion-visor HostKeyServiceImpl.java HostKeyServiceImpl.encryptKey har…
CVE-2026-90514	5.5	—	SourceCodester	School Registration and Fee System	CWE-74	SourceCodester School Registration and Fee System save_stud.php sql injection
CVE-2026-90515	5.5	—	SourceCodester	School Registration and Fee System	CWE-74	SourceCodester School Registration and Fee System delete_stud.php sql injection
CVE-2026-90516	5.5	—	SourceCodester	School Registration and Fee System	CWE-74	SourceCodester School Registration and Fee System pay_report.php sql injection
CVE-2026-90517	5.5	—	PHPGurukul	Bank Locker Management System	CWE-285	PHPGurukul Bank Locker Management System view-assign-locker.php authorization
CVE-2026-90522	5.5	—	jaychouchannel	Tourism-Management-System	CWE-640	jaychouchannel Tourism-Management-System Password Recovery UsersController.ja…
CVE-2026-90523	5.5	—	jaychouchannel	Tourism-Management-System	CWE-266	jaychouchannel Tourism-Management-System User Register Endpoint UsersControll…
CVE-2026-90524	5.5	—	jaychouchannel	Tourism-Management-System	CWE-287	jaychouchannel Tourism-Management-System Update Endpoint missing authentication
CVE-2026-90526	5.5	—	SourceCodester	School Registration and Fee System	CWE-74	SourceCodester School Registration and Fee System save_class.php sql injection
CVE-2026-90565	5.5	—	Rizwan17	inventory-management-system	CWE-266	Rizwan17 inventory-management-system dashboard.php access control
CVE-2026-90566	5.5	—	Rizwan17	inventory-management-system	CWE-266	Rizwan17 inventory-management-system Registration register.php createUserAcco…
CVE-2026-90579	5.5	—	cheshire-cat-ai	Cheshire Cat AI	CWE-287	cheshire-cat-ai Cheshire Cat AI custom_auth_handler.py _authorize_http_key mi…
CVE-2026-90582	5.5	—	evanchiu	serverless-todo	CWE-400	evanchiu serverless-todo API Todo Endpoint index.js saveTodos resource consum…
CVE-2026-90584	5.5	—	TooTallNate	Java-WebSocket	CWE-400	TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuo…
CVE-2025-63842	5.4	—	Repetico	web backend	CWE-79	A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetic…
CVE-2026-88764	5.4	—	Unknown	Simple Membership	CWE-269	Simple Membership < 4.7.8 - Subscriber+ Membership Level Escalation via PayPa…
CVE-2026-15892	5.3	—	zephyrproject	zephyr	CWE-401	Heap memory leak in mcumgr settings-management handlers on access-hook reject…
CVE-2026-77773	5.3	—	Unknown	Contact Form to Chat Apps \| Click to Chat to Order	CWE-200	Social Contact Form (FormyChat) < 2.15.8 - Unauthenticated Gravity Forms Entr…
CVE-2026-88995	5.3	—	Unknown	Bookit — Booking & Appointment Calendar	CWE-200	Bookit < 2.6.0.1 - Unauthenticated Appointment PII Disclosure via Availabilit…
CVE-2026-90527	5.3	—	quequnlong	shiyi-blog	CWE-79	quequnlong shiyi-blog Add Message API index.vue cross site scripting
CVE-2026-90571	5.3	—	Exrick	xmall	CWE-79	Exrick xmall Order Printing order-print.jsp cross site scripting
CVE-2026-90583	5.3	—	kagisearch	smallweb	CWE-79	kagisearch smallweb Query String Rendering sw.py index cross site scripting
CVE-2026-90528	5.1	—	TDuckApp	tduck-platform	CWE-79	TDuckApp tduck-platform Form Write View index.vue cross site scripting
CVE-2026-90529	5.1	—	n/a	DataEase	CWE-79	DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting
CVE-2026-90563	5.1	—	maliangnansheng	bbs-springboot	CWE-79	maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site …
CVE-2026-90564	5.1	—	quequnlong	shiyi-blog	CWE-79	quequnlong shiyi-blog chat sendMsg Endpoint index.vue SysChatMsgMapper.getCha…
CVE-2026-90567	5.1	—	quequnlong	shiyi-blog	CWE-79	quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting
CVE-2026-90568	5.1	—	moxi624	Mogu Blog v2	CWE-79	moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSo…
CVE-2026-90602	5.1	—	Anil-matcha	Open-Generative-AI	CWE-79	Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory…
CVE-2026-90604	5.1	—	Totolink	A3002MU	CWE-79	Totolink A3002MU Anchor Tag cross site scripting
CVE-2020-15875	5.0	—	LibreNMS	LibreNMS	CWE-89	An issue was discovered in LibreNMS 1.65. A remote authenticated attacker wit…
CVE-2026-90569	4.8	—	linlinjava	litemall	CWE-79	linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross…
CVE-2026-90570	4.8	—	linlinjava	litemall	CWE-79	linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross…
CVE-2026-90781	4.8	—	ALSA Project	alsa-lib	CWE-193	alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii…
CVE-2026-80072	4.7	—	Unknown	User Registration & Membership	CWE-601	User Registration & Membership < 5.2.8 - Unauthenticated Open Redirect via Lo…
CVE-2026-29810	4.3	—	CyberPanel	CyberPanel	CWE-390	CyberPanel before 2.4.4 omits a "return 0" that is required by the business l…
CVE-2026-29812	4.3	—	CyberPanel	CyberPanel	CWE-778	CyberPanel before 2.4.4 has no logging for actions that could potentially man…
CVE-2026-89050	4.3	—	Unknown	Quads Ads Manager for Google AdSense	—	Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment…
CVE-2026-90679	4.3	—	Forgejo	Forgejo	CWE-348	Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has…
CVE-2026-88912	4.2	—	Unknown	rtMedia for WordPress, BuddyPress and bbPress	CWE-639	rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrar…
CVE-2026-86407	3.7	—	Unknown	User Registration & Membership	CWE-200	User Registration & Membership < 5.2.8 - Unauthenticated User Data Disclosure…
CVE-2025-70820	3.5	—	Zettlab	D6 Ultra	CWE-36	Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders…
CVE-2026-35867	3.1	—	LB-LINK	AC1900 firmware	CWE-78	A Command Injection vulnerability exists in the bs_SetLimitCli_info function …
CVE-2025-45480	3.0	—	projectfloodlight	Floodlight	CWE-669	Floodlight 71fe8a7 allows disruption of host communication via link spoofing.…
CVE-2026-38332	2.9	—	cdcseacave	TinyEXIF	CWE-125	TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch…
CVE-2026-52296	2.9	—	FFmpeg	FFmpeg	CWE-125	FFmpeg before 9.0 has an out-of-bounds read because of missing required paddi…
CVE-2026-52297	2.9	—	FFmpeg	FFmpeg	CWE-125	FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently p…
CVE-2026-90575	2.9	—	PHPGurukul	Small CRM	CWE-20	PHPGurukul Small CRM Login Success login.php unserialize deserialization
CVE-2026-90773	2.4	—	dalance	procs	CWE-150	procs through 0.14.12 Terminal Escape Sequence Injection via Command
CVE-2026-90490	2.1	—	lenve	vhr	CWE-20	lenve vhr MailReceiver deserialization
CVE-2026-90491	2.1	—	sanjevirau	gsubs	CWE-74	sanjevirau gsubs Electron index.js showQuerySuccessPage code injection
CVE-2026-90492	2.1	—	webgjc	web_robot	CWE-77	webgjc web_robot web.py controller_recover os command injection
CVE-2026-90499	2.1	—	lenve	vhr	CWE-266	lenve vhr Password Update pass HrInfoController.updatePass improper authoriza…
CVE-2026-90500	2.1	—	lenve	vhr	CWE-284	lenve vhr Avatar Upload userface FastDFSUtils.upload unrestricted upload
CVE-2026-90501	2.1	—	lenve	vhr	CWE-266	lenve vhr HrMapper.xml HrInfoController.updateHr privileges management
CVE-2026-90507	2.1	—	vvbbnn00	WARP-Clash-API	CWE-266	vvbbnn00 WARP-Clash-API Subscription subscription.py get_surge_subscription a…
CVE-2026-90511	2.1	—	GongShengyue	OnlineBooks	CWE-74	GongShengyue OnlineBooks listSplit BooksServlet.java sql injection
CVE-2026-90518	2.1	—	PHPGurukul	Bank Locker Management System	CWE-266	PHPGurukul Bank Locker Management System sidebar.php access control
CVE-2026-90519	2.1	—	PHPGurukul	Bank Locker Management System	CWE-284	PHPGurukul Bank Locker Management System add-locker-form.php unrestricted upload
CVE-2026-90520	2.1	—	jaychouchannel	Tourism-Management-System	CWE-266	jaychouchannel Tourism-Management-System Authorization Interceptor Authorizat…
CVE-2026-90521	2.1	—	jaychouchannel	Tourism-Management-System	CWE-285	jaychouchannel Tourism-Management-System CRUD MenpiaodingdanController.java a…
CVE-2026-90525	2.1	—	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System cust_pos_trans.php sql injection
CVE-2026-90574	2.1	—	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System emp_transac.php add sql injection
CVE-2026-90580	2.1	—	FlowiseAI	Flowise	CWE-918	FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side reques…
CVE-2026-90581	2.1	—	cym1102	nginxWebUI	CWE-74	cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection
CVE-2026-90594	2.1	—	wxiaoqi	Spring-Cloud-Platform	CWE-862	wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java Permi…
CVE-2026-90595	2.1	—	wxiaoqi	Spring-Cloud-Platform	CWE-862	wxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlin…
CVE-2026-90597	2.1	—	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System sup_edit1.php sql injection
CVE-2026-90598	2.1	—	jaygajera17	E-commerce-project-springBoot	CWE-285	jaygajera17 E-commerce-project-springBoot UserController.java UserController.…
CVE-2026-90599	2.1	—	Rizwan17	inventory-management-system	CWE-352	Rizwan17 inventory-management-system process.php cross-site request forgery
CVE-2026-90600	2.1	—	itsourcecode	Sales and Inventory System	CWE-74	itsourcecode Sales and Inventory System inv_edit1.php sql injection
CVE-2026-90496	2.0	—	Fengoffice	Feng Office	CWE-74	Fengoffice Feng Office Reorder Handlers MoreController.class.php update_dimen…
CVE-2026-90497	2.0	—	Fengoffice	Feng Office	CWE-79	Fengoffice Feng Office Task Title Output add_task.php getTitle cross site scr…
CVE-2026-90502	2.0	—	stilleshan	ServerStatus	CWE-79	stilleshan ServerStatus Stats Generation main.cpp cross site scripting
CVE-2026-90572	2.0	—	davenardella	snap7	CWE-119	davenardella snap7 s7_micro_client.cpp opUpload memory corruption
CVE-2026-90573	1.9	—	n/a	GPAC	CWE-404	GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereference
CVE-2026-90576	1.9	—	n/a	GPAC	CWE-404	GPAC MP4Box base_scenegraph.c gf_node_list_add_child null pointer dereference
CVE-2026-90577	1.9	—	n/a	GPAC	CWE-119	GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow
CVE-2026-90578	1.9	—	n/a	GPAC	CWE-119	GPAC MP4Box list.c gf_list_count use after free
CVE-2025-64059	1.8	—	getgrav	Grav	CWE-79	Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOT…
CVE-2026-90503	1.8	—	Chengdu Qilu Technology	Ludashi	CWE-200	Chengdu Qilu Technology Ludashi ComputerZ_x64.sys sub_11008 information discl…
CVE-2026-90508	1.8	—	Chengdu Qilu Technology	Ludashi	CWE-862	Chengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageN…
CVE-2026-90505	1.3	—	vvbbnn00	WARP-Clash-API	CWE-362	vvbbnn00 WARP-Clash-API doUpdateLicenseKey race condition
CVE-2026-90506	1.3	—	vvbbnn00	WARP-Clash-API	CWE-362	vvbbnn00 WARP-Clash-API Save Account Job race condition

