CVEs published September 20, 2026
105 CVEs were published on September 20, 2026: 13 critical, 16 high.
- Published
- 105
- Critical
- 13
- High
- 16
- Medium
- 69
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 46
Most affected products
- aiyiyi121 SxDevOps
- 7
- SourceCodester Drug Recommendation System
- 6
- Photo Gallery, Sliders, Proofing and Themes
- 5
- OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joo…
- 4
- SourceCodester Online Reviewer Management System
- 4
- ZTE SmartLife
- 4
- code-projects Assessment Management
- 3
- code-projects Internship Management System
- 3
- Import and export users and customers
- 3
- Netcore NBR200V2
- 3
Critical 13
- CVE-2026-94097Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injectionNetcore NBR200V2
- CVE-2026-94096Netcore NBR200V2 LAN IP Configuration network_tools command injectionNetcore NBR200V2
- CVE-2026-94095Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injectionNetcore NBR200V2
- CVE-2026-94089D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflowD-Link DIR-868L
- CVE-2026-88857Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joo…
- CVE-2026-88854Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joo…
- CVE-2026-88856Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joo…
- CVE-2026-90817An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in whicVanderbilt University REDCap
- CVE-2026-94003Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflowComfast CF-N1-S
- CVE-2026-94107NivoCart through 2.4.0 Predictable Administrator Password Reset Tokennivocart
- CVE-2026-94084Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with OISF Suricata
- CVE-2026-94083Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even thOISF Suricata
- CVE-2026-93958D-Link R95 DHMAPI ssi system os command injectionD-Link R95
High 16
- CVE-2026-88855Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joo…
- CVE-2026-94036D-Link DIR-X1860/DIR-X1860Z routerd ubus access controlD-Link DIR-X1860 · D-Link DIR-X1860Z
- CVE-2026-94113Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet EndpointsFrappe ERPNext
- CVE-2026-94112mayswind ezBookkeeping before 2.0.0 TOTP Replay Attackmayswind ezBookkeeping
- CVE-2026-94109openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRendereropenEQUELLA
- CVE-2026-94108getID3 through 1.9.26 XML External Entity Injection via XML2arrayjames-heinrich getid3
- CVE-2026-94106getID3 before 1.9.26 OS Command Injection via Unescaped Filenamesjames-heinrich getid3
- CVE-2026-94104NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanagernivocart
- CVE-2026-92541Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend ImporterImport and export users and customers
- CVE-2026-92540Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_usersImport and export users and customers
- CVE-2026-87839Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment DeletionTripzzy
- CVE-2026-87067Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object InjectionForminator Forms
- CVE-2026-85017Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object InjectionUnlimited Elements For Elementor
- CVE-2026-82842SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account MatchingSAML Single Sign On
- CVE-2026-81650NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP ImportPhoto Gallery, Sliders, Proofing and Themes
- CVE-2026-86553A password reset vulnerability in ZTE SmartLife APPZTE SmartLife
Medium, low and unrated 76
- CVE-2026-94094OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of serviceOpenClaw
- CVE-2026-94093DLR-RM stable-baselines3 save_util.py VecNormalize.load deserializationDLR-RM stable-baselines3
- CVE-2026-94092dmlc dgl utils.py _read_torch_data deserializationdmlc dgl
- CVE-2026-94091piskvorky gensim Model Loader utils.py load deserializationpiskvorky gensim
- CVE-2026-94090JusticeRage Manalyze PE Parser pe.cpp _parse_debug integer underflowJusticeRage Manalyze
- CVE-2026-940510717376 cowork_bench pdf-tools-mcp server.py ControlFlowNode server-side request forgery0717376 cowork_bench
- CVE-2026-94050D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosureD-Link DIR-X1860Z
- CVE-2026-9404906ketan slideshot renderer.ts render_slides path traversal06ketan slideshot
- CVE-2026-94048CodeAstro QR Code Attendance Management System UserController.php save privileges managementCodeAstro QR Code Attendance Management System
- CVE-2026-94047samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges managementsamanhappy MCPHub
- CVE-2026-940460215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get_file_snippet path traversal0215AndrewFeng ACE-MCP
- CVE-2026-94045newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scriptingnewbee-ltd newbee-mall
- CVE-2026-9404403-lovepreetSingh MCP route.ts create_file path traversal03-lovepreetSingh MCP
- CVE-2026-94043Free5GC Gmm handler.go race conditionFree5GC
- CVE-2026-94042AdithyaYelloju Restaurant Management System add_table.php mysqli_query sql injectionAdithyaYelloju Restaurant Management System
- CVE-2026-94041AdithyaYelloju Restaurant-Management-System add_menu.php sql injectionAdithyaYelloju Restaurant-Management-System
- CVE-2026-94040vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgeryvas3k TaxHacker
- CVE-2026-94039vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgeryvas3k TaxHacker
- CVE-2026-94038NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgeryNonceGeek dim-sum-app
- CVE-2026-9403700Kisumi00 mcp-file-analyzer analyze_csv_data MCP tool main.py ControlFlowNode path traversal00Kisumi00 mcp-file-analyzer
- CVE-2026-94035SourceCodester Drug Recommendation System index.php cross site scriptingSourceCodester Drug Recommendation System
- CVE-2026-94034SourceCodester Drug Recommendation System Password Change change_password cross site scriptingSourceCodester Drug Recommendation System
- CVE-2026-94033SourceCodester Drug Recommendation System User Management add_user cross site scriptingSourceCodester Drug Recommendation System
