CVEs published in September 2026

CVE-2026-82232Critical

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope

CVE-2026-86460Critical

Apache Syncope: Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions

CVE-2026-87779High

Insertion of sensitive information into log file vulnerability in Apache Syncope

CVE-2026-87785Critical

Authentication bypass by spoofing vulnerability in Apache Syncope

CVE-2026-87802Critical

Improper verification of cryptographic signature vulnerability in Apache Syncope

CVE-2026-68570Medium

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not authorized to read, resulting in unauthorized disclosure of information

CVE-2026-72524High

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they are not authorized to

CVE-2026-85706CriticalCISA KEV

GitLab Community Edition and Enterprise Edition Path Traversal Vulnerability

CVE-2026-87719Critical

GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup

CVE-2026-89712Critical

restart ssc_expire_umount walk after dropping nfsd_ssc_lock

CVE-2026-89674Critical

fix XDR length calculation in nfsd4_ff_encode_layoutget

CVE-2026-89669Critical

initialize copy-notify stateid before publishing it

CVE-2026-89662Critical

Prevent lock owner use-after-free during client teardown

CVE-2026-82617Critical

Apache OpenNLP: The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT_REGEX_NAME_FINDER.URL - contain ambiguous nested quantifiers

CVE-2026-67211High

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 (The opennlp-spellcheck extension was introduced in 3.0.0-M4

CVE-2026-68497High

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing

CVE-2024-27012High

Linux Kernel Vulnerability in NetApp Products

CVE-2026-80354High

Authorization bypass through User-Controlled key vulnerability in Apache Camel K

CVE-2026-80351Critical

Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K

CVE-2026-80352Critical

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K

CVE-2026-84939Critical

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled (it's by default enabled)

CVE-2026-49362High

artemis core protocol permits unauthed queue creation

CVE-2026-49363High

Pre-auth topology disclosure via CORE SUBSCRIBE_TOPOLOGY_V2 on channel0

CVE-2026-49364Critical

artemis cluster password leak via jgroups spoof

CVE-2026-57822Medium

Unsafe deserialization via JsonUtil CompositeData on management address

CVE-2026-57967Critical

Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment

CVE-2026-67593Critical

pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo

CVE-2026-75880Medium

Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service

CVE-2026-73789Medium

Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface

CVE-2026-73788Medium

ClearPass: vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privileges on a vulnerable ClearPass OnGuard deployment

CVE-2026-73787High

Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface

CVE-2026-73786High

Unauthenticated Network-Based Denial of Service in CPPM systems

CVE-2026-73769High

Authenticated Remote Code Execution in CPPM Web Interface

CVE-2026-84350High

CVE-2026-84348High

CVE-2026-79293High

CVE-2026-79290High

CVE-2026-79286High

CVE-2026-79282High

CVE-2026-79195High

CVE-2026-79118High

CVE-2026-79032High

CVE-2026-79016High

CVE-2026-76460CriticalCISA KEV

Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability

CVE-2026-76428Critical

CVE-2026-76427Critical

CVE-2026-76426Critical

CVE-2026-76425Critical

CVE-2026-76424Critical

CVE-2026-76423Critical

CVE-2026-76046High

CVE-2026-76022High

CVE-2026-20352High

Cisco Identity Services Engine RADIUS Denial of Service Vulnerability

CVE-2026-20307Critical

CVE-2026-20306Critical

CVE-2026-20305Critical

CVE-2026-20300High

CVE-2026-20287Critical

CVE-2026-20284Critical

CVE-2026-20283Critical

CVE-2026-20282Critical

CVE-2026-20247High

CVE-2026-20237Critical

CVE-2026-20234Critical

CVE-2026-20211Critical

CVE-2026-20194Critical

CVE-2026-20192Critical

CVE-2026-20176Critical

CVE-2026-20130Critical

CVE-2026-0310Critical

PAN-OS: Buffer Overflow Vulnerability via XML Processing

CVE-2026-0309High

PAN-OS: Authenticated Command Injection in CLI with Luna HSM Configuration

CVE-2026-0308Medium

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface

CVE-2026-0307High

GlobalProtect App: Local Privilege Escalation Vulnerabilities

CVE-2026-0306High

Prisma Access Agent: EndPoint DLP Bypass Vulnerability on Windows

CVE-2026-0305Medium

Prisma Access Agent: Information Disclosure Vulnerability on Linux

CVE-2026-0304High

Cortex XDR Broker VM: Privilege Escalation Vulnerability

CVE-2026-0303Medium

Checkov by Prisma Cloud: Code Execution via Auto-Loaded Configuration File

CVE-2026-0302Medium

Checkov by Prisma Cloud: OS Command Injection Vulnerability

CVE-2026-85103Critical

heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems

CVE-2026-85102CriticalCISA KEV

Check Point Multiple Products Improper Certificate Validation Vulnerability

CVE-2026-74761High

Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms

CVE-2026-73334High

Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18

CVE-2026-41871Critical

Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API)

CVE-2026-41869Critical

Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API)

CVE-2026-41870High

Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API)

CVE-2026-65181High

Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with privileges to upload a file to remote storage and create a table to execute arbitrary Java code

CVE-2026-57866High

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x

CVE-2026-56207Critical

Apache Impala: Signature of Bearer token is not verified in last step of SAML2 authentication for Impala's hs2-http interface, allowing altering user name and acting as another user

CVE-2026-54048Medium

Specifying tblproperties('avro.schema.url'=' http://...') or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages

CVE-2026-87602High

ANGLE in Google Chrome: Information disclosure via crafted HTML page

CVE-2026-87619High

Observable discrepancy in Prefetch

CVE-2026-87598High

Incorrect authorization in ServiceWorker

CVE-2026-87626High

Incorrect authorization in DeviceBoundSessionCredentials

CVE-2026-87566High

Observable discrepancy in Layout

CVE-2026-87528Critical

Type confusion in Rust

CVE-2026-87637Critical

Use after free in Extensions

CVE-2026-87586High

ANGLE in Google Chrome: Information disclosure via crafted HTML page

CVE-2026-87470Critical

Improper quantity validation in Tint

CVE-2026-87468High

Incorrect authorization in Isolated

CVE-2026-87635High

UI misrepresentation in Payments