PT-2026-95970

Name of the Vulnerable Software and Affected Versions WatchDog Anti-Virus version 1.8.640 Description Improper link resolution during the quarantine restoration process on Windows allows a local, low-privileged attacker to write a quarantined file to an arbitrary filesystem location. This is...

CVE-2026-93966: Improper Neutralization of Special Elements used in a Command

A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.execcommand of the file backend/ops/hosttasks.py of the component TASKRUNCOMMAND. Such manipulation of the argument command leads to command injection. The attack may be...

CVE-2026-94043: Concurrent Execution using Shared Resource with Improper Synchronization

A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzerdeps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. The attack can be initiated remotely. Patch name:...

PT-2026-95949

Name of the Vulnerable Software and Affected Versions code-projects Assessment Management version 1.0 Description Cross site scripting occurs in the file admin/add-user.php due to the manipulation of the level argument. This issue allows a remote attack to be launched. Recommendations Avoid using...

CVE-2026-93980: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the component Admin Login Form. Executing a manipulation of the argument Password can lead to sql injection. The attack may be performed from...

CVE-2026-92252: Incorrect Default Permissions

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files x86\Watchdog...

CVE-2026-93958: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in D-Link R95 BE95001.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack can be executed remotely. The exploit has been made public and...

CVE-2026-93965: Improper Neutralization of Special Elements used in a Command

A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the component MCP STDIO Server Management. This manipulation of the argument endpointorcommand causes command injection. The attack may be initiated remotely...

CVE-2026-92254: Improper Input Validation

Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 driver versions 1.3.0.0 and earlier on Microsoft Windows allows local, low-privileged attackers to delete arbitrary files with SYSTEM privileges, bypassing NTFS access controls and...

CVE-2026-93964: Missing Authentication for Critical Function

A vulnerability was detected in NginxProxyManager nginx-proxy-manager up to 2.15.1. This impacts the function internalCertificate.validate of the file backend/internal/certificate.js of the component Validate Route. The manipulation results in missing authentication. The attack can be launched...

CVE-2026-93959: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer0/admins/assessments/course/btnfunctions.php. This manipulation of the argument Course causes sql injection. The attack is possible to be carried...

CVE-2026-94090: Integer Underflow (Wrap or Wraparound)

A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::parsedebug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attack may be performed from remote. The patc...

CVE-2026-94094: Improper Resource Shutdown or Release

A flaw has been found in OpenClaw up to 2026.9.5. Affected is the function createCanvasHostHandler of the file extensions/canvas/src/host/server.ts of the component Canvas Host Route. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been...

CVE-2026-94092: Deserialization of Untrusted Data

A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function loadinfo/readtorchdata of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was...

CVE-2026-94091: Deserialization of Untrusted Data

A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Loader. This manipulation of the argument fname causes deserialization. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-93979: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in code-projects Internship Management System 1.0. This affects an unknown part of the file /employer/login.php. Performing a manipulation of the argument Password results in sql injection. The attack is possible to be carried out remotely. The exploit has been...

CVE-2026-94033: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drugrecommender/Admin/adduser of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is...

CVE-2026-94031: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in 0-Gaurav-0 nexus-mcp aed0026e7ac1f23dc940e46e9fd3a2da6904f914. Affected by this issue is the function childprocess.exec of the file src/auth/browser.ts of the component nexusreauth MCP tool. The manipulation of the argument url results in command injection. The...

CVE-2026-94028: Server-Side Request Forgery (SSRF)

A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.modeldump of the file mealie/routes/households/controllergrouprecipeactions.py of the component Recipe Action Trigger. Executing a manipulation of the argument url can lead to server-side reques...

CVE-2026-94003: Stack-based Buffer Overflow

A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function getcsspathfromuri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been...