CVE-2026-93961 Dromara UJCMS UserController UserController.java usernameExist improper authorization

A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/src/main/java/com/ujcms/cms/core/web/api/UserController.java of the component UserController. Performing a manipulation of the argument Username results in...

CVE-2026-93960 Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from...

CVE-2026-93960

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from...

EUVD-2026-83647

A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1Controller.php of the component OAuth Scope Handler. Such manipulation of the argument ID leads to missing authentication. The attack may be performed from...

CVE-2026-93959 SourceCodester Online Reviewer Management System btn_functions.php sql injection

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer0/admins/assessments/course/btnfunctions.php. This manipulation of the argument Course causes sql injection. The attack is possible to be carried...

EUVD-2026-83610

A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getAppSettings of the file backend/src/main/java/org/booklore/controller/AppSettingController.java of the component Settings API Endpoint. Such manipulation leads...

CVE-2026-94093: Deserialization of Untrusted Data

A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/loadreplaybuffer/VecNormalize.load of the file saveutil.py. Such manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclos...

CVE-2026-94092: Deserialization of Untrusted Data

A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function loadinfo/readtorchdata of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was...

CVE-2026-94091: Deserialization of Untrusted Data

A weakness has been identified in piskvorky gensim up to 4.4.0. The impacted element is the function Load of the file gensim/utils.py of the component Model Loader. This manipulation of the argument fname causes deserialization. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-94090: Integer Underflow (Wrap or Wraparound)

A security flaw has been discovered in JusticeRage Manalyze 1.0.0. The affected element is the function PE::parsedebug of the file manape/pe.cpp of the component PE Parser. The manipulation of the argument misc.Length results in integer underflow. The attack may be performed from remote. The patc...

CVE-2026-94089: Stack-based Buffer Overflow

A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfaauthentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffer overflow. The attack can be executed...

CVE-2026-94051: Server-Side Request Forgery (SSRF)

A vulnerability was found in 0717376 coworkbench up to d943e75bc0fc8e3b27141979300cd8cbcd1e890d. Affected by this vulnerability is the function ControlFlowNode of the file localservers/pdf-tools-mcp/pdftoolsmcp/server.py of the component pdf-tools-mcp. Performing a manipulation of the argument...

CVE-2026-94049: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in 06ketan slideshot up to 4.4.0. This impacts the function renderslides of the file packages/cli/src/renderer.ts. This manipulation of the argument htmlPath causes path traversal. The attack is possible to be carried out remotely. The exploit has been published and may be...

CVE-2026-94048: Improper Privilege Management

A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument roleid results in improper privilege management. The attack can be executed remotely. The exploit is...

CVE-2026-94045: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...

CVE-2026-94044: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function createfile of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content leads to path traversal. The attack can be launched remotely. The...

CVE-2026-94043: Concurrent Execution using Shared Resource with Improper Synchronization

A vulnerability was determined in Free5GC up to 4.2.3. This vulnerability affects unknown code of the file /corefuzzerdeps/free5gc/NFs/amf/internal/gmm/handler.go of the component Gmm Handler. This manipulation causes race condition. The attack can be initiated remotely. Patch name:...

CVE-2026-94042: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqliquery of the file admin/addtable.php. The manipulation of the argument table/members/price results in sql injection. It is possible to launch th...

CVE-2026-94041: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is some unknown functionality of the file admin/addmenu.php. The manipulation of the argument item/price/image/type leads to sql injection. It is...

CVE-2026-94040: Server-Side Request Forgery (SSRF)

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/app/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may b...