CVE Vulnerabilities - 21 September 2026

The Feiyu Star Router (model B-MB5E202-210322-r11656) allows an attacker to send specially crafted data to the send_order.cgi page, which can run arbitrary commands on the device. This can be done fro...

The Feiyu Star Router can be tricked into running unauthorized commands when a specially crafted request is sent to its web interface. This means an attacker on the network could potentially take cont...

The RooCMS website software (versions up to 1.2.2, 1.3.4, and 1.4RC2) lets an attacker send specially crafted data to the site_pagePHP.php page and run their own commands on the server. This can be do...

The iDX and Evo iDX web interface can be tricked into sending malformed HTTP responses when a specially crafted value is sent to the "Success" parameter. This could let an attacker inject unwanted hea...

The iDirect iDX and Evo iDX web interfaces can be tricked into sending visitors to a different website by manipulating the Host field. This open‑redirect can be launched from anywhere on the internet ...

The User Profile API in Omega Solution FBP Fulfillment by People can be tricked into granting access to data without proper permission checks. This means an attacker could view or modify other users' ...

The HRM OS version of Omega Solution allows an attacker to send a specially crafted request to the role‑permission endpoint and modify role identifiers. This can give unauthorized users the ability to...

The login page of WuzhiCMS (versions up to 4.1.0) can be tricked into sending visitors to a web address of the attacker. This open redirect could be used to lure users to phishing sites or other malic...

The Beszel monitoring tool (versions before 0.19.0) allows any user who has logged in to create or delete alert rules for computers they do not have permission to view. This could let a malicious insi...

Version 0.9.9 of Thinkst Applied Research’s OpenCanary has a weakness in its Redis component that lets anyone on the network cause the program to use unlimited memory, which can stop it from working. ...

The draw.io diagramming tool (versions before 30.2.7) forwards requests to its export server without checking the path, so a specially crafted request can reach other internal URLs. This can let outsi...

Versions of GoCD from 13.1.0 through 26.1.0 let any signed‑in user call a support API that should be admin‑only. By using that call, a user can view command‑line arguments and internal paths for sourc...

If the Redis feature on a Thinkst Canary honeypot is turned on, anyone on the network can cause it to stop working, making it unavailable for monitoring. The issue is fixed in the latest software rele...

The To Do List Member WordPress plugin (versions up to 1.6) allows anyone on the internet to use its import feature to create published posts and categories without logging in. This means unwanted or ...

The xxl-job tool (versions up to 3.5.0) lets an attacker place malicious code into the Name field on the /jobgroup/insert page. When a user views that page, the hidden code can run in their browser, p...

The Kanban board feature in Hyve5 Leantime versions up to 3.9.8 lets attackers inject malicious code into web pages viewed by users. This can be triggered remotely and could cause unwanted actions or ...

The Red Hat build of Keycloak and Red Hat Single Sign‑On 7 can mix up access rights when two users create resources with the same name. When a user asks for a token, the system may wrongly combine per...

The web page used to create and edit scheduled jobs in xxl-job does not properly clean the job name and author fields. An attacker who can send a crafted request could cause a user's browser to execut...

The shzh version 10.7.2.693 includes a driver (shdrv_x64.sys) that can be forced to stop working if a local user sends a specially crafted process ID. This causes the computer to become unresponsive a...

If you run Hatchet version earlier than 0.95.3, a worker from one customer could see the result of another customer's background task when it knows the task's unique ID. This only applies to multi‑ten...

In Red Hat Build of Keycloak and Red Hat Single Sign‑On 7, an administrator can require users to set up two‑factor authentication, but a user can avoid this by clicking a special session‑restart link ...

Versions of Joplin from 1.4.0 through 3.7.2 allow a note to include a hidden link that bypasses the app's safety checks. On Windows, clicking such a link can cause the computer to automatically send t...

The open‑source Warpgate bastion host (versions before 0.27.6) can insert extra HTML into the single‑sign‑on return page when a specially crafted redirect or error value is used. This can cause a user...