CVE-2026-94028

Mealie (mealie-recipes) versions up to 3.25.1 contain a server-side request forgery (SSRF) vulnerability in the Recipe Action Trigger component, specifically in the payload.model_dump function within mealie/routes/households/controller_group_recipe_actions.py. A remote attacker with low privilege...

CVE-2026-92253

WatchDog Anti-Virus 1.8.640 on Windows is affected by an improper link resolution vulnerability in its quarantine restoration process . A local, low-privileged attacker can create a directory junction at the original path of a quarantined file and, by persuading an administrator to restore that f...

CVE-2026-92252

CVE-2026-92252 affects WatchDog Anti-Virus on Windows , where the installer incorrectly grants the Users group Full Control over C:\Program Files (x86)\Watchdog Anti-Virus. This allows local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files. The practi...

CVE-2026-94016

A cross-site scripting (XSS) flaw was identified in SourceCodester Drug Recommendation System 1.0 , specifically in the /drug_recommender/Admin/add_symptom endpoint. Manipulating the txtname parameter allows an authenticated remote attacker to inject and execute arbitrary script content, resultin...

CVE-2026-90817

CVE-2026-90817 is an unauthenticated Remote Code Execution vulnerability in REDCap 13.3.0 and higher , rated CVSS 9.8 (Critical) . The flaw resides in the survey passthrough routing and Data Import processing logic , where an attacker can manipulate HTTP requests to reach an unintended controller...

CVE-2026-92254

WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0 and earlier) on Microsoft Windows contains a missing authorization flaw in the IOCTL handlers of its wsdkd.sys kernel driver. Local, low-privileged attackers can send crafted IOCTL requests to the \Device\wsdk device to delete arbitrary files wi...

CVE-2026-94015

A SQL injection vulnerability exists in SourceCodester Drug Recommendation System 1.0 , specifically in the file /drug_recommender/Admin/edit_user.php . Manipulating the ID argument allows an unauthenticated, remote attacker to execute arbitrary SQL. The CVSS 3.1 score is 7.3 (HIGH) , reflecting ...

CVE-2026-94113

Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain a missing authorization vulnerability in three whitelisted timesheet endpoints (get_projectwise_timesheet_data, get_timesheet_detail_rate, and get_timesheet) that fail to enforce doctype permissions. An authenticated attacker...

CVE-2026-94112

mayswind ezBookkeeping versions before 2.0.0 contain a TOTP replay attack vulnerability: the application fails to invalidate one-time passcodes after use. An attacker with stolen credentials can replay a captured TOTP code against multiple authorization attempts within the ~90-second acceptance w...

CVE-2026-94111

Tencent BrowserSkill through 0.3.0 contains an authentication bypass in the local daemon WebSocket origin validation . The flawed logic accepts any chrome-extension origin whose identifier is 32 characters long and falls within the range a-p , allowing an attacker to register a malicious browser ...

CVE-2026-94004

DedeCMS versions up to 5.7.118 are affected by a code injection vulnerability in the file plus/mytag_js.php . The root cause is the manipulation of the aid argument within an unknown function of that file. The vulnerability is exploitable remotely with no privileges and no user interaction requir...

CVE-2026-94109

openEQUELLA versions before 2026.1.0 are affected by a remote code execution vulnerability in FreeMarker template compilation, caused by an unsandboxed TemplateClassResolver configuration. Authenticated attackers can inject malicious template expressions via collection summaries , dashboard portl...

CVE-2026-94003

A stack-based buffer overflow in the function get_css_path_from_uri within /cgi-bin/mbox-config of the Comfast CF-N1-S Web Management Interface (version 2.6.0.1) allows an unauthenticated remote attacker to trigger the overflow, leading to high impact on confidentiality, integrity, and availabili...

CVE-2026-93997

A SQL injection vulnerability exists in SourceCodester Drug Recommendation System 1.0 , specifically in the /Admin/edit_symptom.php file. The vulnerability is triggered by unsanitized input in the ID argument, allowing a remote, unauthenticated attacker to manipulate database queries. CVSS 3.1 sc...

CVE-2026-94108

getID3 (PHP library) versions through 1.9.26 are affected by an XML External Entity (XXE) injection in the XML2array helper function. The root cause is that entity loading is not properly disabled when running on PHP before 8.0 . An attacker can craft malicious XML metadata in media files to disc...

CVE-2026-94106

getID3 before 1.9.26 is affected by an OS command injection vulnerability in its shell-out handlers, which fail to escape filenames when constructing command strings. An attacker can craft a malicious filename containing shell metacharacters to inject arbitrary commands that execute with the priv...

