CVE-2026-94092: Deserialization of Untrusted Data

A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function loadinfo/readtorchdata of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was...

CVE-2026-94089: Stack-based Buffer Overflow

A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfaauthentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffer overflow. The attack can be executed...

CVE-2026-94049: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in 06ketan slideshot up to 4.4.0. This impacts the function renderslides of the file packages/cli/src/renderer.ts. This manipulation of the argument htmlPath causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be...

CVE-2026-94044: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function createfile of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content leads to path traversal. The attack can be launched remotely. The...

CVE-2026-94094: Improper Resource Shutdown or Release

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been...

CVE-2026-94050: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...

CVE-2026-94033: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drugrecommender/Admin/adduser of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is...

CVE-2026-93980: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the component Admin Login Form. Executing a manipulation of the argument Password can lead to sql injection. The attack may be performed from...

CVE-2026-94091: Deserialization of Untrusted Data

A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Loader. This manipulation of the argument fname causes deserialization. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-94032: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used...

CVE-2026-92252: Incorrect Default Permissions

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files x86\Watchdog...

CVE-2026-93964: Missing Authentication for Critical Function

A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authentication. The attack can be launched...

CVE-2026-94034: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drugrecommender/Admin/changepassword of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site...

CVE-2026-93974: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer0/admins/assessments/databank/btnfunctions.php?action=remove. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched...

CVE-2026-93977: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-93975: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be...

CVE-2026-94035: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /drugrecommender/index.php. Executing a manipulation of the argument full name can lead to cross site scripting. The attack can be launched remotely. The exploit has been...

CVE-2026-93973: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer0/admins/assessments/subject/btnfunctions.php?action=remove. Performing a manipulation of the argument ID results in sql injection. The attack can...

CVE-2026-93958: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in D-Link R95 BE95001.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and...

CVE-2026-92253: Improper Link Resolution Before File Access

Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, low-privileged attackers to cause a quarantined file to be written to an arbitrary filesystem location by creating a directory junction at the original file pa...