CVE-2026-52823: Cross-Site Request Forgery (CSRF)

Kimai is an open-source time tracking application. Prior to 2.58.0, TimesheetController exposes GET /api/timesheets/id/stop and GET /api/timesheets/id/restart, which reuse an authenticated browser session and perform state-changing operations through GET requests without a request-forgery defense...

CVE-2026-91004: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /deletefaculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to th...

CVE-2026-91001: Stack-based Buffer Overflow

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddnsasp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiate...

CVE-2026-90880: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/NewGUI/Set/Diagnostics.asp of the component Diagnostics. Performing a manipulation of the argument Addr results in command injection. The attack may be initiated remotely...

CVE-2026-90879: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

CVE-2026-90877: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /updaterequirementstatus.php. The manipulation of the argument haydi results in sql injection. It is possible to launch the attack remotely. The exploi...

CVE-2026-90856: Improper Privilege Management

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts an unknown function of the file signup.php of the component Registration Flow. Such manipulation of the argument role leads to improper privilege management. The attack can be...

CVE-2026-90855: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the...

CVE-2026-90854: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The...

CVE-2026-90849: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

CVE-2026-90847: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iuxset.cgi of the component System Setup. This manipulation causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and ma...

CVE-2026-90843: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmapnewscan of the file functionsnmap.py of the component New Nmap Scan Handler. Such manipulation of the argument target/params leads to os command...

CVE-2026-90842: Cleartext Storage in a File or on Disk

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

CVE-2026-90841: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

CVE-2026-90840: Improper Authentication

A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely...

ROS-20260915-73-0058

The vulnerability of the Navigation section in Microsoft Edge and Google Chrome relates to a flaw in data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass existing security measures through a specially created HTML page, operating remotely...

CVE-2026-90878: Uncontrolled Resource Consumption

A vulnerability was determined in vllm-project vLLM up to 0.27.1. This affects an unknown part of the file /v1/chat/completions of the component Jinja Template Rendering. This manipulation of the argument chattemplate causes resource consumption. The attack can be initiated remotely. The exploit...

PT-2026-92118

Name of the Vulnerable Software and Affected Versions TOTOLINK X5000R version 9.1.0cu.2089 B20211224 Description An OS command injection flaw exists in the Export Ovpn Handler component. A remote attacker can exploit this by manipulating the filetype argument within the exportOvpn function of the...

PT-2026-91849

Name of the Vulnerable Software and Affected Versions luben zstd-jni versions prior to 1.5.7-14 Description A remote attack can trigger a use after free condition within the Dictionary Sharing component. This issue occurs in the ZstdCompressCtx.loadDict function located in the ZstdCompressCtx.jav...

ROS-20260915-73-0176

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the false representation of critical information to the user interface. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...