# CVEs published 2026-09-20

105 CVEs were published on September 20, 2026: 13 critical, 16 high. Days are UTC.

- [CVE-2026-94097](https://cve.now/CVE-2026-94097.md): Netcore NBR200V2 CGI Diagnostic Endpoint network\_tools command injection (CVSS 10.0, Netcore NBR200V2)
- [CVE-2026-94096](https://cve.now/CVE-2026-94096.md): Netcore NBR200V2 LAN IP Configuration network\_tools command injection (CVSS 9.4, Netcore NBR200V2)
- [CVE-2026-94095](https://cve.now/CVE-2026-94095.md): Netcore NBR200V2 Traceroute Diagnostic Feature network\_tools command injection (CVSS 9.4, Netcore NBR200V2)
- [CVE-2026-94094](https://cve.now/CVE-2026-94094.md): OpenClaw Canvas Host Route server.ts createCanvasHostHandler denial of service (CVSS 5.3, OpenClaw)
- [CVE-2026-94093](https://cve.now/CVE-2026-94093.md): DLR-RM stable-baselines3 save\_util.py VecNormalize.load deserialization (CVSS 5.3, DLR-RM stable-baselines3)
- [CVE-2026-94092](https://cve.now/CVE-2026-94092.md): dmlc dgl utils.py \_read\_torch\_data deserialization (CVSS 5.1, dmlc dgl)
- [CVE-2026-94091](https://cve.now/CVE-2026-94091.md): piskvorky gensim Model Loader utils.py load deserialization (CVSS 5.1, piskvorky gensim)
- [CVE-2026-94090](https://cve.now/CVE-2026-94090.md): JusticeRage Manalyze PE Parser pe.cpp \_parse\_debug integer underflow (CVSS 5.3, JusticeRage Manalyze)
- [CVE-2026-94089](https://cve.now/CVE-2026-94089.md): D-Link DIR-868L Authentication webfa\_authentication.cgi strcpy stack-based overflow (CVSS 10.0, D-Link DIR-868L)
- [CVE-2026-94051](https://cve.now/CVE-2026-94051.md): 0717376 cowork\_bench pdf-tools-mcp server.py ControlFlowNode server-side request forgery (CVSS 5.3, 0717376 cowork\_bench)
- [CVE-2026-94050](https://cve.now/CVE-2026-94050.md): D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get\_rand\_key information disclosure (CVSS 5.3, D-Link DIR-X1860Z)
- [CVE-2026-94049](https://cve.now/CVE-2026-94049.md): 06ketan slideshot renderer.ts render\_slides path traversal (CVSS 5.3, 06ketan slideshot)
- [CVE-2026-94048](https://cve.now/CVE-2026-94048.md): CodeAstro QR Code Attendance Management System UserController.php save privileges management (CVSS 5.1, CodeAstro QR Code Attendance Management System)
- [CVE-2026-94047](https://cve.now/CVE-2026-94047.md): samanhappy MCPHub Template Import Endpoint templateService.ts importTemplate privileges management (CVSS 5.3, samanhappy MCPHub)
- [CVE-2026-94046](https://cve.now/CVE-2026-94046.md): 0215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get\_file\_snippet path traversal (CVSS 5.3, 0215AndrewFeng ACE-MCP)
- [CVE-2026-94045](https://cve.now/CVE-2026-94045.md): newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting (CVSS 5.1, newbee-ltd newbee-mall)
- [CVE-2026-94044](https://cve.now/CVE-2026-94044.md): 03-lovepreetSingh MCP route.ts create\_file path traversal (CVSS 6.9, 03-lovepreetSingh MCP)
- [CVE-2026-94043](https://cve.now/CVE-2026-94043.md): Free5GC Gmm handler.go race condition (CVSS 6.9, Free5GC)
- [CVE-2026-88857](https://cve.now/CVE-2026-88857.md): Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla \< 6.2.7 (CVSS 9.4, OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joo…)
- [CVE-2026-88854](https://cve.now/CVE-2026-88854.md): Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla \< 6.2.7 (CVSS 9.3, OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joo…)
- [CVE-2026-88855](https://cve.now/CVE-2026-88855.md): Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla \< 6.2.7 (CVSS 8.6, OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joo…)
- [CVE-2026-88856](https://cve.now/CVE-2026-88856.md): Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla \< 6.2.7 (CVSS 9.4, OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joo…)
- [CVE-2026-94042](https://cve.now/CVE-2026-94042.md): AdithyaYelloju Restaurant Management System add\_table.php mysqli\_query sql injection (CVSS 5.3, AdithyaYelloju Restaurant Management System)
