CVE Vulnerabilities - 21 September 2026

MaxKB before 2.10.5-lts can run commands from chat input

CVE-2026-77521 GHSA-f36j-f34j-h3rx

The MaxKB AI assistant lets users send prompts that can trigger the system to execute operating‑system commands without needing approval. This could allow an attacker to run unwanted code on the serve...

10.0

Netcore NBR200V2 allows remote command injection via network tools

CVE-2026-94097

The Netcore NBR200V2 device version 1.3.241127.071246 contains a flaw in its web-based network tools page that lets an attacker run arbitrary commands on the system. This can be triggered over the net...

9.3

Ajenti admin panel lets low‑privilege users gain full system control

CVE-2026-79920 GHSA-j8xf-5fw2-f99q

In versions of Ajenti before 2.2.16, any signed‑in user could ask the system to install, remove, or upgrade plugins. Because the request runs as the system’s administrator (root), a user without prope...

9.9

Netcore NBR200V2 router allows remote code execution

CVE-2026-94101

The router's software component that handles VLAN settings can be tricked into overwriting memory when a specially crafted WAN number is sent. An attacker on the network could exploit this to run thei...

8.6

Netcore NBR200V2 router allows remote code execution via VLAN setting

CVE-2026-94100

The router’s WAN VLAN configuration feature can be tricked into overflowing its memory when a specially crafted VLAN request is sent from outside the network. This could let an attacker run their own ...

8.6

Netcore NBR200V2 allows remote command execution via restore

CVE-2026-94099

The Netcore NBR200V2 device can be tricked into running your own commands when its backup restore feature processes a specially crafted web request. An attacker on the network could use this to take c...

8.6

Netcore NBR200V2 allows remote command injection via LAN IP settings

CVE-2026-94096

The Netcore NBR200V2 device can be tricked into running unauthorized commands when an attacker changes the IPv4 setting in its LAN configuration tool. This can be done over the network, potentially gi...

8.6

Netcore NBR200V2 traceroute feature allows remote code execution

CVE-2026-94095

The traceroute diagnostic tool on Netcore NBR200V2 can be tricked into running any command by sending a specially crafted URL. An attacker on the network could use this to take control of the device. ...

8.6

gray-matter can run unwanted code when processing JS front matter

CVE-2026-78847

If your application uses gray-matter to read front‑matter and allows the language to be set to JavaScript, the library may execute that code automatically. This could let an attacker run arbitrary com...

9.8

Univer 1.0.0-alpha.2 can run attacker code remotely

CVE-2026-88405

The RemoteRegisterFunctionService component in Univer version 1.0.0-alpha.2 can be tricked into running any code an attacker sends. This could let an attacker take control of the system or steal data....

9.8

Univer can let remote attackers run any code

CVE-2026-88404

The version 1.0.0-alpha.2 of Univer contains a flaw in its script execution service that lets a specially crafted request run any commands on the server. This could let attackers take control of the s...

9.8

NocoBase 2.1.21 allows database data theft via crafted query

CVE-2026-88402

The checkSQL feature in NocoBase version 2.1.21 can be tricked into running unwanted database commands, letting an attacker view private information stored in the system. This could expose customer re...

9.8

ZLMediaKit HTTP API lets attackers run code

CVE-2026-67827

The ZLMediaKit media server’s web interface can be accessed without a password, allowing someone on the network to change a setting that runs any command on the server. This could let an attacker take...

9.8

Perl Email Sender library can run attacker commands on Windows

CVE-2026-93012 UBUNTU-CVE-2026-93012

The Email::Sender::Transport::Sendmail module for Perl (versions before 2.602) builds a single command line that includes the sender and recipient addresses and passes it to the Windows command shell....

9.8

Mailu mail server can be tricked to skip login

CVE-2026-85751 GHSA-rfhj-4wcq-74xg

Mailu installations that use proxy authentication but do not set the REAL_IP_HEADER may trust a client‑controlled X‑Forwarded‑By header. An attacker can fake this header to appear as a trusted proxy a...

9.8

Apache MINA 2.0 and 2.1 allow filter bypass

CVE-2026-94301 UBUNTU-CVE-2026-94301

The Apache MINA library versions 2.0.29 through 2.0.30 and 2.1.13 through 2.1.14 still miss a security fix that prevents a special kind of bypass. This could let an attacker get around the program’s a...

9.8

CGA-mhvr-g383-2q9w

CGA-mhvr-g383-2q9w

9.8

CGA-222p-wj37-5v8h

CGA-222p-wj37-5v8h

9.8

Web to Print Online Designer lets anyone upload files

CVE-2026-82187

The Web to Print Online Designer plugin for WordPress does not check what kind of files are uploaded and gives out the upload token to anyone who asks. This means an unauthenticated person could uploa...

9.8

OpenStack Octavia allows load‑balancer config injection

CVE-2026-94572 UBUNTU-CVE-2026-94572 DEBIAN-CVE-2026-94572

The Octavia component that creates load balancers can accept special characters in TLS settings without checking them. An attacker who controls a TLS‑enabled load balancer could insert new lines and c...

9.4

OpenStack Octavia Amphora allows redirect URL injection

CVE-2026-94571 UBUNTU-CVE-2026-94571 DEBIAN-CVE-2026-94571

If you use OpenStack Octavia with the Amphora driver, a user who can manage load balancers could place control characters in a redirect URL, causing raw text to be written into the HAProxy configurati...

9.4

libXrender allows malicious X server to run code on clients

CVE-2026-88807 DEBIAN-CVE-2026-88807 UBUNTU-CVE-2026-88807 ROOT-OS-DEBIAN-12-CVE-2026-88807

Versions of libXrender older than 0.9.13 on Debian, Ubuntu and other Linux systems can be tricked by a rogue X server into executing code inside any program that connects to it. This could let an atta...

9.4

Warpgate runs malicious code after crafted SSO link

CVE-2026-58491 GHSA-3c3w-75j2-7h74

Versions of Warpgate before 0.25.5 allow a specially crafted link to insert unwanted web page code after a user completes single sign‑on authentication. This can let an attacker view the user’s sessio...

9.3

Fluent Bit may allow remote code execution via crafted PONG

CVE-2026-61674 GHSA-jrp8-r9hx-gf73 BIT-fluent-bit-2026-61674

Versions of Fluent Bit from 0.11.0 through 5.0.8 can be tricked into running malicious code if an attacker sends an overly long response during the secure‑forward handshake. The problem occurs when th...

9.2

MaxKB allows credential injection leading to code execution

CVE-2026-79916 GHSA-2324-7xjr-9qxg

In MaxKB versions before 2.10.5‑lts, a signed‑in workspace user can place special characters into the fields used for AWS Bedrock credentials. These characters are written directly to the system's AWS...

9.1