VulnCheck KEV: CVE-2026-42018

JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources...

PT-2026-89370

Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS : ImageMagick vulnerabilities (USN-8739-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8739-1 advisory. It was discovered that ImageMagick incorrectly handled certain images. An attacker could...

PT-2026-89441

Unauthenticated Broken Authentication in WP Travel = 12.0.3 versions...

PT-2026-89425

Unauthenticated Content Injection in Simple Cloudflare Turnstile = 1.42.1 versions...

PT-2026-89422

Yappp new one for this month 1-3 for September CVE-2026-87807. A good starting point for September. Updates for August 3/4 pulled another one CVE-2026-85715...

PT-2026-89433

Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce = 1.2.2 versions...

PT-2026-89461

🚨 CVE-2026-4130 There is a storage of sensitive information in cleartext vulnerability in NI SystemLink. This vulnerability may allow an attacker with local access to obtain sensitive information stored by the system in the clear. This vulnerability affects NI SystemLink and NI SystemLink Server...

PT-2026-89432

Unauthenticated Broken Access Control in BuddyForms = 2.9.0 versions...

Security Updates for Microsoft Outlook Products C2R (September 2026)

The Microsoft Outlook Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. CVE-2026-69629 - Use of uninitialized resource in Microsoft...

CVE-2026-88069

creationtimestamp| type| source ---|---|--- 2026-09-09 23:20:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4ofosx6i2t 2026-09-10 01:30:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/117244154620572346 2026-09-10 01:30:27+00:00| seen|...

CVE-2026-75712

creationtimestamp| type| source ---|---|--- 2026-09-09 23:17:49+00:00| seen| https://bsky.app/profile/experiencedigest.bsky.social/post/3mv4obnjb372w...

CVE-2026-87930

creationtimestamp| type| source ---|---|--- 2026-09-09 23:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mv4nbz4sft24 2026-09-17 22:00:04+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102612 2026-09-18 00:00:05+00:00| published-proof-of-concept|...

lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href

A flaw was found in lxml, a library for processing XML and HTML in Python. The lxml.html.defs.linkattrs were missing xlink:href, which could allow an attacker to bypass URL filtering mechanisms. This vulnerability enables URL bypass attacks in embedded content such as Scalable Vector Graphics SVG...

CVE-2026-87017 Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.1, the built-in knowledge search tool passed the caller's readable knowledge identifiers through a metadata filter, but the search methods in eleven shipped vector backends ignored that...

CVE-2026-50024

creationtimestamp| type| source ---|---|--- 2026-09-09 20:35:05+00:00| published-proof-of-concept| https://github.com/WangYihang/GitHacker/security/advisories/GHSA-hr3m-4qwq-3mgc...

Updated thunderbird packages fix security vulnerabilities

Uninitialized memory in MIME parsing. CVE-2026-84639 One byte overflow read in mail parser. CVE-2026-84640 Information disclosure due to malicious IMAP server response. CVE-2026-84641 Calendar invitation attachments could launch local executables. CVE-2026-84637 Allowed UNC hostnames for...

CVE-2026-18147

creationtimestamp| type| source ---|---|--- 2026-09-09 17:30:50+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gvpjw73fbh6bz 2026-09-09 20:59:01+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mv4gji5m542r...

CVE-2026-80924

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfreesensitive for derived key buffers cryptokrb5prepareencryption and cryptokrb5preparechecksum free the buffer holding the freshly derived keys with plain kfree, leaving the key material behind in the freed...

CVE-2026-80924 crypto: krb5 - use kfree_sensitive() for derived key buffers

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfreesensitive for derived key buffers cryptokrb5prepareencryption and cryptokrb5preparechecksum free the buffer holding the freshly derived keys with plain kfree, leaving the key material behind in the freed...