Latest Security Vulnerabilities

Sunday September 20, 2026

Zte

CVE-2026-86551 Z80Ultra (NX741J) Android: WiFi MAC Address Disclosure
CVE-2026-86554 SmartLife App Auth Param Leak Enables Account Enumeration
CVE-2026-86552 Authentication Bypass in SmartLife App via Unverified Email Sign-Up
CVE-2026-86555 Hardcoded Key in ZTE SmartLife App Exposes Server Info
CVE-2026-86553 SmartLife Auth Param Leak Allows Password Reset

Frappe Erpnext

CVE-2026-94113 Frappe ERPNext <15.121.0/16.34.0> timesheet info disclosure
 

Unclassified

CVE-2026-82842 WordPress SAML Single Sign On <6.0.0 Identity Link Bypass
CVE-2026-84223 Kirki <6.3.1 WP plugin unsanitized SVG upload risk
CVE-2026-81654 Photo Gallery, Sliders WP Plugin <4.5.0 Improper Capability Check
CVE-2026-81651 Gallery Ownership Bypass in Photo Gallery, Sliders, Proofing & Themes v<4.5.0
CVE-2026-85017 Arbitrary PHP Object Injection in Unlimited Elements For Elementor <=2.0.19
CVE-2026-87067 Forminator Forms <1.57.2.1 RCE via XML-RPC Deserialization
CVE-2026-87068 Forminator Forms <=1.57.2.1 Role Validation Bypass via Nested Quiz
CVE-2026-87839 Tripzzy WP Plugin < 1.5.1: Unauth AJAX Allows Comment Deletion
CVE-2026-92423 Meow Gallery <5.5.5: Missing Capability Check Exposes Draft Post Metadata
And others...

Oisf Suricata

CVE-2026-94083 Suricata <8.0.7 DoH2 type confusion leads to invalid free
CVE-2026-94084 Suricata <8.0.7 Http2ThreadMultiBuf use-after-free
CVE-2026-57223 Suricata <7.0.17 / <8.0.6 Windows Service LPE via Unquoted ImagePath
CVE-2026-57228 Suricata <7.0.17 Heap OOB Read in SMTP MIME Decoder

D Link R95

CVE-2026-93958 D-Link R95 1.00.16 OS Cmd Injection via /bin/ssi (NTPServer)

Kamailio

CVE-2026-93962 Kamailio 5.8.8/6.0.7/6.1.4/6.2.0-dev1 Heap Overflow in CDP Receiver (shm_malloc)

Dedecms

CVE-2026-94004 DedeCMS <=5.7.118 Remote Code Injection via mytag_js.php aid param

Pixelfed

CVE-2026-93960 Pixelfed OAuth Scope Handler ID manipulation (missing auth) v0.12.11-0.12.10

Tencent

CVE-2026-94111 CVE-2026-94111: BrowserSkill 0.3.0 Auth Bypass via WebSocket Origin Validation

Olivier Ls Php Fts

CVE-2026-93957 PHP-FTS 1.1.3 Remote Comparison Bypass in SearchEngine::matchesSingleFilter
CVE-2026-93956 olivier-ls PHP-FTS XSS via buildHighlights up to 1.1.2 (fixed 1.1.3)

Comfast Cf N1 S

CVE-2026-94003 Comfast CF-N1-S 2.6.0.1 Web Mgmt Interface Stack Buffer Overflow

Getid3

CVE-2026-94106 getID3 <1.9.26 OS Command Injection via Unescaped Filenames
CVE-2026-94108 getID31.9.26 XXE via XML2array (PHP<8.0)

Sourcecodester Online Reviewer Management System

CVE-2026-93959 SQLi via Course param in btn_functions.php of SCM System 1.0
CVE-2026-93972 SQL Injection in SourceCodester Online Reviewer Mgmt 1.0 via btn_functions.php
CVE-2026-93973 SourceCodester Online Reviewer Mgmt Sys 1.0 SQLi via btn_functions.php
CVE-2026-93974 SQLi via btn_functions.php in SourceCodester Online Reviewer System 1.0

Nginxproxymanager Nginx Proxy Manager

CVE-2026-93964 NginxProxyManager NGPM <=2.15.1 Auth Bypass via intCert.validate (VRoute)

Aiyiyi121 Sxdevops

CVE-2026-93965 Command Injection in aiyiyi121 SxDevOps 1.0/1.1 MCP STDIO Server Mgmt
CVE-2026-93966 Command Injection in aiyiyi121 SxDevOps 1.0/1.1 via TASK_RUN exec_command
CVE-2026-93967 Command Handler in Aiyiyi121 SxDevOps 1.1: CMD Injection in generate_host_task
CVE-2026-93968 SxDevOps 1.0/1.1 Privilege Escalation via UserSerializer update
CVE-2026-93969 Hard-Coded Credentials in aiiyi121 SxDevOps 1.01.1 rbac/services.py
CVE-2026-93970 CVE-2026-93970: Hard-coded creds in aiyiyi121 SxDevOps 1.0 Settings Handler
CVE-2026-93971 aiyi yi121 SxDevOps 1.0/1.1 Remote Info Disclosure via settings.py

