CVEs published September 6, 2026

A flaw has been found in Tenda CP3 27.5.57.101.

A vulnerability was identified in Tenda HG10 300001138.

MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor. parse_assertion in…

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the…

N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14.

A vulnerability was found in Tenda HG10 300001138.

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12.

A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials.

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key.

A vulnerability has been found in Tenda CP3 27.5.57.101.

A vulnerability was detected in Tenda CP3 27.5.57.101.

A flaw in libcurl's handling of HTTP/2 Server Push streams, when the parent handle is set to share connections with other handles, can lead to use-after-free in the cleanup process.

A vulnerability was determined in Tenda HG10 300001138.

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions.

It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the…

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the…

Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the…

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is…

The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to Go's plugin.Open.

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services.

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions.

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in…

With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns.

A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag.

A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was…

When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key…

When performing transfers via libcurl’s multi interface, pooled TLS connections can outlive their originating easy handles.

The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4.

A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification.

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0.

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0.

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0.

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0.

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0.

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0.

A vulnerability was determined in Mstfakts College-Management-System.

A vulnerability was found in Mstfakts College-Management-System.

A flaw has been found in rabindralamsal inventory-management-system 1.0.0.

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0.

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0.

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0.

A vulnerability has been found in code-projects Task Management System In PHP 1.0.

A security flaw has been discovered in code-projects Content Management System 1.0.

A vulnerability was determined in SourceCodester Online Voting System 1.0.

A vulnerability was found in SourceCodester Online Voting System 1.0.

A vulnerability has been found in SourceCodester Online Voting System 1.0.

A flaw has been found in SourceCodester Online Voting System 1.0.

MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL).

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the…

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject…

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods.

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowing unauthenticated users to create an account and receive a…

The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on…

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with superuser privilege.

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions.

A weakness has been identified in itsourcecode Sales and Inventory System 1.0.

A vulnerability was detected in DefaultFuction CRM 1.0.0.

A security vulnerability has been detected in DefaultFuction CRM 1.0.0.

A weakness has been identified in DefaultFuction CRM 1.0.0.

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0.

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0.

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation.

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic().

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility.

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas.

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py).

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname.

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns.

A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0.

A vulnerability was identified in diem-project diem up to 5.1.3.

A flaw has been found in code-projects Daily Expense Manager 1.0.

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a role selected during registration is one actually…

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into an action's…

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes,…

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends,…

A security vulnerability has been detected in JeecgBoot up to 3.9.3.

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0.

A vulnerability was identified in Mstfakts College-Management-System.

A vulnerability has been found in Open5GS 2.7.7/2.8.0.

A vulnerability was determined in diem-project diem up to 5.1.3.

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to install a fixed set of…

A security flaw has been discovered in mwiede jsch up to 2.28.5.

A security flaw has been discovered in Projectwolds Online Attendance System 1.0.

A vulnerability was found in code-projects Task Management System 1.0.

A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1.