Get alerted about vulnerabilities that affect your stack.
Sign up free to get alerts when software you use is affected.
CVE Vulnerabilities - 22 September 2026
RSS4 vulnerabilities published on 22 September 2026
Arista VeloCloud Orchestrator on-prem allows remote attackers to gain control
CVE-2026-93952
The on‑premises VeloCloud Orchestrator from Arista does not properly check some input it receives. An attacker on the network could trick it into running privileged functions, potentially viewing, cha...
9.5
KEV
F5 BIG‑IP APM may allow remote code execution
CVE-2026-94127
The BIG‑IP Access Policy Manager component can be tricked into running unwanted code when an access policy and an OAuth profile are set on a virtual server. An attacker who can reach the server could ...
9.3
KEV
Check Point servers let attackers upload and run scripts
CVE-2026-93616
The Security Management Server, Multi‑Domain Security Management Server, Log Server, Multi‑Domain Log Server, and SmartEvent can be tricked into accepting files from anyone on the network. An attacker...
9.8
KEV
WordPress can load malicious PHP file from outside theme
CVE-2026-87902
DEBIAN-CVE-2026-87902
UBUNTU-CVE-2026-87902
BIT-wordpress-multisite-2026-87902
WordPress sites can be tricked into loading a PHP file that lives outside the theme folder, allowing an attacker to run their own code on the server. This can happen without the attacker needing a log...
8.1
KEV