- [CVE-2026-94041](https://cve.now/CVE-2026-94041.md): AdithyaYelloju Restaurant-Management-System add\_menu.php sql injection (CVSS 5.3, AdithyaYelloju Restaurant-Management-System)
- [CVE-2026-94040](https://cve.now/CVE-2026-94040.md): vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery (CVSS 6.9, vas3k TaxHacker)
- [CVE-2026-94039](https://cve.now/CVE-2026-94039.md): vas3k TaxHacker Invoice PDF Renderer actions.ts generateInvoicePDF server-side request forgery (CVSS 6.9, vas3k TaxHacker)
- [CVE-2026-94038](https://cve.now/CVE-2026-94038.md): NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery (CVSS 6.9, NonceGeek dim-sum-app)
- [CVE-2026-94037](https://cve.now/CVE-2026-94037.md): 00Kisumi00 mcp-file-analyzer analyze\_csv\_data MCP tool main.py ControlFlowNode path traversal (CVSS 5.3, 00Kisumi00 mcp-file-analyzer)
- [CVE-2026-94036](https://cve.now/CVE-2026-94036.md): D-Link DIR-X1860/DIR-X1860Z routerd ubus access control (CVSS 8.7, D-Link DIR-X1860 · D-Link DIR-X1860Z)
- [CVE-2026-94035](https://cve.now/CVE-2026-94035.md): SourceCodester Drug Recommendation System index.php cross site scripting (CVSS 5.3, SourceCodester Drug Recommendation System)
- [CVE-2026-94034](https://cve.now/CVE-2026-94034.md): SourceCodester Drug Recommendation System Password Change change\_password cross site scripting (CVSS 5.1, SourceCodester Drug Recommendation System)
- [CVE-2026-94033](https://cve.now/CVE-2026-94033.md): SourceCodester Drug Recommendation System User Management add\_user cross site scripting (CVSS 5.1, SourceCodester Drug Recommendation System)
- [CVE-2026-94032](https://cve.now/CVE-2026-94032.md): itsourcecode Leave Management System index.php sql injection (CVSS 5.3, itsourcecode Leave Management System)
- [CVE-2026-94031](https://cve.now/CVE-2026-94031.md): 0-Gaurav-0 nexus-mcp nexus\_reauth MCP tool browser.ts child\_process.exec command injection (CVSS 5.3, 0-Gaurav-0 nexus-mcp)
- [CVE-2026-94030](https://cve.now/CVE-2026-94030.md): SerenityOS LibGfx BMPLoader.cpp decode\_bmp\_pixel\_data integer overflow (CVSS 2.3, SerenityOS)
- [CVE-2026-94028](https://cve.now/CVE-2026-94028.md): mealie-recipes Mealie Recipe Action Trigger controller\_group\_recipe\_actions.py payload.model\_dump server-side request forgery (CVSS 5.3, mealie-recipes Mealie)
- [CVE-2026-92253](https://cve.now/CVE-2026-92253.md): Arbitrary File Write via Directory Junction in WatchDog Anti-Virus Quarantine Restoration (CVSS 5.2, WatchDog Anti-Virus)
- [CVE-2026-92252](https://cve.now/CVE-2026-92252.md): Incorrect Default Permissions in WatchDog Anti-Virus Installation Directory (CVSS 5.9, WatchDog Anti-Virus)
- [CVE-2026-94016](https://cve.now/CVE-2026-94016.md): SourceCodester Drug Recommendation System add\_symptom cross site scripting (CVSS 4.8, SourceCodester Drug Recommendation System)
- [CVE-2026-90817](https://cve.now/CVE-2026-90817.md): An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in whic (CVSS 9.8, Vanderbilt University REDCap)
- [CVE-2026-92254](https://cve.now/CVE-2026-92254.md): WatchDog Antivirus kernel driver arbitrary file deletion via unauthenticated IOCTL (CVSS 6.9, Watchdog Anti-Virus)
- [CVE-2026-94015](https://cve.now/CVE-2026-94015.md): SourceCodester Drug Recommendation System edit\_user.php sql injection (CVSS 6.9, SourceCodester Drug Recommendation System)
- [CVE-2026-94113](https://cve.now/CVE-2026-94113.md): Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints (CVSS 7.1, Frappe ERPNext)
- [CVE-2026-94112](https://cve.now/CVE-2026-94112.md): mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack (CVSS 7.6, mayswind ezBookkeeping)
- [CVE-2026-94111](https://cve.now/CVE-2026-94111.md): Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon (CVSS 6.9, Tencent BrowserSkill)