Code Projects Assessment Management

CVE-2026-93975 Assessment Management 1.0 XSS in admin/edit-user.php
CVE-2026-93976 CVE-2026-93976: XSS in Assessment Management 1.0 (admin/add-user.php)
CVE-2026-93977 XSS in code-projects Assessment Mgt 1.0 (lecturer/add-single-mark.php)

Ujcms

CVE-2026-93961 Improper Authorization in Dromara UJCMS 12.3.1 UserController usernameExist

Code Projects Internship Management System

CVE-2026-93978 CVE-2026-93978: SQLi via /login.php Password in code-projects IMS 1.0
CVE-2026-93979 SQL Injection in code-projects Internship Management System 1.0 /employer/login.php
CVE-2026-93980 Internship Mgmt Sys 1.0: SQLi via Password in /admin/login.php

Sourcecodester Drug Recommendation System

CVE-2026-93997 SrcCodester DR System 1.0 Remote SQLi in edit_symptom.php

Itsourcecode Leave Management System

CVE-2026-93963 CVE-2026-93963

Mayswind Ezbookkeeping

CVE-2026-94112 TOTP Replay in mayswind ezBookkeeping <2.0.0

Saturday September 19, 2026

Mischiefmarmot

CVE-2026-13200 WordPress Create Plugin <2.5.3 SQLi via order param
CVE-2026-13191 WordPress Create Plugin v2.5.3 SQLi via order_by Author+

Xootix

CVE-2026-12402 Stored XSS via fb-config Setting in OTP Login Register Woocommerce (<=2.7.3)

Red Hat Build Keycloak

CVE-2026-93999 Keycloak OIDC Token Refresh Bypass for Disabled Clients
CVE-2026-94001 Keycloak Admin REST API DeleteCred PrivEsc for Delegated Admin
CVE-2026-94000 Privilege Escalation via Keycloak Admin REST Group-Membership API

Themeum Tutor Lms

CVE-2026-88944 TutorLMS WP Plugin Auth Bypass v4.0.8 enables post deletion
CVE-2026-89081 Tutor LMS <4.0.8 Reflected XSS via search param
CVE-2026-89333 IDOR in Tutor LMS <=4.0.8 via student_id

Brechtvds

CVE-2026-89274 WP Recipe Maker <=10.8.1 Arbitrary Shortcode Exec via reviewBody
CVE-2026-90884 WP Recipe Maker <=10.8.1 Stored XSS via notes parameter (Contributor+)
 

Unclassified

CVE-2026-82842 WordPress SAML Single Sign On <6.0.0 Identity Link Bypass
CVE-2026-84223 Kirki <6.3.1 WP plugin unsanitized SVG upload risk
CVE-2026-81654 Photo Gallery, Sliders WP Plugin <4.5.0 Improper Capability Check
CVE-2026-81651 Gallery Ownership Bypass in Photo Gallery, Sliders, Proofing & Themes v<4.5.0
CVE-2026-85017 Arbitrary PHP Object Injection in Unlimited Elements For Elementor <=2.0.19
CVE-2026-87067 Forminator Forms <1.57.2.1 RCE via XML-RPC Deserialization
CVE-2026-87068 Forminator Forms <=1.57.2.1 Role Validation Bypass via Nested Quiz
CVE-2026-87839 Tripzzy WP Plugin < 1.5.1: Unauth AJAX Allows Comment Deletion
CVE-2026-92423 Meow Gallery <5.5.5: Missing Capability Check Exposes Draft Post Metadata
And others...

Themehigh

CVE-2026-9832 Stripe for WooCommerce: ImpVerif of Crypto Sig up to 5.0.8

Ghozylab

CVE-2026-2422 WP Composer 1.0.5 Stored XSS via pbwp_raw_shortcode Base64

Perl Dbi

CVE-2026-78030 Perl DBI <1.653 DBD::DBM Allows Arbitrary Module Load (AML)

Wordplus Better Messages

CVE-2026-89334 Authorization Bypass in Better Messages Chat Rooms WP Plugin v2.15.33
CVE-2026-89093 WordPress Better Messages <=2.15.33 Info Exposure via Spoofing (Guest IP)

Exim

CVE-2026-94057 Exim <4.100.1 SMTP Smuggling via DATA Rejection
CVE-2026-94056 Exim <4.100.1: Proxy-Protocol Uninit Stack Data Leak
CVE-2026-94055 Exim <4.100.1 Use-After-Free via GnuTLS TLS Settings
CVE-2026-94054 Exim <4.100.1 OOB Write via Proxy-Protocol (attacker-controlled IP)

