# CVEs published 2026-09-06

92 CVEs were published on September 6, 2026: 12 critical, 24 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-86235](https://cve.now/CVE-2026-86235.md): itsourcecode Sales and Inventory System pos\_transac.php add sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-86234](https://cve.now/CVE-2026-86234.md): itsourcecode Sales and Inventory System cust\_transac.php add sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-86233](https://cve.now/CVE-2026-86233.md): itsourcecode Sales and Inventory System us\_del.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-86232](https://cve.now/CVE-2026-86232.md): itsourcecode Sales and Inventory System sup\_del.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-86231](https://cve.now/CVE-2026-86231.md): mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation (CVSS 6.3, mwiede jsch)
- [CVE-2026-86228](https://cve.now/CVE-2026-86228.md): JeecgBoot AiragModelController.java exportXls access control (CVSS 5.3, JeecgBoot)
- [CVE-2026-86304](https://cve.now/CVE-2026-86304.md): MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse\_assertion builds Net::SAML2::Binding::POST without a trust anchor (CVSS 9.8, MojoX-Authentication)
- [CVE-2026-86227](https://cve.now/CVE-2026-86227.md): valkey-io valkey kvstore.c kvstoreGetHashtable out-of-bounds (CVSS 2.3, valkey-io valkey)
- [CVE-2026-86226](https://cve.now/CVE-2026-86226.md): Projectwolds Online Attendance System profile.php cross site scripting (CVSS 5.1, Projectwolds Online Attendance System)
- [CVE-2026-86225](https://cve.now/CVE-2026-86225.md): SourceCodester Class and Exam Timetabling System modal\_add\_room.php mysqli\_query sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-86224](https://cve.now/CVE-2026-86224.md): SourceCodester Class and Exam Timetabling System modal\_add\_product.php mysqli\_query sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-86223](https://cve.now/CVE-2026-86223.md): SourceCodester Class and Exam Timetabling System modal\_add\_coursea.php mysqli\_query sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-86222](https://cve.now/CVE-2026-86222.md): SourceCodester Class and Exam Timetabling System modal\_add\_course2.php mysqli\_query sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-86221](https://cve.now/CVE-2026-86221.md): SourceCodester Class and Exam Timetabling System modal\_add\_course1.php mysqli\_query sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-82209](https://cve.now/CVE-2026-82209.md): domain-scoped PSL domain cookie (CVSS 8.2, curl)
- [CVE-2026-82208](https://cve.now/CVE-2026-82208.md): wolfSSL CA-cache hit overrides callback (CVSS 7.5, curl)
- [CVE-2026-80255](https://cve.now/CVE-2026-80255.md): secure cookie attribute bypass with tab (CVSS 7.5, curl)
- [CVE-2026-80231](https://cve.now/CVE-2026-80231.md): native CA store conn reuse (CVSS 7.5, curl)
- [CVE-2026-80230](https://cve.now/CVE-2026-80230.md): OpenSSL pinning bypass (CVSS 7.5, curl)
- [CVE-2026-80229](https://cve.now/CVE-2026-80229.md): OpenSSL provider use-after-free (CVSS 7.5, curl)
- [CVE-2026-19931](https://cve.now/CVE-2026-19931.md): Negotiate ambient user conn reuse (CVSS 9.8, curl)
- [CVE-2026-18924](https://cve.now/CVE-2026-18924.md): HTTP/2 server push UAF (CVSS 9.1, curl)
- [CVE-2026-13608](https://cve.now/CVE-2026-13608.md): OpenLDAP SASL authentication bypass (CVSS 7.4, curl)
- [CVE-2026-86219](https://cve.now/CVE-2026-86219.md): Authen::SASL::Perl::DIGEST\_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server\_step (CVSS 9.8, Authen-SASL)
