CVE-2026-93962 Kamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflow

A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shmmalloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch th...

CVE-2026-93961 Dromara UJCMS UserController UserController.java usernameExist improper authorization

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation of the argument Username results in...

EUVD-2026-83647

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from...

CVE-2026-93960 Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from...

CVE-2026-93959 SourceCodester Online Reviewer Management System btn_functions.php sql injection

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer0/admins/assessments/course/btnfunctions.php. This manipulation of the argument Course causes sql injection. The attack is possible to be carried...

Improper Validation of Array Index

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Validation of Array Index via SamplingParams.updatefromtokenizer, which fails to validate badwords token indices against the model's...

EUVD-2026-83610

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads...

PT-2026-95968

Name of the Vulnerable Software and Affected Versions mayswind ezBookkeeping versions prior to 2.0.0 Description The software fails to invalidate Time-based One-Time Password TOTP passcodes after they have been used. This allows an attacker who has obtained stolen credentials to replay a captured...

CVE-2026-94031: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function childprocess.exec of the file src/auth/browser.ts of the component nexusreauth MCP tool. The manipulation of the argument url results in command injection. The...

CVE-2026-93971: Exposure of Sensitive Information to an Unauthorized Actor

A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevops/settings.py. This manipulation causes information disclosure. It is possible to initiate the attack remotely. Patch name: 2b4bf8585c3e731e7a8af30801ea46680bc783f9. It is...

CVE-2026-93970: Use of Hard-coded Credentials

A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/settings.py of the component Settings Handler. The manipulation results in hard-coded credentials. The attack may be performed from remote. The patch is...

CVE-2026-93967: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generatehosttask of the file backend/aiops/services.py of the component Command Handler. Performing a manipulation of the argument command results in command injection. Remote exploitation of the attac...

CVE-2026-94090: Integer Underflow (Wrap or Wraparound)

A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::parsedebug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attack may be performed from remote. The patc...

CVE-2026-94046: Improper Limitation of a Pathname to a Restricted Directory

A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function getfilesnippet of the file getFileSnippet.ts of the component MCP Tool. Executing a manipulation of the argument projectRootPath/filePath can lead to path traversal. The attack may be...

CVE-2026-94045: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...

CVE-2026-94041: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is some unknown functionality of the file admin/addmenu.php. The manipulation of the argument item/price/image/type leads to sql injection. It is...

CVE-2026-94040: Server-Side Request Forgery (SSRF)

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/app/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may b...

CVE-2026-94039: Server-Side Request Forgery (SSRF)

A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer. Performing a manipulation of the argument businessLogo results in server-side request forgery. The attack is possib...

CVE-2026-94038: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabaseurl leads to server-side request forgery. The attack can be executed remotely. The...

PT-2026-95980

Name of the Vulnerable Software and Affected Versions NonceGeek dim-sum-app affected versions not specified Description An issue in the Deno Backend component within the file deno/main.tsx allows for server-side request forgery, a technique where an attacker induces the server to make requests to...