CVE Vulnerabilities - 27 September 2026

Seetong T8108 series lets attackers access without login

CVE-2026-100886

The Debug Service on Seetong T8108, T8108P, T8116 and T8232 devices does not correctly verify who is connecting, so an outsider could reach the device over the network. Because the flaw can be exploit...

9.3

Citrix NetScaler ADC and Gateway can mishandle web traffic

CVE-2026-88773

Older versions of Citrix NetScaler ADC and NetScaler Gateway may treat incoming web requests differently, allowing a single request to be split and processed incorrectly. This can let an attacker bypa...

9.3

D-Link DIR-895L remote attacker can corrupt memory

CVE-2026-100740

The D-Link DIR-895L router contains a flaw in its L2TP control channel code that lets an attacker send specially crafted data and write outside the intended memory area. This can cause the device to c...

8.6

Nezha can redirect login to attacker‑controlled site

CVE-2026-101090

Nezha version 2.2.3 may use the web address supplied by an attacker during the OAuth2 login process instead of the correct server address when a specific setting is left blank. This can cause a victim...

9.3

Nezha can let forged host hijack OAuth login

GHSA-rf68-8gjr-36q7

Nezha version 2.2.3 may use a web address supplied by an attacker when the optional dashboard host setting is left blank. This can cause a victim’s login to be redirected to a site controlled by the a...

9.3

Obot platform Docker quickstart gives anyone admin rights

CVE-2026-101065

The Docker quick‑start guide for Obot runs the service publicly on port 8080 without requiring a login, and treats every request as an administrator. Anyone who can reach that port can control the Obo...

9.3

Citrix NetScaler ADC and Gateway may crash or misbehave

CVE-2026-88777

Versions of Citrix NetScaler ADC and NetScaler Gateway older than the listed releases can experience a memory overflow that may cause the device to behave unexpectedly or stop working. This could lead...

8.8

Citrix NetScaler ADC and Gateway can crash or misbehave

CVE-2026-88776

Versions of Citrix NetScaler ADC and NetScaler Gateway older than the listed releases can experience a memory overflow that may cause the system to behave unpredictably or stop working altogether. Thi...

8.8

Citrix NetScaler ADC and Gateway may crash or hang

CVE-2026-88775

Older versions of Citrix NetScaler ADC and NetScaler Gateway can run into a memory overflow that may cause the device to behave unexpectedly, crash, or stop responding. This can interrupt network traf...

8.8

Citrix NetScaler lets attackers run commands remotely

CVE-2026-88771

The NetScaler ADC and NetScaler Gateway can be tricked into accepting harmful input, letting anyone on the network execute commands on the device. This could give an attacker control over the load bal...

9.5 KEV

Unbound DNS resolver could be tricked into running code

RHSA-2026:72199

The Unbound DNS server packages for Red Hat (including the main program, libraries, development files, debug info, and Python bindings) may allow an attacker to supply crafted data that could cause th...

9.8

hMailServer allows remote code execution via crafted password

CVE-2026-100741

Versions 6.0.0 through 6.3.3 of hMailServer on Windows can run any script if an attacker sends a specially formed password containing a backslash and an apostrophe. This requires event scripting to be...

9.8

obot pre‑v0.21.1 lets logged‑in users access restricted MCP

CVE-2026-101084 GHSA-vw82-7fv8-r6gp

Versions of obot earlier than 0.21.1 do not check whether a user is allowed to use the /mcp-connect function. As a result, any user who is signed in and knows a server ID can connect to back‑end MCP s...

9.3

obot before v0.21.1 lets any logged-in user reach restricted servers

GHSA-vw82-7fv8-r6gp GO-2026-5678 CVE-2026-101084

Versions of obot older than 0.21.1 do not properly check who is allowed to use the /mcp-connect feature. As a result, any user who has logged in can connect to back‑end MCP servers if they know the se...

8.6

Contrast lets malicious container image be substituted

CVE-2026-100833 GHSA-m2qg-wrxv-h898

Versions of Contrast before 1.23.1 can create security rules that don’t check the exact identity of container images. If someone with access to the Kata agent interface (such as a cluster administrato...

8.6

wolfSSL 5.9.2 may accept out-of-scope certificate names

CVE-2026-89134 DEBIAN-CVE-2026-89134 UBUNTU-CVE-2026-89134

The wolfSSL library version 5.9.2 can mistakenly trust a digital certificate that contains a special address field instead of a regular website name. This means a connection could be made to a server ...

7.6

vm2 allows sandbox escape via custom module resolver

GHSA-c9wr-qm7p-p6vc

The vm2 library (versions before 3.12.2) lets untrusted code break out of its sandbox when a custom module resolver is used. An attacker can load a nearby file that isn’t supposed to be allowed, causi...

9.9

vm2 allows untrusted code to break out of sandbox

GHSA-c9wr-qm7p-p6vc

The vm2 library used in GitHub Actions can let untrusted code slip past its safety checks and run directly on the host system. This could let an attacker execute any code they want on your server. Upd...

9.5

Obot before v0.23.0 allows attacker to impersonate logged‑in users

CVE-2026-101062

Versions of the Obot platform up to 0.22.1 that have authentication turned on let anyone register a new client application without proof and set any redirect address. An attacker can trick a logged‑in...

8.7

Obot lets attackers hijack user login via OAuth registration

GHSA-xwmw-prc4-v3cr

Versions of Obot before 0.23.0 let anyone register a fake application and receive a code that grants full access to a logged‑in user’s account. An attacker can then act as that user and read or change...

8.7

Sylius lets attackers log into admin API with fake token

CVE-2026-100871 GHSA-f6mx-qxjc-55xf

Versions of Sylius listed above issue login tokens that do not identify which part of the system created them. An attacker can create a regular shop account using an admin's email, get a token, and th...

8.7

Sylius admin password reset can be redirected to attacker

CVE-2026-100870 GHSA-77w3-2367-7xvq

Sylius builds password‑reset links for administrators using the website address sent by the browser, without checking it. An attacker can trick the system into sending those links to a domain they con...

8.7

Download Manager Pro lets attackers inject scripts into admin page

CVE-2026-86609

The Download Manager Pro WordPress plugin (versions before 7.5.6) fails to clean data entered through its email‑locked download subscription form. This lets unauthenticated users place malicious code ...

8.8

Heym before 0.0.53 lets attackers run code on server

CVE-2026-100865 GHSA-pm6h-x3h5-j38h CVE-2026-101050 CVE-2026-101049

The Heym service versions earlier than 0.0.53 allow anyone with a valid login to change workflow rules or upload crafted templates that cause the system to execute any Python or operating‑system comma...

8.7

heymrun heym lets logged‑in users run arbitrary code

CVE-2026-100864 GHSA-87x2-9jwx-7gh4

Versions of heym before 0.0.91 let anyone with a valid account craft special expressions that break out of the sandbox and run any Python command on the server. This could let an attacker control the ...

8.7