Methodology

Ranking. Sort: (1) KEV membership, descending. (2) EPSS score, descending. (3) CVSS base score, descending. (4) CVE ID, ascending. CVEs lacking EPSS or CVSS data sort below those that have it within their KEV tier and are labeled AWAITING ENRICHMENT. Missing scores are never imputed.

Standings. Vendor tables exclude records whose vendor field is a placeholder (n/a, unknown); the excluded count is stated under the standings. Rate stats are arithmetic over published figures: KEV/100 = KEV additions YTD ÷ CVEs YTD × 100; Med CVSS and Med EPSS are medians over the vendor's year-to-date disclosures.

Day boundary. A day is a UTC calendar day. This page covers 2026-09-13 00:00:00–23:59:59 UTC. All times shown are UTC.

Feed status for this edition. cvelist: ok · kev: ok · epss: ok · nvd: ok.

Sources. CVE records from the CVE Program (cvelistV5). Enrichment from the National Vulnerability Database (NIST). Known-exploited status from the CISA KEV catalog. Exploit probability from FIRST EPSS. Open-source advisories from OSV.dev. This page reports the public record; it does not analyze, rank by opinion, or editorialize. See full methodology.

Machine-readable. This edition as JSON or CSV — the ranked results, transactions, and counts, for citation or ingestion. Frozen at publication; later changes appear as transactions on later editions.