CVE-2026-93976: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2026-93997: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the file /Admin/editsymptom.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-93972: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer0/admins/assessments/course/btnfunctions.php. Such manipulation of the argument courseID leads to sql injection. It is possible to...

CVE-2026-94093: Deserialization of Untrusted Data

A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/loadreplaybuffer/VecNormalize.load of the file saveutil.py. Such manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclos...

CVE-2026-94051: Server-Side Request Forgery (SSRF)

A vulnerability was found in 0717376 coworkbench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNode of the file localservers/pdf-tools-mcp/pdftoolsmcp/server.py of the component pdf-tools-mcp. Performing a manipulation of the argument...

CVE-2026-94048: Improper Privilege Management

A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument roleid results in improper privilege management. The attack can be executed remotely. The exploit is...

CVE-2026-94043: Concurrent Execution using Shared Resource with Improper Synchronization

A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzerdeps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. The attack can be initiated remotely. Patch name:...

CVE-2026-93966: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.execcommand of the file backend/ops/hosttasks.py of the component TASKRUNCOMMAND. Such manipulation of the argument command leads to command injection. The attack may be...

CVE-2026-93965: Improper Neutralization of Special Elements used in a Command

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

CVE-2026-93960: Missing Authentication for Critical Function

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from...

CVE-2026-93968: Improper Privilege Management

A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of the component UserSerializer. Executing a manipulation can lead to improper privilege management. The attack can be executed remotely. This patch is called...

CVE-2026-93954

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads...

CVE-2026-93954 grimmory-tools grimmory Settings API Endpoint AppSettingController.java AppSettingController.getAppSettings authorization

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads...

CVE-2026-93742 Totolink A3002MU formWsc command injection

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/formWsc. This manipulation of the argument localPin causes command injection. The attack can be initiated remotely. The exploit has been made available to the...

CVE-2026-87917

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-87917

The MC4WP: Mailchimp for WordPress plugin (versions up to and including 4.14.0 ) is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'data' Dynamic Content Tag , caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts i...

EUVD-2026-83575

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-88926

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-92430

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin, affecting versions 3.6.1-5.4.6 , contains an unauthenticated order status manipulation vulnerability. The root cause is the failure to verify the authenticity of its PIX payment webhook before updating an order's...

CVE-2026-92430 Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying...