CVE Vulnerabilities - 25 September 2026

Mediawiki ExternalData extension lets attackers run code remotely

CVE-2026-100382

The ExternalData add‑on for Mediawiki can be tricked into executing system commands without any authentication. This means an attacker could run arbitrary code on the server hosting your wiki, potenti...

10.0

Firefox can let attackers gain higher system rights

OESA-2026-4123

Certain versions of Firefox and Thunderbird can be tricked into giving a malicious website higher access to your computer. The issue affects older Firefox releases and several Thunderbird versions. Up...

10.0

Firefox can let attackers gain higher privileges

OESA-2026-4121

Recent updates fix several flaws in Firefox and Thunderbird that could let a malicious website or email cause the program to run with more rights than intended. This could allow an attacker to take co...

10.0

Firefox may allow attackers to gain higher privileges

OESA-2026-4122

Several flaws in Firefox's video handling and graphics code could let a malicious website run code with more rights than intended. Upgrade to Firefox version 156 or the latest ESR releases to apply th...

10.0

Firefox can let attackers gain higher system rights

OESA-2026-4120

The web browser Firefox (including several extended support releases) contains bugs that could let a malicious website or email cause the program to run with more privileges than intended. This could ...

10.0

Git LFS may write files outside repository

OESA-2026-4068

Versions 0.5.2 through 3.7.0 of Git Large File Storage can place data in locations beyond the intended project folder when symbolic or hard links are present. This could let unwanted files appear on y...

10.0

RabbitMQ lets attacker run script through OAuth token

CVE-2026-67237 DEBIAN-CVE-2026-67237 GHSA-2rf7-f6r6-8rwh UBUNTU-CVE-2026-67237

Versions of RabbitMQ server 4.2.0‑4.2.7 and 4.3.0‑4.3.1 can insert an attacker‑controlled token into a JavaScript file that is shown in the management console. This could let a malicious user run code...

9.9

CGA-7g24-vcwc-m8v9

CGA-7g24-vcwc-m8v9

9.9

CGA-pmx7-q7q2-qhvg

CGA-pmx7-q7q2-qhvg

9.9

CGA-hg9m-346g-35w4

CGA-hg9m-346g-35w4

9.9

CGA-w44m-chf5-cjwf

CGA-w44m-chf5-cjwf

9.9

Unbound DNS resolver can be crashed or hacked

OESA-2026-4130

The Unbound DNS service used on openeuler systems may stop working or allow unauthorized code to run when it processes specially crafted DNS keys. This happens because the validator can overflow its m...

9.9

Rocky Linux Unbound could let attackers run code

RLSA-2026:71487

The Unbound DNS service on Rocky Linux can be tricked into executing malicious code through specially crafted DNS responses. This could allow an attacker to take control of the server or cause it to c...

9.8

FriendsOfFlarum OAuth lets attacker hijack accounts via Discord

CVE-2026-92161 GHSA-g7vj-c29h-3h5m

The FriendsOfFlarum OAuth plugin for Flarum (versions before 1.7.4 and 2.0.0‑beta.4) does not verify that a Discord‑provided email address is confirmed. An attacker who knows a user's email can create...

9.8

Zimbra Collaboration Suite lets anyone write files and run code

CVE-2026-93643

If Zimbra’s OnlyOffice document feature is enabled, a remote attacker who can view a public document can trick the system into writing files to any location and then run commands as the Zimbra service...

9.8

Linux kernel may miscount network credits after allocation error

CVE-2026-100075 DEBIAN-CVE-2026-100075 UBUNTU-CVE-2026-100075 BELL-CVE-2026-100075

The Linux kernel’s RDMA component can leave internal counters incorrect if a memory allocation fails, causing it to track the wrong number of send‑queue slots. This miscount can lead to network commun...

9.8

jsonpath-plus may let attackers execute code

GHSA-pppg-cpfq-h7wr CVE-2024-21534 ROOT-APP-NPM-CVE-2024-21534

The jsonpath-plus library used in several web projects has a flaw that could allow an attacker to run unwanted code on your server. This affects any application that includes jsonpath-plus from the li...

9.3

Rocky Unbound may allow remote code execution

RLSA-2026:71419

The Unbound DNS service on Rocky Linux can be tricked by specially crafted DNS responses, causing the software to crash or run malicious code. This could let an attacker take control of the server tha...

9.8

Unbound can be crashed by crafted DNS queries

RHSA-2026:71611

The Red Hat Unbound DNS server and its Python bindings are vulnerable to specially crafted queries that could crash the service. This could interrupt name resolution for users and applications. Apply ...

9.8

Unbound can let attackers run code remotely

RHSA-2026:71610

The Unbound DNS software and its Python bindings on Red Hat systems have a flaw that could let a remote attacker execute code on the server. This could compromise the integrity of your network service...

9.8

Unbound DNS software may return false DNS answers

RHSA-2026:71487

The Unbound DNS server and its Python bindings on Red Hat systems could be forced to give incorrect domain name information, potentially redirecting users to malicious sites. This can affect the core ...

9.8

Red Hat Unbound may allow remote code execution

RHSA-2026:71460

The Unbound DNS resolver and its libraries in Red Hat can be tricked into running malicious code. This could let an attacker take control of the server hosting the service. Apply the latest Red Hat se...

9.8

Unbound DNS service may execute attacker code

RHSA-2026:71419

The Red Hat packages for Unbound and its Python bindings can be tricked into running malicious code, potentially letting an attacker take control of the server. This affects systems using the unbound,...

9.8

protobufjs can let attackers modify core JavaScript objects

GHSA-h755-8qp9-cq85 CVE-2023-36665 ROOT-APP-NPM-CVE-2023-36665

The protobufjs library versions from 6.10.0 up to 7.2.4 allow a specially crafted data file to change the basic behavior of the program by altering its core objects. This could let an attacker cause u...

9.8

Apache Qpid Broker-J reuses session ID after login

CVE-2026-92609

When a user logs into the management interface of Apache Qpid Broker-J, the system keeps the same session identifier instead of creating a new one. This allows a remote attacker who knows the old iden...

9.8