CVE-2026-94107

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint. Recovery codes are generated using substr(md5(mt_rand()), 0, 10), producing a short and predictable token. An attacker who knows an administrator's email address can request a password ...

CVE-2026-94105

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in its admin password reset controller (reset.php). An unauthenticated attacker can send a GET request with a missing or incorrect code parameter , which rewrites the config_password setting to 0, effectively disablin...

CVE-2026-94104

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi() endpoint (filemanager.php). The root cause is a failure to validate file extensions for new filenames or when the chunks parameter is 2 or higher. An attacker with view-only back-office access can u...

CVE-2026-93980

A SQL injection vulnerability in the code-projects Internship Management System 1.0 affects the Admin Login Form (/admin/login.php). Manipulating the Password argument allows a remote, unauthenticated attacker to inject SQL, potentially compromising confidentiality, integrity, and availability. T...

CVE-2026-93979

code-projects Internship Management System 1.0 is vulnerable to SQL injection in the file /employer/login.php through manipulation of the Password argument. The flaw allows a remote, unauthenticated attacker to execute arbitrary SQL, impacting confidentiality, integrity, and availability (CVSS 3....

CVE-2026-93978

code-projects Internship Management System 1.0 is affected by an SQL injection vulnerability in the file /login.php. Manipulation of the Password argument allows a remote, unauthenticated attacker to inject SQL commands, resulting in low impact on confidentiality, integrity, and availability (CVS...

CVE-2026-93977

code-projects Assessment Management 1.0 is affected by a cross-site scripting (XSS) vulnerability in the file lecturer/add-single-mark.php . Manipulating the mark parameter allows an attacker to inject script into the application. Remote exploitation is possible, requiring low privileges and user...

CVE-2026-93976

CVE-2026-93976 is a cross-site scripting (XSS) vulnerability in code-projects Assessment Management 1.0 , located in the file admin/add-user.php . Manipulation of the level argument leads to XSS, and the attack can be launched remotely. Exploitation requires high privileges and user interaction ,...

CVE-2026-93975

code-projects Assessment Management 1.0 is affected by a cross-site scripting (XSS) vulnerability in the admin/edit-user.php file (User Editing component). Manipulation of the arguments name, sname, email, username, password, or id allows an authenticated remote attacker to inject script, resulti...

CVE-2026-86555

The ZTE SmartLife mobile application contains a hardcoded key used to decrypt account server information. The key is stored in plaintext within the application code, so an attacker with access to the binary can extract it and decrypt the protected server configuration data. The CVSS v3.1 score is...

CVE-2026-93974

A SQL injection vulnerability exists in SourceCodester Online Reviewer Management System 1.0 , specifically in the ID argument of /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. The flaw can be exploited remotely without authentication or user interaction. The exploit has...

CVE-2026-93973

SourceCodester Online Reviewer Management System 1.0 is affected by a SQL injection vulnerability in the file /reviewer_0/admins/assessments/subject/btn_functions.php?action=remove. Manipulating the ID argument allows remote, unauthenticated attackers to inject SQL, resulting in low impact on con...

CVE-2026-86554

ZTE SmartLife APP is affected by an email enumeration and account ID leakage vulnerability. The app dynamically generates authentication parameters in its runtime process, which an attacker with low privileges can extract and use to invoke the backend endpoint /account/verify.serv . This allows a...

CVE-2026-93972

SourceCodester Online Reviewer Management System 1.0 contains a SQL injection vulnerability in the file /reviewer_0/admins/assessments/course/btn_functions.php, exploitable remotely via manipulation of the courseID parameter without authentication. The CNA rates the base severity as HIGH (CVSS v3...

CVE-2026-93971

An information disclosure vulnerability was identified in aiyiyi121 SxDevOps versions 1.0 and 1.1, located in an unknown function of the file backend/sxdevops/settings.py . The weakness can be exploited remotely without authentication, leading to a low confidentiality impact (CVSS 3.1: 5.3 Medium...

CVE-2026-93970

aiyiyi121 SxDevOps (versions 1.0/1.1) contains a hard-coded credentials vulnerability in the file backend/sxdevops/settings.py within the Settings Handler component. The flaw is exploitable remotely over the network with no required privileges or user interaction, rated CVSS 3.1: 7.3 (HIGH) with ...

CVE-2026-93969

SxDevOps (by aiyiyi121) versions 1.0 and 1.1 contain a hard-coded credential vulnerability in the ensure_default_superuser function within rbac/services.py. An unauthenticated remote attacker can leverage this to gain unauthorized access, resulting in low impact on confidentiality, integrity, and...

