CVE-2026-63405

creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:14+00:00| published-proof-of-concept| https://github.com/anycable/anycable/security/advisories/GHSA-5p54-whvp-x327 2026-09-19 15:31:24+00:00| seen| https://gist.github.com/alon710/5e8f8e10b5d10b651ea44234a36a9e37...

CVE-2026-85058

creationtimestamp| type| source ---|---|--- 2026-09-18 18:35:02+00:00| published-proof-of-concept| https://github.com/moquette-io/moquette/security/advisories/GHSA-9jjc-fw8x-fmwx 2026-09-19 02:31:41+00:00| seen| https://gist.github.com/alon710/6c8180b6898a74f52da1dc6d425e2b77 2026-09-24...

CVE-2026-63459

creationtimestamp| type| source ---|---|--- 2026-09-17 16:35:14+00:00| published-proof-of-concept| https://github.com/vendurehq/vendure/security/advisories/GHSA-xhq9-whgq-49j5...

CVE-2026-63460

creationtimestamp| type| source ---|---|--- 2026-09-17 16:35:13+00:00| published-proof-of-concept| https://github.com/vendurehq/vendure/security/advisories/GHSA-jgm3-qmp2-c4p7...

CVE-2026-91016

The Motors WordPress plugin, in versions prior to 1.4.121 , is vulnerable to an authorization bypass. The plugin fails to verify if a request is authorized to view a user's non-published car listings. This flaw allows unauthenticated attackers to access and read draft, pending, and private listin...

CVE-2026-90880 D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/NewGUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely...

CVE-2026-90858

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function sessionstart of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The...

CVE-2026-90858 subhajitkhan online-clinic-management-system adminappview.php session_start authorization

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the function sessionstart of the file adminappview.php. Executing a manipulation of the argument adminmail can lead to authorization bypass. The...

PT-2026-92036

Name of the Vulnerable Software and Affected Versions OpenClaw ClawScan versions prior to 0.1.7 Description A flaw in the Static Scanner component, specifically within the file internal/runner/static scanner.go, allows for an incomplete comparison with missing factors. This issue can be exploited...

CVE-2026-61578

creationtimestamp| type| source ---|---|--- 2026-09-14 20:00:06+00:00| published-proof-of-concept| Telegram/1Vwrq603LNSzLjTsf8z6M76upo6xgVWjVAK5cahZOMce6I 2026-09-15 00:00:10+00:00| published-proof-of-concept| Telegram/1Vwrq603LNSzLjTsf8z6M76upo6xgVWjVAK5cahZOMce6I...

CVE-2026-90805 subhajitkhan online-clinic-management-system doctorlogin.php sql injection

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument docmail/docpswd can lead to sql injection. The attack can be executed remotely...

EUVD-2026-77613

A flaw has been found in GPAC up to f1219cde. This issue affects the function gfnodelistgetchild of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploi...

EUVD-2026-77177

A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This issue affects the function LocalRuntime.executecommand of the file runtime/runtime.py of the component LocalRuntime. Executing a manipulation can lead to os command injection. The attack may be...

PT-2026-91251

A flaw has been found in GPAC up to f1219cde. This issue affects the function gf node list get child of the file scenegraph/base scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The...

PT-2026-91763

Name of the Vulnerable Software and Affected Versions michaelliao itranswarp versions prior to 2.20 Description A flaw in the Page Content Rendering component allows remote attackers to perform cross site scripting XSS, which is a technique used to inject malicious scripts into web pages viewed b...

CVE-2026-90599

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The explo...

CVE-2026-90599 Rizwan17 inventory-management-system process.php cross-site request forgery

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely. The explo...

EUVD-2026-77063

A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gflistcount of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used...

CVE-2026-90521

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processing of the file MenpiaodingdanController.java of the component CRUD. The manipulation of the argument ID results in authorization bypass. It...

CVE-2026-90516 SourceCodester School Registration and Fee System pay_report.php sql injection

A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/payreport.php. Performing a manipulation of the argument period results in sql injection. The attack can be initiated remotely. The exploit has...