CVEs published in September 2026

CVE-2026-76703Medium

EdgeConnect: buffer overflow vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways that could allow an authenticated attacker with administrative access to cause a denial of service

CVE-2026-76702Medium

EdgeConnect: vulnerability in the operating system of HPE Networking EdgeConnect SD-WAN Gateways could allow an authenticated local attacker to cause a denial-of-service

CVE-2026-76701Medium

EdgeConnect: vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive information

CVE-2026-76700Medium

EdgeConnect: Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service

CVE-2026-76699Medium

EdgeConnect: buffer overflow vulnerability exists in a system service within the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to cause a denial-of-service

CVE-2026-76698Medium

EdgeConnect: command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways

CVE-2026-76697Medium

EdgeConnect: vulnerability in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways could allow a remote attacker authenticated with low privileges to access sensitive information

CVE-2026-76696Medium

EdgeConnect: vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct a denial of service attack

CVE-2026-76695Medium

EdgeConnect: Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to send specially crafted packets to the affected service

CVE-2026-76694Medium

EdgeConnect: privilege escalation vulnerability exists in the command line interface of HPE Networking EdgeConnect SD-WAN Gateways

CVE-2026-76693High

EdgeConnect: vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service against certain services running on impacted Gateways

CVE-2026-76692High

EdgeConnect: vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to obtain limited information from memory and disrupt the normal operation of the affected service

CVE-2026-76691High

EdgeConnect: Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways

CVE-2026-76690High

EdgeConnect: vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution

CVE-2026-76689High

Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

CVE-2026-76688High

EdgeConnect: Vulnerabilities have been identified in the web-based management interface of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls

CVE-2026-76687High

EdgeConnect: vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate privileges

CVE-2026-76686High

EdgeConnect: vulnerability exists in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways

CVE-2026-76685High

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

CVE-2026-76684High

EdgeConnect: Vulnerabilities have been identified in the API of HPE Networking EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls

CVE-2026-76683High

EdgeConnect: Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met

CVE-2026-76682High

Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways

CVE-2026-76681High

EdgeConnect: vulnerability in the API of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker with low privileges to access sensitive information beyond what is authorized by the user's existing privilege level

CVE-2026-76680High

EdgeConnect: Vulnerabilities in the API of EdgeConnect SD-WAN Orchestrator could allow a remote attacker authenticated with low privileges to conduct server-side request forgery (SSRF) attacks

CVE-2026-76679High

EdgeConnect: Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to conduct denial-of-service attacks

CVE-2026-76678High

EdgeConnect: vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges

CVE-2026-76677High

EdgeConnect: privilege escalation vulnerability exists in the API of EdgeConnect SD-WAN Gateways

CVE-2026-76676High

EdgeConnect: Buffer overflow vulnerabilities exist in the underlying operating system of EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to execute arbitrary code if certain preconditions outside of the attacker's control are met

CVE-2026-76675Critical

EdgeConnect: command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways

CVE-2026-76674Critical

EdgeConnect: Buffer overflow vulnerabilities exist in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to execute arbitrary code

CVE-2026-76673Critical

EdgeConnect: Vulnerabilities have been identified in the API of EdgeConnect SD-WAN Orchestrator that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls

CVE-2026-76672Critical

Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator

CVE-2026-76670Critical

EdgeConnect: Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator

CVE-2026-76669Critical

EdgeConnect: Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator

CVE-2026-12910Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to bypass SAML SSO sign-in restrictions and authenticate without SSO due to missing authentication enforcement checks

CVE-2026-13210High

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user to access CI/CD variables outside their intended environment scope due to improper input validation in the environment scope pattern matcher

CVE-2026-82837Medium

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that certain conditions could have allowed an authenticated user to access sensitive credentials and tokens without transiting the expected proxy due to improper authorization checks on internal data emission endpoints

CVE-2026-88765High

GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under certain conditions could allow an authenticated user to achieve remote code execution by importing a specially crafted Git project export to overflow the Unicode conversion buffer used in Advanced Search indexing

CVE-2026-21588High

This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center

CVE-2026-21587High

Confluence: This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center

CVE-2026-21586High

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center

CVE-2026-90439Medium

NGINX ngx_http_v3_module: Denial of Service via TLS handshake heap buffer overflow

CVE-2026-77179Critical

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path

CVE-2026-59887High

DoS (Denial of Service) linkify-it Dependency in Jira Service Management Data Center