- [CVE-2026-86220](https://cve.now/CVE-2026-86220.md): SourceCodester Class and Exam Timetabling System modal\_add\_course.php mysqli\_query sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-82750](https://cve.now/CVE-2026-82750.md): Unbounded EIP-7702 authorization list in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors account delegation (CVSS 8.3, ZenHive mpp)
- [CVE-2026-82751](https://cve.now/CVE-2026-82751.md): Unbounded key authorization in mpp Tempo fee-payer sponsorship inflates gas cost and sponsors access-key provisioning (CVSS 8.3, ZenHive mpp)
- [CVE-2026-83534](https://cve.now/CVE-2026-83534.md): PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize\_database\_parallel() (CVSS 6.4, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-19634](https://cve.now/CVE-2026-19634.md): PostgreSQL Anonymizer: SQL injection in import\_database\_rules() and import\_roles\_rules() via crafted object names / JSON (CVSS 6.4, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-19633](https://cve.now/CVE-2026-19633.md): PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries (CVSS 8.8, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-86217](https://cve.now/CVE-2026-86217.md): code-projects Hotel and Tourism Reservation in PHP Database Backup hotel\_db%20(1).sql information disclosure (CVSS 6.9, code-projects Hotel and Tourism Reservation in PHP)
- [CVE-2026-86283](https://cve.now/CVE-2026-86283.md): MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data (CVSS 7.1, MISP)
- [CVE-2026-86216](https://cve.now/CVE-2026-86216.md): code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting (CVSS 5.3, code-projects Hotel and Tourism Reservation in PHP)
- [CVE-2026-86215](https://cve.now/CVE-2026-86215.md): Mstfakts College-Management-System Logout server.php session expiration (CVSS 5.3, Mstfakts College-Management-System)
- [CVE-2026-86214](https://cve.now/CVE-2026-86214.md): Mstfakts College-Management-System login.php improper authentication (CVSS 6.9, Mstfakts College-Management-System)
- [CVE-2026-86213](https://cve.now/CVE-2026-86213.md): Mstfakts College-Management-System Search university.php mysqli\_query sql injection (CVSS 6.9, Mstfakts College-Management-System)
- [CVE-2026-86259](https://cve.now/CVE-2026-86259.md): OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation (CVSS 9.0, THU-MAIC OpenMAIC)
- [CVE-2026-86258](https://cve.now/CVE-2026-86258.md): nbviewer through 1.0.1 Path Traversal via LocalFileHandler (CVSS 8.2, jupyter nbviewer)
- [CVE-2026-86257](https://cve.now/CVE-2026-86257.md): wger before 2.6 CSV Formula Injection via member export (CVSS 4.8, wger-project wger · wger)
- [CVE-2026-86256](https://cve.now/CVE-2026-86256.md): wger before 2.6 Open Redirect via trainer-login next parameter (CVSS 5.1, wger-project wger · wger)
- [CVE-2026-86255](https://cve.now/CVE-2026-86255.md): wger before 2.5 Uncontrolled Resource Consumption via date\_sequence (CVSS 7.1, wger-project wger · wger)
- [CVE-2026-86254](https://cve.now/CVE-2026-86254.md): wger Incomplete Authorization Fix Cross-Tenant Account Deletion (CVSS 6.1, wger-project wger)
- [CVE-2026-86253](https://cve.now/CVE-2026-86253.md): h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments (CVSS 8.2, h3js h3 · h3)
- [CVE-2026-86252](https://cve.now/CVE-2026-86252.md): h3 before 1.15.9 SSE Event Injection via Carriage Return (CVSS 6.9, h3js h3 · h3)
- [CVE-2026-86251](https://cve.now/CVE-2026-86251.md): h3 before 1.15.9 Path Traversal via Double Decoding (CVSS 8.2, h3js h3 · h3)
- [CVE-2026-86250](https://cve.now/CVE-2026-86250.md): h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie (CVSS 8.7, h3js h3 · h3)
- [CVE-2026-86205](https://cve.now/CVE-2026-86205.md): h3 before 2.0.1-rc.18 Open Redirect via redirectBack() (CVSS 5.3, h3js h3 · h3)
