CVE Vulnerabilities - 22 September 2026

The /dashboard/userprofile.php page in College-Notes-Gallery lets a remote user send any file to the server without checks. This could let an attacker place malicious code on the system, leading to fu...

Versions of Moonshot AI Kimi Code up to 0.31.0 let an attacker trigger the system to run arbitrary operating system commands through a faulty configuration loader. This can be done from outside your n...

The OpenAPI component in Yonyou U8cloud version 5.x can be tricked into running unintended database commands when a specially crafted request is sent. This could let an attacker read, change, or delet...

OctoPrint version 1.0.0 includes a function that can be tricked into running any command on the host computer. An attacker who can reach the Command API could execute commands, potentially taking cont...

The login part of the Mstfakts College Management System can be tricked into keeping a user’s existing session ID, allowing an attacker who knows that ID to take over the user’s account from anywhere ...

The template engine in mtrano APENCMS lets an attacker send specially crafted data that is run as code on the server. This can be triggered from anywhere on the internet, giving the attacker control o...

The hosp_order application from sfturing can be tricked into running malicious code when a user submits a specially crafted search query. This can happen from anywhere on the internet and could let at...

The changedetection.io web tool (versions up to 0.60.7) lets an attacker supply a crafted file name to a function that serves static files. This can cause the server to reveal or serve any file on its...

The file‑download feature in OctoPrint version 1.0.0 does not properly check the name of the file being requested. An attacker who can send a specially crafted request from anywhere on the Internet co...

The bsdtar program and its related utilities (bsdcat, bsdcpio, bsdunzip) on Red Hat systems can be manipulated to run code that an attacker provides. This could let an attacker gain control or disrupt...

In versions of Cloudreve before 4.18.0, an OAuth token that was supposed to allow only read‑only access could also be used to call admin functions that change data, such as checking WOPI service endpo...

IBM Financial Transaction Manager running on RedHat OpenShift does not properly enforce two-way encryption checks, allowing a remote attacker to capture sensitive information. This could expose transa...

The screenshot feature in changedetection.io versions up to 0.60.7 accepts a file name that can be tricked into accessing files outside its own folder. An attacker could use this to view sensitive fil...

The changedetection.io web tool (versions up to 0.60.7) compares passwords in a way that takes slightly longer when the correct password is used. An attacker who can measure these tiny time difference...

The Ruby 3.4 packages provided in Red Hat hardened images (including the main runtime, bundled gems, default gems, development files, and documentation) had a bug that could stop security fixes from b...

The bootupd and rust-bootupd components used in Red Hat hardened images contain bugs that could let an attacker increase their access rights on a system. This could lead to unauthorized changes or con...

The GNU C Library (glibc) loader has a flaw that can be triggered when certain programs use a special path setting starting with $ORIGIN. This can cause the program to stop working or expose some of i...

The visual selector feature in Changedetection.io versions up to 0.55.8 lets an attacker insert harmful script code through a specially crafted input. This could let a remote attacker affect what user...

The Dark Reader browser add‑on, which darkens web pages, could cause a website to make the extension fetch a small image from a program running on the user’s own network without any authentication. Th...