boxscore/security

A daily page of record for published software vulnerabilities — the previous UTC day, closed and final. New here?

Wednesday, September 23, 2026 · all times UTC← 2026-09-22 · archive

Security Box Score — September 23, 2026 — page 2

Edition of September 23, 2026, continued — page 2 of 2. Back to page 1

Results (continued, ranked) — ranks 401–472 of 472
CVECVSSEPSS %ileVendorProductCWETitle
CVE-2026-888315.3—Red HatRed Hat Hardened ImagesCWE-636Busybox: busybox: httpd silently fails open when ip deny rules contain invali…
CVE-2026-888405.3—Red HatRed Hat Hardened ImagesCWE-125Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing tr…
CVE-2026-909005.3—joomshaper.comEasy Store extension for JoomlaCWE-352Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storef…
CVE-2026-909505.3—UnknownPaid Membership SubscriptionsCWE-693Paid Member Subscriptions < 3.1.0 - Unauthenticated reCAPTCHA Bypass via Regi…
CVE-2026-924195.3—WEBCONWEBCON BPSCWE-639IDOR in WEBCON BPS
CVE-2026-934215.3—mesop-devmesopCWE-117Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint
CVE-2026-936235.3—Jordy MeowAI EngineCWE-639WordPress AI Engine plugin <= 3.7.8 - Insecure Direct Object References (IDOR…
CVE-2026-940795.3—WP User ManagerWP User ManagerCWE-862WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability
CVE-2026-940805.3—WebWizardsMarketKingCWE-862WordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability
CVE-2026-955145.3—netgsmNetgsmCWE-289WordPress Netgsm plugin <= 2.10.0 - Bypass Vulnerability vulnerability
CVE-2026-955245.3—weDevsWP User FrontendCWE-290WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability
CVE-2026-955925.3—Oleh RadiusThemeTeamCWE-639WordPress Team plugin <= 6.0.0 - Insecure Direct Object References (IDOR) vul…
CVE-2026-956005.3—TrustedLoginTrustedLogin ConnectorCWE-497WordPress TrustedLogin Connector plugin <= 2.0.3 - Sensitive Data Exposure vu…
CVE-2026-966525.3—PlexMedia ServerCWE-918Plex Media Server SSRF
CVE-2026-966555.3—PlexMedia ServerCWE-918Plex Media Server arbitrary-host SSRF
CVE-2026-966725.3—FrappeERPNextCWE-470Frappe ERPNext before 16.34.1 Unauthorized Method Invocation
CVE-2026-967395.3—n/aSEMCMSCWE-79SEMCMS KindEditor Upload upload_json.php cross site scripting
CVE-2026-714585.0—Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8CWE-204Automation-controller: automation-controller-container: automation-controller…
CVE-2026-714595.0—Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8CWE-862Automation-controller: automation-controller-container: automation-controller…
CVE-2026-630014.8—redaxocoreCWE-79REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
CVE-2026-630024.8—redaxocoreCWE-79REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
CVE-2026-866044.8—UnknownGTranslateCWE-74GTranslate < 5.0.1 - Unauthenticated Arbitrary Shortcode Execution via Email …
CVE-2026-944574.8—WebFactoryCaptcha CodeCWE-290WordPress Captcha Code plugin <= 3.32 - Bypass Vulnerability vulnerability
CVE-2026-966744.8—ALSA Projectalsa-libCWE-190alsa-lib through 1.2.16.1 Integer Overflow via Topology File
CVE-2026-966754.8—ALSA Projectalsa-libCWE-129alsa-lib through 1.2.16.1 Denial of Service via pcm_multi
CVE-2026-190874.4—IBMFinancial Transaction Manager (FTM) for RedHat OpenShiftCWE-250IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
CVE-2026-965454.4—Red HatRed Hat Enterprise Linux 10CWE-125Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader
CVE-2026-63274.3—IBMConcertCWE-117Multiple Vulnerabilities in IBM Concert Software
CVE-2026-556324.3—gocdgocdCWE-863GoCD is vulnerable to authorization bypass via pipeline structure API
CVE-2026-618344.3—thomaspoignantscim-patchCWE-915scim-patch: Mutation of Inherited Built-in Method Objects
CVE-2026-629984.3—redaxocoreCWE-20REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column…
CVE-2026-714604.3—Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8CWE-862Automation-controller: automation-controller-container: automation-controller…
CVE-2026-714614.3—Red HatRed Hat Ansible Automation Platform 2.7CWE-209Automation-controller: automation-controller-container: automation-controller…
CVE-2026-847184.3—Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8CWE-348Automation-controller: automation-controller: client ip spoofing in audit/acc…
CVE-2026-925294.3—GitLabGitLabCWE-863Incorrect Authorization in GitLab