- [CVE-2022-51009](https://cve.now/CVE-2022-51009.md): PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry (CVSS 8.7, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2022-51008](https://cve.now/CVE-2022-51008.md): PocketMine-MP before 4.12.3 Denial of Service via Unauthenticated Sessions (CVSS 6.9, pmmp PocketMine-MP)
- [CVE-2021-48007](https://cve.now/CVE-2021-48007.md): PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket (CVSS 7.1, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2021-48006](https://cve.now/CVE-2021-48006.md): PocketMine-MP before 4.0.3 Operator Privilege Escalation via Case Sensitivity (CVSS 4.8, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2020-37277](https://cve.now/CVE-2020-37277.md): PocketMine-MP before 3.15.4 Denial of Service via InventoryTransaction (CVSS 7.1, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2026-86242](https://cve.now/CVE-2026-86242.md): Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds (CVSS 8.1, maximhq Bifrost)
- [CVE-2026-86212](https://cve.now/CVE-2026-86212.md): Open5GS AMF/MME improper authorization (CVSS 5.3, Open5GS)
- [CVE-2026-86211](https://cve.now/CVE-2026-86211.md): rabindralamsal inventory-management-system Login index.php sql injection (CVSS 6.9, rabindralamsal inventory-management-system)
- [CVE-2026-86210](https://cve.now/CVE-2026-86210.md): SourceCodester Class and Exam Timetabling System delete\_user\_account.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-80437](https://cve.now/CVE-2026-80437.md): Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags (CVSS 4.8, Ninja Forms)
- [CVE-2026-80439](https://cve.now/CVE-2026-80439.md): Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Shortcode Execution via Action Setting Mail-Tags (CVSS 4.8, Redirection for Contact Form)
- [CVE-2026-19862](https://cve.now/CVE-2026-19862.md): JetFormBuilder \< 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action (CVSS 4.8, JetFormBuilder)
- [CVE-2026-19859](https://cve.now/CVE-2026-19859.md): JetFormBuilder \< 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter (CVSS 6.5, JetFormBuilder)
- [CVE-2026-86209](https://cve.now/CVE-2026-86209.md): SourceCodester Class and Exam Timetabling System delete\_user.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-86208](https://cve.now/CVE-2026-86208.md): SourceCodester Class and Exam Timetabling System delete\_teacher.php sql injection (CVSS 6.9, SourceCodester Class and Exam Timetabling System)
- [CVE-2026-86183](https://cve.now/CVE-2026-86183.md): diem-project diem dmWidget BasedmWidgetActions.class.php authorization (CVSS 6.9, diem-project diem)
- [CVE-2026-86182](https://cve.now/CVE-2026-86182.md): diem-project diem dmConsole actions.class.php executeCommand cross-site request forgery (CVSS 5.3, diem-project diem)
- [CVE-2026-86181](https://cve.now/CVE-2026-86181.md): code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting (CVSS 5.1, code-projects Task Management System)
- [CVE-2026-86180](https://cve.now/CVE-2026-86180.md): code-projects Task Management System In PHP Login index.php sql injection (CVSS 6.9, code-projects Task Management System In PHP)
- [CVE-2026-86179](https://cve.now/CVE-2026-86179.md): code-projects Daily Expense Manager Database Backup exp\_ak.sql information disclosure (CVSS 6.9, code-projects Daily Expense Manager)
- [CVE-2026-86172](https://cve.now/CVE-2026-86172.md): DefaultFuction CRM delete.php sql injection (CVSS 5.3, DefaultFuction CRM)
- [CVE-2026-86171](https://cve.now/CVE-2026-86171.md): DefaultFuction CRM delete.php sql injection (CVSS 5.3, DefaultFuction CRM)