Wpmudev Forminator Forms

CVE-2026-92229 Forminator Forms Plugin <=1.57.2 Arbitrary Shortcode Exec

Rclone

CVE-2026-93986 rclone <1.75.1 Path Traversal via Untrusted Object Names
CVE-2026-93987 rclone 1.x CVE-2026-93987 Path Traversal in serve docker volume plugin

Vllm

CVE-2026-93989 vLLM 0.29.0 Bad_Words Index OOB CVE-2026-93989

Libexpatproject Libexpat

CVE-2026-93990 Expat 2.8.4 XML Parser UTF-16 Surrogate Validation Flaw (CVE-2026-93990)

Argoproj Argo Workflows

CVE-2026-93991 Argo Workflows 4.1.0-4.1.3 Auth Bypass in ListArchivedWorkflows via Neg NS selector

Edgarrojas

CVE-2026-11899 Auth Bypass in PDF Builder for WooCommerce 2.0.11

Easyappointments

CVE-2026-9232 Easy Appointments <=3.12.27 Sensitive Info Exposed via handle_customers_ajax

Creativeinteractivemedia

CVE-2026-15098 R3D Flipbook Lite WP Plugin <=5.1.1 Stored XSS via lightboxtext attribute

Cleverplugins

CVE-2026-15660 Missing Auth in SEO Booster 7.4.7: Admin OAuth Callback Overwrites Options

Litespeedtech Litespeed Cache

CVE-2026-76579 LiteSpeed Cache WP Plugin 7.9 Reflected XSS in 'esi' param

Blockspare

CVE-2026-1242 BlockSpare WP Plugin <=4.2.6 Auth Bypass by Incorrect Permission Callback

Vowelweb Ibtana

CVE-2026-1984 Ibtana Ecommerce Addons WP v0.4.7.7: Unauthorized Post Meta via AJAX

Properfraction Profilepress

CVE-2026-85658 Arbitrary Shortcode Exec in ProfilePress Plugin v4.17.2

Pdfcrowd

CVE-2026-92807 WP Save as PDF Plugin 4.6.1 AFI via pdf_created_callback

Totolink A3002mu

CVE-2026-93742 Command Injection via formWsc in Totolink A3002MU (Hh-B20211125.1046)
CVE-2026-93741 Totolink A3002MU Buffer Overflow via submit-url (Hh-B20211125.1046)

Openpanel

CVE-2026-93982 OpenPanel logs unredacted MCP tokens from query parameters
CVE-2026-93983 OpenPanel ClickHouse SQL Injection via Unsanitized Property Keys
CVE-2026-93984 OpenPanel Tracking API: Client Secret Hash Bypass Enables Revenue Injection
CVE-2026-93985 OpenPanel js-runtime Sandbox Escape via Webhook Template Validator

F1logic

CVE-2026-12042 WP2Social Auto Publish <2.4.12 XSS via Admin Settings

Olivier Ls Php Fts

CVE-2026-93957 PHP-FTS 1.1.3 Remote Comparison Bypass in SearchEngine::matchesSingleFilter
CVE-2026-93956 olivier-ls PHP-FTS XSS via buildHighlights up to 1.1.2 (fixed 1.1.3)

Hiroaki Miyashita

CVE-2026-9855 WordPress Custom Field Template <=2.7.8: Authenticated SQLi via post_ID

Vowelweb

CVE-2026-2278 WordPress VW Writer Blog 1.3.8: Cap Check Missing in Reset Settings

Elixir Mint Mint

CVE-2026-82672 HTTP Request Smuggling in elixir-mint mint <1.10.1 (chunk-size flaw)

Stellarwp

CVE-2026-77820 WPComplete (2.9.9.0) Stored XSS via empty shortcode attribute

Grimmory Tools Grimmory

CVE-2026-93954 AUC: Incorrect Auth via Settings API Endpoint in Grimmory <3.4.1 (Java)
CVE-2026-93955 Auth Bypass in Grimmory-Tools 3.3.3 Download Endpoint via bookId

Hono

CVE-2026-93981 Hono <4.13.7 XSS via unescaped strings in hono/jsx rendering

Webkul Qloapps

CVE-2026-93988 QloApps 1.7.0 Path Traversal via admin/ajax.php getEmailHTML

Friday September 18, 2026

Automattic Wordpress

CVE-2026-93485 WordPress Core <7.1.1 DOM-Based XSS Vulnerability

Nextcloud Server

CVE-2026-82985 Apple Photos Smart Album Info Disclosure via Search Config

IBM Guardium Data Protection

CVE-2026-84073 IBM Guardium 12.2 SQL Injection via Improper Neutralization of Special Elements
CVE-2026-84084 CVE-2026-84084: IBM Guardium Data Protection 12.2 CSRF allows remote bypass
CVE-2026-82832 Remote Code Exec in IBM Guardium DP 12.2 via Improper Input Neutralization
 