CVE-2026-925304.3—GitLabGitLabCWE-348Use of Less Trusted Source in GitLab
CVE-2026-935134.3—SiteSkiteSiteSkiteCWE-639WordPress SiteSkite plugin <= 2.1.7 - Insecure Direct Object References (IDOR…
CVE-2026-964464.2—Red HatRed Hat Build of KeycloakCWE-862Keycloak-services: keycloak-services: par single-use bypass via prompt=none s…
CVE-2026-714624.1—Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8CWE-204Automation-controller: automation-controller-container: automation-controller…
CVE-2026-968074.0—FlatpakFlatpakCWE-61In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$a…
CVE-2026-711783.7—DellSecure Connect Gateway (SCG) Policy ManagerCWE-647Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.1…
CVE-2026-777563.7—Apache Software FoundationApache TomcatCWE-444Apache Tomcat: Transfer-Encoding honored for HTTP/1.0 requests
CVE-2026-878483.7—UnknownMPCX LightboxCWE-862MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure
CVE-2026-714643.1—Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8CWE-88Automation-controller: automation-controller-container: automation-controller…
CVE-2026-714653.1—Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8CWE-88Automation-controller: automation-controller-container: automation-controller…
CVE-2026-926283.1—GitLabGitLabCWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Ra…
CVE-2026-965482.9—sfturinghosp_orderCWE-259sfturing hosp_order jdbc.properties hard-coded credentials
CVE-2026-965502.9—sfturinghosp_orderCWE-310sfturing hosp_order MailUtil.java getProperties cleartext transmission
CVE-2026-968722.9—The Wikimedia FoundationMediawiki - WikiLambda ExtensionCWE-280WikiLambda public function execution bypasses the unsaved-code permission thr…
CVE-2026-49212.7—IBMGuardium Data ProtectionCWE-209IBM Guardium Data Protection is affected by multiple vulnerabilities.
CVE-2026-714632.7—Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 8CWE-209Automation-controller: automation-controller-container: automation-controller…
CVE-2026-965462.5—Red HatRed Hat Enterprise Linux 10CWE-125Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader
CVE-2026-772852.4—openbaoopenbaoCWE-532OpenBao Agent Writes Secrets to Stdout
CVE-2026-660692.3—rabbitmqrabbitmq-serverCWE-862RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics
CVE-2026-660752.3—rabbitmqrabbitmq-serverCWE-862RabbitMQ: Monitoring-tag user can restart federation links
CVE-2026-660762.3—rabbitmqrabbitmq-serverCWE-862RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure
CVE-2026-672402.3—rabbitmqrabbitmq-serverCWE-1333RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard
CVE-2026-782532.3—qtqtCWE-674Denial-of-service (stack-exhaustion) vulnerability in QXmlStreamReader::readE…
CVE-2026-672182.1—rabbitmqrabbitmq-serverCWE-862RabbitMQ: Super-stream HTTP creation skips configure-permission check
CVE-2026-672242.1—rabbitmqrabbitmq-serverCWE-22RabbitMQ: Admin path-traversal write via trace name
CVE-2026-965512.1—sfturinghosp_orderCWE-352sfturing hosp_order CommonUserController.java cross-site request forgery
CVE-2026-966762.1—FastFAC1900RCWE-119Fast FAC1900R uhttpd get_alias_name stack-based overflow
CVE-2026-966782.1—weiqingwenspring-boot-forumCWE-22weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate…
CVE-2026-966802.1—ByteDanceCoze Scraper ExtensionCWE-862ByteDance Coze Scraper Extension External Message index.js chrome.runtime.onM…
CVE-2026-965491.9—sfturinghosp_orderCWE-310sfturing hosp_order CommonUserServiceImpl.java cleartext storage
CVE-2026-965521.3—sfturinghosp_orderCWE-325sfturing hosp_order User Password MD5.java MD5.getMD5 hash without salt
CVE-2026-82356await—ImprivataImprivata Enterprise Access Management—Imprivata EAM: Unrotatable X.509 RSA Key Pair in Production
CVE-2026-86867await—Cinnamon AIKotaemon—Cinnamon's kotaemon contains improper authorization checks in multi‑user chat…
CVE-2026-86926await—ClarisFileMaker Server—A heap buffer overflow vulnerability in the FileMaker Server database engine …
CVE-2026-86930await—ClarisFileMaker Server—An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an …
CVE-2026-86934await—ClarisFileMaker Server—An authorization bypass vulnerability in the FileMaker Server Web Publishing …
CVE-2026-86938await—ClarisFileMaker Pro—A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allo…