- [CVE-2026-94004](https://cve.now/CVE-2026-94004.md): DedeCMS mytag\_js.php code injection (CVSS 6.9, DedeCMS)
- [CVE-2026-94109](https://cve.now/CVE-2026-94109.md): openEQUELLA \< 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer (CVSS 8.6, openEQUELLA)
- [CVE-2026-94003](https://cve.now/CVE-2026-94003.md): Comfast CF-N1-S Web Management mbox-config get\_css\_path\_from\_uri stack-based overflow (CVSS 10.0, Comfast CF-N1-S)
- [CVE-2026-93997](https://cve.now/CVE-2026-93997.md): SourceCodester Drug Recommendation System edit\_symptom.php sql injection (CVSS 6.9, SourceCodester Drug Recommendation System)
- [CVE-2026-94108](https://cve.now/CVE-2026-94108.md): getID3 through 1.9.26 XML External Entity Injection via XML2array (CVSS 8.3, james-heinrich getid3)
- [CVE-2026-94107](https://cve.now/CVE-2026-94107.md): NivoCart through 2.4.0 Predictable Administrator Password Reset Token (CVSS 9.2, nivocart)
- [CVE-2026-94106](https://cve.now/CVE-2026-94106.md): getID3 before 1.9.26 OS Command Injection via Unescaped Filenames (CVSS 8.7, james-heinrich getid3)
- [CVE-2026-94105](https://cve.now/CVE-2026-94105.md): NivoCart through 2.4.0 Destructive Configuration Write via the Password Reset Controller (CVSS 6.9, nivocart)
- [CVE-2026-94104](https://cve.now/CVE-2026-94104.md): NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager (CVSS 8.7, nivocart)
- [CVE-2026-93980](https://cve.now/CVE-2026-93980.md): code-projects Internship Management System Admin Login Form login.php sql injection (CVSS 6.9, code-projects Internship Management System)
- [CVE-2026-93979](https://cve.now/CVE-2026-93979.md): code-projects Internship Management System login.php sql injection (CVSS 6.9, code-projects Internship Management System)
- [CVE-2026-93978](https://cve.now/CVE-2026-93978.md): code-projects Internship Management System login.php sql injection (CVSS 6.9, code-projects Internship Management System)
- [CVE-2026-93977](https://cve.now/CVE-2026-93977.md): code-projects Assessment Management add-single-mark.php cross site scripting (CVSS 5.1, code-projects Assessment Management)
- [CVE-2026-93976](https://cve.now/CVE-2026-93976.md): code-projects Assessment Management add-user.php cross site scripting (CVSS 4.8, code-projects Assessment Management)
- [CVE-2026-93975](https://cve.now/CVE-2026-93975.md): code-projects Assessment Management User Editing edit-user.php cross site scripting (CVSS 4.8, code-projects Assessment Management)
- [CVE-2026-86555](https://cve.now/CVE-2026-86555.md): Hardcoded Key Vulnerability in ZTE SmartLife APP (CVSS 6.2, ZTE SmartLife)
- [CVE-2026-93974](https://cve.now/CVE-2026-93974.md): SourceCodester Online Reviewer Management System btn\_functions.php remove sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-93973](https://cve.now/CVE-2026-93973.md): SourceCodester Online Reviewer Management System btn\_functions.php remove sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-86554](https://cve.now/CVE-2026-86554.md): Email enumeration and account ID leakage vulnerabilities in ZTE SmartLife APP (CVSS 4.3, ZTE SmartLife)
- [CVE-2026-93972](https://cve.now/CVE-2026-93972.md): SourceCodester Online Reviewer Management System btn\_functions.php sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-93971](https://cve.now/CVE-2026-93971.md): aiyiyi121 SxDevOps settings.py information disclosure (CVSS 6.9, aiyiyi121 SxDevOps)
- [CVE-2026-93970](https://cve.now/CVE-2026-93970.md): aiyiyi121 SxDevOps Settings settings.py hard-coded credentials (CVSS 6.9, aiyiyi121 SxDevOps)
- [CVE-2026-93969](https://cve.now/CVE-2026-93969.md): aiyiyi121 SxDevOps services.py ensure\_default\_superuser hard-coded credentials (CVSS 6.9, aiyiyi121 SxDevOps)
- [CVE-2026-93968](https://cve.now/CVE-2026-93968.md): aiyiyi121 SxDevOps UserSerializer serializers.py update privileges management (CVSS 5.1, aiyiyi121 SxDevOps)