- [CVE-2026-85038](https://cve.now/CVE-2026-85038.md): B2BKing \< 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role Selection (CVSS 5.3, B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — W…)
- [CVE-2026-84219](https://cve.now/CVE-2026-84219.md): Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding (CVSS 7.5, Kirki)
- [CVE-2026-84028](https://cve.now/CVE-2026-84028.md): Bold Page Builder \< 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional\_settings (CVSS 6.8, Bold Page Builder)
- [CVE-2026-75793](https://cve.now/CVE-2026-75793.md): SureCart \< 4.7.0 - Unauthenticated Account Creation with Automatic Login (CVSS 6.5, SureCart)
- [CVE-2026-18480](https://cve.now/CVE-2026-18480.md): SureCart \< 4.6.3 - Subscriber+ Administrator Account Takeover (CVSS 8.8, SureCart)
- [CVE-2026-13159](https://cve.now/CVE-2026-13159.md): Real Estate Papi \<= 1.0.5 - Subscriber+ Plugin Installation (CVSS 4.3, Real Estate Papi)
- [CVE-2026-86170](https://cve.now/CVE-2026-86170.md): DefaultFuction CRM edit.php sql injection (CVSS 5.3, DefaultFuction CRM)
- [CVE-2026-86168](https://cve.now/CVE-2026-86168.md): code-projects Content Management System login.php sql injection (CVSS 6.9, code-projects Content Management System)
- [CVE-2026-86167](https://cve.now/CVE-2026-86167.md): Tenda HG10 Boa formgponConf os command injection (CVSS 9.4, Tenda HG10)
- [CVE-2026-86166](https://cve.now/CVE-2026-86166.md): Tenda HG10 Boa Web Server formWanRedirect buffer overflow (CVSS 8.7, Tenda HG10)
- [CVE-2026-86165](https://cve.now/CVE-2026-86165.md): Tenda HG10 formURL buffer overflow (CVSS 9.3, Tenda HG10)
- [CVE-2026-86164](https://cve.now/CVE-2026-86164.md): itsourcecode Sales and Inventory System trans\_view.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-86163](https://cve.now/CVE-2026-86163.md): itsourcecode Sales and Inventory System pro\_del.php sql injection (CVSS 5.3, itsourcecode Sales and Inventory System)
- [CVE-2026-86162](https://cve.now/CVE-2026-86162.md): SourceCodester Online Voting System ajax.php login sql injection (CVSS 6.9, SourceCodester Online Voting System)
- [CVE-2026-86161](https://cve.now/CVE-2026-86161.md): SourceCodester Online Voting System ajax.php delete\_category sql injection (CVSS 6.9, SourceCodester Online Voting System)
- [CVE-2026-75816](https://cve.now/CVE-2026-75816.md): Frontend Admin by DynamiApps \<= 3.29.12 - Unauthenticated Account Takeover via '\_acf\_objects' Object Identifier (CVSS 9.8, shabti Frontend Admin by DynamiApps)
- [CVE-2026-18056](https://cve.now/CVE-2026-18056.md): HivePress Authentication \<= 1.1.4 - Unauthenticated Authentication Bypass via 'access\_token' Parameter to Facebook Authenticator (CVSS 7.5, HivePress Authentication)
- [CVE-2026-16310](https://cve.now/CVE-2026-16310.md): MemberDash \<= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter (CVSS 9.8, LearnDash MemberDash)
- [CVE-2026-86218](https://cve.now/CVE-2026-86218.md): pre-authentication remote code execution (CVSS 10.0, KEV, N-able N-central)
- [CVE-2026-86160](https://cve.now/CVE-2026-86160.md): SourceCodester Online Voting System ajax.php delete\_voting sql injection (CVSS 6.9, SourceCodester Online Voting System)
- [CVE-2026-86159](https://cve.now/CVE-2026-86159.md): SourceCodester Online Voting System ajax.php save\_user sql injection (CVSS 6.9, SourceCodester Online Voting System)
- [CVE-2026-86153](https://cve.now/CVE-2026-86153.md): Tenda CP3 Redirect.cpp SetRedirectEnable privileges management (CVSS 9.4, Tenda CP3)
- [CVE-2026-86152](https://cve.now/CVE-2026-86152.md): Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection (CVSS 10.0, Tenda CP3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.