Unclassified

CVE-2026-82842 WordPress SAML Single Sign On <6.0.0 Identity Link Bypass
CVE-2026-84223 Kirki <6.3.1 WP plugin unsanitized SVG upload risk
CVE-2026-81654 Photo Gallery, Sliders WP Plugin <4.5.0 Improper Capability Check
CVE-2026-81651 Gallery Ownership Bypass in Photo Gallery, Sliders, Proofing & Themes v<4.5.0
CVE-2026-85017 Arbitrary PHP Object Injection in Unlimited Elements For Elementor <=2.0.19
CVE-2026-87067 Forminator Forms <1.57.2.1 RCE via XML-RPC Deserialization
CVE-2026-87068 Forminator Forms <=1.57.2.1 Role Validation Bypass via Nested Quiz
CVE-2026-87839 Tripzzy WP Plugin < 1.5.1: Unauth AJAX Allows Comment Deletion
CVE-2026-92423 Meow Gallery <5.5.5: Missing Capability Check Exposes Draft Post Metadata
And others...

Red Hat Camel Spring Boot

CVE-2026-93560 Netty STOMP codec int truncation can cause DoS

ImageMagick

CVE-2026-93586 ImageMagick 7.1.2-31 UAF in ImagesToBlob
CVE-2026-93588 ImageMagick <7.1.2-31 or <6.9.13-56 NULL Deref DoS in PNM Coder

MongoDB

CVE-2026-93763 MongoDB ODM FLE Config Failure Exposes Cleartext
CVE-2026-93764 Mongoid: Embedded Model Field Encryption Bypass (CVE-2026-93764)

IBM Cics Tx Advanced

CVE-2026-11549 IBM WAS Lib Virt. Host Bypass
CVE-2026-11722 HTTP Request Smuggling in IBM WebSphere Application Server

IBM WebSphere Application Server

CVE-2026-11538 IBM WebSphere AS 9.0/8.5 Log Injection via LTPA Token
CVE-2026-11545 IBM WebSphere App Server 8.5/9.0 Auth Bypass in Admin Console

IBM Mq

CVE-2026-10027 IBM MQ Buffer Overflow via Malformed Compressed Channels - Remote Code Exec
CVE-2026-10751 IBM MQ Java Client Deserialization Filter Bypass Enables Code Exec
CVE-2026-10575 IBM MQ Heap Buffer Overflow in MQPUT Distribution Headers (CVE-2026-10575)

Synology Diskstation Manager

CVE-2026-13639 Low Entropy in DSM Login (<7.2.1-69057-12) Enables Remote File Access & DoS
CVE-2026-4036 Synology DSM pre-7.3.2 SQLi via Sharing API remote auth
CVE-2026-6205 Synology DSM External Control of File Path Vulnerability before 7.2.1-69057-12
CVE-2026-40538 Synology DSM <7.2.2: Brute-Force Auth Allows Limited File Read
CVE-2026-40535 DSM Desktop API Path Traversal (7.2.1) Remote File Write
CVE-2026-40534 Synology DSM XSS in Video API before 7.3.2-86009-2
CVE-2026-40532 Forced Browsing in Wallpaper Path (DSM 7.x<7.2.1) Enables Auth Leak

Red Hat Openshift

CVE-2026-75885 OpenShift Console Unauth devfile API SSRF/DoS

Hcl Bigfix

CVE-2026-67100 HCL BigFix Service Mgmt: SQLi & Cross-Tenant Data Exposure

Red Hat Amq Broker

CVE-2026-93566 Netty HTTP Request Smuggling via Chunk-Size Line Bypass
CVE-2026-93574 Netty netty-codec-http HTTP Smuggling via Chunk-Size Post-Digit Whitespace

Garycourt Uri Js

CVE-2026-93690 Denial of Service in uri-js <=4.4.1 removeDotSegments Unicode separator loop

Microsoft Edge Chromium

CVE-2026-88097 Sep 2026: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

Brechtvds

CVE-2026-89274 WP Recipe Maker <=10.8.1 Arbitrary Shortcode Exec via reviewBody
CVE-2026-90884 WP Recipe Maker <=10.8.1 Stored XSS via notes parameter (Contributor+)

Oisf Suricata

CVE-2026-94083 Suricata <8.0.7 DoH2 type confusion leads to invalid free
CVE-2026-94084 Suricata <8.0.7 Http2ThreadMultiBuf use-after-free
CVE-2026-57223 Suricata <7.0.17 / <8.0.6 Windows Service LPE via Unquoted ImagePath
CVE-2026-57228 Suricata <7.0.17 Heap OOB Read in SMTP MIME Decoder