- CVE-2026-94032itsourcecode Leave Management System index.php sql injectionitsourcecode Leave Management System
- CVE-2026-940310-Gaurav-0 nexus-mcp nexus_reauth MCP tool browser.ts child_process.exec command injection0-Gaurav-0 nexus-mcp
- CVE-2026-94030SerenityOS LibGfx BMPLoader.cpp decode_bmp_pixel_data integer overflowSerenityOS
- CVE-2026-94028mealie-recipes Mealie Recipe Action Trigger controller_group_recipe_actions.py payload.model_dump server-side request forgerymealie-recipes Mealie
- CVE-2026-92253Arbitrary File Write via Directory Junction in WatchDog Anti-Virus Quarantine RestorationWatchDog Anti-Virus
- CVE-2026-92252Incorrect Default Permissions in WatchDog Anti-Virus Installation DirectoryWatchDog Anti-Virus
- CVE-2026-94016SourceCodester Drug Recommendation System add_symptom cross site scriptingSourceCodester Drug Recommendation System
- CVE-2026-92254WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTLWatchdog Anti-Virus
- CVE-2026-94015SourceCodester Drug Recommendation System edit_user.php sql injectionSourceCodester Drug Recommendation System
- CVE-2026-94111Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket DaemonTencent BrowserSkill
- CVE-2026-94004DedeCMS mytag_js.php code injectionDedeCMS
- CVE-2026-93997SourceCodester Drug Recommendation System edit_symptom.php sql injectionSourceCodester Drug Recommendation System
- CVE-2026-94105NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controllernivocart
- CVE-2026-93980code-projects Internship Management System Admin Login Form login.php sql injectioncode-projects Internship Management System
- CVE-2026-93979code-projects Internship Management System login.php sql injectioncode-projects Internship Management System
- CVE-2026-93978code-projects Internship Management System login.php sql injectioncode-projects Internship Management System
- CVE-2026-93977code-projects Assessment Management add-single-mark.php cross site scriptingcode-projects Assessment Management
- CVE-2026-93976code-projects Assessment Management add-user.php cross site scriptingcode-projects Assessment Management
- CVE-2026-93975code-projects Assessment Management User Editing edit-user.php cross site scriptingcode-projects Assessment Management
- CVE-2026-86555Hardcoded Key Vulnerability in ZTE SmartLife APPZTE SmartLife
- CVE-2026-93974SourceCodester Online Reviewer Management System btn_functions.php remove sql injectionSourceCodester Online Reviewer Management System
- CVE-2026-93973SourceCodester Online Reviewer Management System btn_functions.php remove sql injectionSourceCodester Online Reviewer Management System
- CVE-2026-86554Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APPZTE SmartLife
- CVE-2026-93972SourceCodester Online Reviewer Management System btn_functions.php sql injectionSourceCodester Online Reviewer Management System
- CVE-2026-93971aiyiyi121 SxDevOps settings.py information disclosureaiyiyi121 SxDevOps
- CVE-2026-93970aiyiyi121 SxDevOps Settings settings.py hard-coded credentialsaiyiyi121 SxDevOps
- CVE-2026-93969aiyiyi121 SxDevOps services.py ensure_default_superuser hard-coded credentialsaiyiyi121 SxDevOps
- CVE-2026-93968aiyiyi121 SxDevOps UserSerializer serializers.py update privileges managementaiyiyi121 SxDevOps
- CVE-2026-93967aiyiyi121 SxDevOps Command services.py generate_host_task command injectionaiyiyi121 SxDevOps
- CVE-2026-92965TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code RedemptionTikTok
- CVE-2026-92423Meow Gallery < 5.5.5 - Author+ Draft and Private Post Disclosure via fetch_postsMeow Gallery
- CVE-2026-92422Meow Gallery < 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load_gallery_collection REST RouteMeow Gallery
- CVE-2026-92410Sign-up Sheets < 2.4.0 - Arbitrary Sign-up Deletion via CSRFSign-up Sheets
- CVE-2026-87840Tripzzy < 1.5.1 - Unauthenticated Booking Data TamperingTripzzy
- CVE-2026-87068Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form ImportForminator Forms
- CVE-2026-84223Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG UploadKirki
- CVE-2026-81654NextGEN Gallery < 4.5.0 - Authenticated Plugin Image Settings UpdatePhoto Gallery, Sliders, Proofing and Themes
- CVE-2026-81653NextGEN Gallery < 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDORPhoto Gallery, Sliders, Proofing and Themes
- CVE-2026-81652NextGEN Gallery < 4.5.0 - Contributor+ Image Metadata Disclosure via IDORPhoto Gallery, Sliders, Proofing and Themes
- CVE-2026-81651NextGEN Gallery < 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDORPhoto Gallery, Sliders, Proofing and Themes
- CVE-2026-16542Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatarImport and export users and customers
- CVE-2026-14844Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode AttributesMaster Slider
- CVE-2026-93966aiyiyi121 SxDevOps TASK_RUN_COMMAND host_tasks.py paramiko.SSHClient.exec_command command injectionaiyiyi121 SxDevOps
- CVE-2026-93965aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injectionaiyiyi121 SxDevOps
- CVE-2026-93964NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authenticationNginxProxyManager nginx-proxy-manager
- CVE-2026-93963itsourcecode Leave Management System controller.php sql injectionitsourcecode Leave Management System
- CVE-2026-93962Kamailio CDP Diameter Receiver receiver.c shm_malloc heap-based overflowKamailio
- CVE-2026-93961Dromara UJCMS UserController UserController.java usernameExist improper authorizationDromara UJCMS
- CVE-2026-86552A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APPZTE SmartLife
- CVE-2026-93960Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authenticationPixelfed
- CVE-2026-93959SourceCodester Online Reviewer Management System btn_functions.php sql injectionSourceCodester Online Reviewer Management System
- CVE-2026-86551Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) productZTE NX741J
- CVE-2026-93957olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparisonolivier-ls PHP-FTS