CVE-2026-93968

aiyiyi121 SxDevOps versions 1.0 and 1.1 are affected by an improper privilege management vulnerability in the update function of the UserSerializer component (file backend/rbac/serializers.py). A remote attacker with high privileges can manipulate the update function to alter user privileges, res...

CVE-2026-93967

CVE-2026-93967 affects aiyiyi121 SxDevOps 1.0/1.1 , a DevOps platform. The vulnerability is a command injection in the function generate_host_task within the file backend/aiops/services.py (component: Command Handler). Manipulating the command argument allows an authenticated remote user to injec...

CVE-2026-92422

The Meow Gallery WordPress plugin (versions before 5.5.5 ) is vulnerable to unauthenticated arbitrary shortcode execution . The flaw exists because the plugin fails to properly sanitize user-supplied values before concatenating them into a shortcode string, which is then processed by the WordPres...

CVE-2026-92423

The Meow Gallery WordPress plugin versions before 5.5.5 is vulnerable to a draft and private post disclosure. The root cause is a failure to perform proper capability checks or restrict results to the requesting user's own posts before returning data via the fetch_posts function. This allows auth...

CVE-2026-92540

The Import and export users and customers WordPress plugin (versions before 2.5.2 ) is vulnerable to privilege escalation . The software fails to correctly enforce the promote_users capability during a CSV import operation. This flaw allows users who only possess the create_users capability to by...

CVE-2026-92965

The TikTok WordPress plugin versions 1.2.0 through 1.4.1 is vulnerable to unauthenticated OAuth code redemption . The root cause is a failure to verify request authorization when processing a sign-in code provided in the URL. This allows any visitor to force the site to redeem an arbitrary code a...

CVE-2026-92410

The Sign-up Sheets WordPress plugin, in versions before 2.4.0 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is the insufficient validation of the CSRF nonce protecting the sign-up deletion action. An attacker can exploit this by sending a forged request to delete s...

CVE-2026-92541

The Import and export users and customers WordPress plugin (versions before 2.5.2 ) contains a privilege escalation vulnerability. The plugin fails to enforce the promote_users capability within its front-end import functionality. Consequently, an attacker with only the create_users capability ca...

CVE-2026-87067

The Forminator Forms WordPress plugin (versions before 1.57.2.1 ) is vulnerable to Authenticated Remote Code Execution (RCE) via PHP Object Injection . The flaw exists because the plugin fails to restrict which classes can be instantiated during the deserialization of values received from an XML-...

CVE-2026-87839

The Tripzzy WordPress plugin (versions before 1.5.1 ) contains an improper access control vulnerability. The root cause is a lack of authorization checks and failure to validate the identifier of the object being removed within an AJAX action . Because this action is accessible to unauthenticated...

CVE-2026-87068

The Forminator Forms WordPress plugin (versions before 1.57.2.1 ) is vulnerable to an Authenticated Privilege Escalation flaw. The issue occurs because the plugin fails to apply consistent role validation when a registration form is nested inside an imported quiz. An attacker with permissions to ...

CVE-2026-87840

The Tripzzy WordPress plugin (versions before 1.5.1 ) contains an improper access control vulnerability allowing unauthenticated booking data tampering. The plugin fails to perform necessary capability or ownership checks on administrative booking-management actions. These actions are exposed to ...

CVE-2026-84223

The Kirki WordPress plugin (versions 6.0.0 - 6.3.0 ) is vulnerable to a Stored XSS flaw because it fails to sanitize uploaded SVG files while making them uploadable site-wide. This allows users with author-level access and above to upload a file containing malicious JavaScript . Because the file ...

CVE-2026-85017

The Unlimited Elements For Elementor WordPress plugin (versions before 2.0.20 ) is vulnerable to PHP Object Injection . The root cause is a missing capability check on an AJAX action , which allows the plugin to deserialize attacker-controlled stored data. This flaw enables authenticated attacker...

CVE-2026-82842

The SAML Single Sign On WordPress plugin (versions before 6.0.0 ) is vulnerable to an unauthenticated privilege escalation flaw. The root cause is that the plugin fails to honor configured criteria for linking incoming single sign-on identities to WordPress accounts, instead always resolving iden...

CVE-2026-81653

The NextGEN Gallery (Photo Gallery, Sliders, Proofing and Themes) WordPress plugin versions before 4.5.0 is vulnerable to an Insecure Direct Object Reference (IDOR) . The root cause is a failure to verify that a user owns the gallery associated with a specific image. Consequently, users granted g...

CVE-2026-81654

The NextGEN Gallery WordPress plugin (versions before 4.5.0 ) is vulnerable to an authorization bypass because it fails to verify if a user possesses the options capability before saving image sizing settings. This allows users with only gallery-management privileges to modify settings that affec...