CVE Vulnerabilities - 20 September 2026

The part of the system that saves user information does not verify the role identifier correctly. Because of this, a person who can reach the system could turn a normal user into an administrator or g...

The stable-baselines3 library (up to version 2.9.0) lets an attacker craft a specially designed file that, when loaded with functions like PPO.load or VecNormalize.load, runs arbitrary code on the ser...

The pdf-tools-mcp component in cowork_bench lets an attacker supply a crafted pdf_file_path value that makes the server contact any URL it chooses. This remote request can expose internal resources or...

The template import feature in samanhappy MCPHub versions up to 1.0.32 does not correctly check user rights, so a remote attacker could gain higher privileges than intended. This could let an attacker...

The restaurant management software’s add_table page does not properly check user input, allowing a remote user to send specially crafted data that changes the way the database is queried. An attacker ...

The admin/add_menu.php page in the AdithyaYelloju Restaurant Management System accepts data for item, price, image and type without proper checking. An attacker who can send crafted values to those fi...

The Leave Management System version 1.0 contains a flaw in the /module/department/index.php page that lets an attacker send specially crafted data to run database commands. This can be exploited over ...

The nexus-mcp authentication tool runs a system command based on a URL you provide. If an attacker controls that URL, they can make the server run arbitrary commands, potentially compromising your dat...

The Leave Management System version 1.0 lets an attacker send specially crafted department IDs to the controller.php page, which can trick the database into revealing or altering data. This can be don...

The dmlc DGL library (versions up to 2.1.0) contains a function that reads data from a file path without proper checks. An attacker who can control that path can cause the program to execute their own...

The function that loads saved models in piskvorky/gensim (up to version 4.4.0) can be tricked into executing hidden code from a specially crafted file. An attacker could send such a file and cause the...

OpenClaw versions up to 2026.9.5 let a specially crafted request to the Canvas Host route consume all memory, causing the service to stop responding. The problem can be triggered from anywhere on the ...

The slideshot tool (versions up to 4.4.0) can be tricked into reading any file on the server by supplying a specially crafted path. This could let an attacker view or steal sensitive data. Update to a...

The ACE-MCP tool (versions up to 4.10.8) can be tricked into opening files outside the intended project folder. By giving a crafted path, an attacker could view system files such as /etc/hosts. Update...

The mcp-file-analyzer tool can be tricked into accessing files outside its intended folder when a specially crafted file name is supplied. This could let an attacker view or steal sensitive data on yo...

The web page /drug_recommender/index.php in SourceCodester Drug Recommendation System can be tricked by sending a specially crafted full name value. This causes the page to display attacker‑controlled...

The Mealie recipe web app (versions up to 3.25.1) can be tricked into sending requests to other servers when a specially crafted URL is supplied. This could let an attacker make the server interact wi...

Versions of Pixelfed up to 0.12.11 let a remote user request the list of known instances without signing in. This could reveal network details that should be private. Update Pixelfed to version 0.12.1...

The SearchEngine component in olivier-ls PHP-FTS versions up to 1.1.3 can incorrectly compare filter data, allowing an attacker to trigger unexpected behavior from outside the network. This could let ...

The TikTok plugin for WordPress versions before 1.4.2 accepts sign‑in codes from any visitor without checking who submitted them. This lets an attacker trigger the plugin to redeem advertising codes u...

The newbee-mall web store (versions up to 1.0.0) lets anyone upload a product with a crafted name that contains malicious code. When a visitor views that product, the code runs in their browser, which...

The web page used to change passwords in the SourceCodester Drug Recommendation System can be tricked into running code that an attacker supplies. This could let a remote attacker display false inform...

The user‑creation page in the SourceCodester Drug Recommendation System does not properly filter the name, email or password fields, so an attacker can inject malicious code that runs in a browser. Th...

The Assessment Management system (version 1.0) contains a flaw in the add‑single‑mark.php page that lets a remote user insert malicious code into the mark field. When a victim views the affected page,...

On the ZTE Z80Ultra (model NX741J), any program without special privileges can read the device’s Wi‑Fi MAC address from a system setting. This information can be used to identify or track the device, ...