CVE-2026-59880High

DoS (Denial of Service) immutable.js Dependency in Confluence Data Center

CVE-2026-59879High

DoS (Denial of Service) immutable Dependency in Confluence Data Center

CVE-2026-59642High

BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Confluence Data Center

CVE-2026-59639High

BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Confluence Data Center

CVE-2026-58060High

RCE (Remote Code Execution) org.bouncycastle:bcprov-lts8on Dependency in Confluence Data Center

CVE-2026-58059High

DoS (Denial of Service) Bouncy Castle Dependency in Confluence Data Center

CVE-2026-47762High

DOM-based XSS tinymce Dependency in Jira Software Data Center

CVE-2026-47761High

DOM-based XSS tinymce Dependency in Jira Software Data Center

CVE-2026-47759High

DOM-based XSS tinymce Dependency in Jira Software Data Center

CVE-2026-44728High

RCE (Remote Code Execution) @babel/plugin-transform-modules-systemjs Dependency in Jira Software Data Center

CVE-2026-16221High

Injection fast-uri Dependency in Jira Software Data Center

CVE-2026-13506High

DoS (Denial of Service) Bouncy Castle Dependency in Confluence Data Center

CVE-2026-12816High

BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Confluence Data Center

CVE-2026-12803High

BASM (Broken Authentication & Session Management) Bouncy Castle Dependency in Confluence Data Center

CVE-2022-46175High

Injection json5 Dependency in Jira Software Data Center

CVE-2026-89021Medium

MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths

CVE-2026-89020High

MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's TFTP RRQ builder function that allows authenticated users to crash the mtget worker process by supplying a URL path of 507 bytes or more to the /tool fetch command; the first write outside the 528-byte buffer occurs at 505 bytes

CVE-2026-84445High

Denial of Service via malformed RPC requests

CVE-2026-76461CriticalCISA KEV

Cisco Secure Email Gateway SQL Injection Vulnerability

CVE-2026-76443Critical

CVE-2026-76442Critical

CVE-2026-76441Critical

CVE-2026-76440Critical

CVE-2026-20353Critical

CVE-2026-82427High

Apache Storm: Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervisor localises

CVE-2026-82428High

Apache Storm: Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate, for example `dep---.jar`

CVE-2026-82429High

Apache Storm: Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS and calling `lchown` and `chmod` on each entry's full pathname while running with an effective uid of 0

CVE-2026-82430High

Apache Storm: Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory to the untrusted topology user, and only afterwards reads and acts on the command file that the supervisor wrote into that same directory

CVE-2026-82431Critical

Apache Storm: Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.groups` was considered

CVE-2026-82433Medium

Apache Storm: Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check

CVE-2026-82432High

Apache Storm: Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only

CVE-2026-82434Critical

Apache Storm: Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology configuration, because workers need it

CVE-2026-82435Critical

Apache Storm: Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames before any authentication has taken place

CVE-2026-82437Medium

Apache Storm: Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content

CVE-2026-82426Medium

Apache Storm PMC: Description Nimbus accepted the `uploadedJarLocation` argument of `submitTopology` / `submitTopologyWithOpts` as a server-side path and opened it directly, without checking that it referred to a file the caller had actually uploaded

CVE-2026-82438High

Apache Storm: Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user

CVE-2026-82439Critical

Apache Storm: Description The DRPC server kept a map from function name to request queue and created an entry the first time a function name was seen

CVE-2026-82441Critical

A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading the corresponding blobs

CVE-2026-84179Medium

Apache Security Team: Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field of TopologyPageInfo

CVE-2026-73191Medium

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope

CVE-2026-73195High

Improper Encoding or Escaping of Output vulnerability in Apache Syncope

CVE-2026-73236High

Incorrect Authorization vulnerability in Apache Syncope

CVE-2026-73370Critical

Incorrect Authorization vulnerability in Apache Syncope

CVE-2026-73178High

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope

CVE-2026-73470Critical

Improper Privilege Management vulnerability in Apache Syncope

CVE-2026-73579Critical

Incorrect Authorization vulnerability in Apache Syncope

CVE-2026-75015Medium

Insufficiently Protected Credentials vulnerability in Apache Syncope

CVE-2026-75030Critical

Missing Authorization vulnerability in Apache Syncope

CVE-2026-77051Critical

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope

CVE-2026-73668Critical

Incorrect Authorization vulnerability in Apache Syncope

CVE-2026-77147Medium

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope

CVE-2026-77181Critical

Incorrect Authorization vulnerability in Apache Syncope

CVE-2026-77883Medium

Exposure of sensitive information through data queries vulnerability in Apache Syncope

CVE-2026-78318Medium

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope

CVE-2026-78330Critical

Incorrect privilege assignment vulnerability in Apache Syncope

CVE-2026-78336High

Insertion of sensitive information into sent data vulnerability in Apache Syncope