CVEs published September 13, 2026

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations,…

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution from attacker-supplied files.

Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation.

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows.

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the…

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active…

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated…

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text.

A security vulnerability has been detected in dromara orion-visor up to 2.5.7.

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users.

Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default.

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint.

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275.

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in 32-bit arithmetic.

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services.

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python…

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components.

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages with header content exceeding 20,490 bytes.

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters.

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more.

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments.

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks.

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5.

The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attackers to cause a denial of service (memory consumption and…

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment, allowing an attacker who already knows…

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently…

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with…

The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after PINGREQ retries are exhausted.

Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1.

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0.

A vulnerability was found in getzep graphiti up to 0.30.2.

A vulnerability was determined in embedded-graphics up to 0.8.2.

A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2.

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f.

A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0.

A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09.

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09.

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938d.

A vulnerability was found in SourceCodester School Registration and Fee System 1.0.

A vulnerability was determined in SourceCodester School Registration and Fee System 1.0.

A vulnerability has been found in SourceCodester School Registration and Fee System 1.0.

A weakness has been identified in dromara orion-visor up to 2.5.7.

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT.

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11.

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account, allowing…

wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack.

PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index.

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files.

A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit.

A flaw has been found in simalexan api-lambda-send-email-ses up to bda6869aa81371d1e872242e74fe7d953edb818d.

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0.

A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2.

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0.

A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0.

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0.

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2.

A vulnerability was found in FlowiseAI Flowise up to 3.0.2.

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0.

A weakness has been identified in itsourcecode Sales and Inventory System 1.0.

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132.

A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64.

A weakness has been identified in PHPGurukul Bank Locker Management System 1.0.

A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0.

A vulnerability was detected in GongShengyue OnlineBooks up to dfc5eacc08d3b0396c266049548618f6fb9587ea.

A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.

A security vulnerability has been detected in lenve vhr 1.0-SNAPSHOT.

A weakness has been identified in lenve vhr 1.0-SNAPSHOT.

A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0.

A weakness has been identified in sanjevirau gsubs up to 1.0.3.

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT.

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2.

A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php.

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT.

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button, allowing…

S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed allocation for DataChangeNotification is overwritten by a successful…

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1.

A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0.

A flaw has been found in GPAC up to f1219cde.

A vulnerability was detected in GPAC up to f1219cde.

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f.

A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0.

A flaw has been found in restify node-restify up to 12.0.0.

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request, allowing unauthenticated users to retrieve other…

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions, allowing unauthenticated…

The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() in subsys/mgmt/mcumgr/grp/settings_mgmt/src/settings_mgmt.c allocate a key_name…

A vulnerability was determined in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.

A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46.

A vulnerability was determined in davenardella snap7 up to 1.4.3.

A vulnerability was found in Fengoffice Feng Office up to 3.11.13.11.

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting, allowing unauthenticated attackers to redirect visitors to an…

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-byte buffer when parsing a name= field with 64 or more characters.

Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification.

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2.

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf.

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c.

A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1.

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who…

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce…

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code.

A weakness has been identified in PHPGurukul Small CRM 4.0.

The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation page owns the account named in the request, nor that any…

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0.

A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2.

A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1.

A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1.

A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0.

A vulnerability has been found in DataEase up to 2.10.25/2.10.26.

A flaw has been found in TDuckApp tduck-platform up to 5.3.

A vulnerability was detected in stilleshan ServerStatus 1.0/2.0.

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11.

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0.

A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714.

A security vulnerability has been detected in GPAC up to f1219cde.

A vulnerability was identified in GPAC up to f1219cde.

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column.

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LINK router AC1900_AZ2 V1.0.2 via shell metacharacters, if the device is deployed in a…

FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libavformat/mov.c.

FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.

TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length.

A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0.

A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0.

A flaw has been found in Chengdu Qilu Technology Ludashi 6.1026.4715.714.