- [CVE-2026-93967](https://cve.now/CVE-2026-93967.md): aiyiyi121 SxDevOps Command services.py generate\_host\_task command injection (CVSS 5.1, aiyiyi121 SxDevOps)
- [CVE-2026-92965](https://cve.now/CVE-2026-92965.md): TikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption (CVSS 3.7, TikTok)
- [CVE-2026-92541](https://cve.now/CVE-2026-92541.md): Import and export users and customers \< 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer (CVSS 7.2, Import and export users and customers)
- [CVE-2026-92540](https://cve.now/CVE-2026-92540.md): Import and export users and customers \< 2.5.2 - Custom Role Privilege Escalation to Administrator via caller\_can\_promote\_users (CVSS 7.2, Import and export users and customers)
- [CVE-2026-92423](https://cve.now/CVE-2026-92423.md): Meow Gallery \< 5.5.5 - Author+ Draft and Private Post Disclosure via fetch\_posts (CVSS 2.7, Meow Gallery)
- [CVE-2026-92422](https://cve.now/CVE-2026-92422.md): Meow Gallery \< 5.5.5 - Unauthenticated Arbitrary Shortcode Execution via load\_gallery\_collection REST Route (CVSS 6.5, Meow Gallery)
- [CVE-2026-92410](https://cve.now/CVE-2026-92410.md): Sign-up Sheets \< 2.4.0 - Arbitrary Sign-up Deletion via CSRF (CVSS 4.3, Sign-up Sheets)
- [CVE-2026-87840](https://cve.now/CVE-2026-87840.md): Tripzzy \< 1.5.1 - Unauthenticated Booking Data Tampering (CVSS 5.3, Tripzzy)
- [CVE-2026-87839](https://cve.now/CVE-2026-87839.md): Tripzzy \< 1.5.1 - Unauthenticated Arbitrary Comment Deletion (CVSS 7.5, Tripzzy)
- [CVE-2026-87068](https://cve.now/CVE-2026-87068.md): Forminator Forms \< 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import (CVSS 6.6, Forminator Forms)
- [CVE-2026-87067](https://cve.now/CVE-2026-87067.md): Forminator Forms \< 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection (CVSS 8.5, Forminator Forms)
- [CVE-2026-85017](https://cve.now/CVE-2026-85017.md): Unlimited Elements For Elementor \< 2.0.20 - Subscriber+ PHP Object Injection (CVSS 7.5, Unlimited Elements For Elementor)
- [CVE-2026-84223](https://cve.now/CVE-2026-84223.md): Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload (CVSS 6.8, Kirki)
- [CVE-2026-82842](https://cve.now/CVE-2026-82842.md): SAML Single Sign On \< 6.0.0 - Unauthenticated Privilege Escalation via Account Matching (CVSS 8.1, SAML Single Sign On)
- [CVE-2026-81654](https://cve.now/CVE-2026-81654.md): NextGEN Gallery \< 4.5.0 - Authenticated Plugin Image Settings Update (CVSS 3.1, Photo Gallery, Sliders, Proofing and Themes)
- [CVE-2026-81653](https://cve.now/CVE-2026-81653.md): NextGEN Gallery \< 4.5.0 - Authenticated Arbitrary Gallery Image Deletion via IDOR (CVSS 4.2, Photo Gallery, Sliders, Proofing and Themes)
- [CVE-2026-81652](https://cve.now/CVE-2026-81652.md): NextGEN Gallery \< 4.5.0 - Contributor+ Image Metadata Disclosure via IDOR (CVSS 2.7, Photo Gallery, Sliders, Proofing and Themes)
- [CVE-2026-81651](https://cve.now/CVE-2026-81651.md): NextGEN Gallery \< 4.5.0 - Authenticated Cross-Gallery Settings Modification via IDOR (CVSS 3.1, Photo Gallery, Sliders, Proofing and Themes)
- [CVE-2026-81650](https://cve.now/CVE-2026-81650.md): NextGEN Gallery \< 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import (CVSS 7.2, Photo Gallery, Sliders, Proofing and Themes)
- [CVE-2026-16542](https://cve.now/CVE-2026-16542.md): Import and export users and customers \< 2.4.5 - Admin+ SSRF via bp\_avatar (CVSS 4.1, Import and export users and customers)
- [CVE-2026-14844](https://cve.now/CVE-2026-14844.md): Master Slider \<= 3.11.2 - Contributor+ Stored XSS via ms\_slider Shortcode Attributes (CVSS 6.8, Master Slider)
- [CVE-2026-93966](https://cve.now/CVE-2026-93966.md): aiyiyi121 SxDevOps TASK\_RUN\_COMMAND host\_tasks.py paramiko.SSHClient.exec\_command command injection (CVSS 5.1, aiyiyi121 SxDevOps)
- [CVE-2026-93965](https://cve.now/CVE-2026-93965.md): aiyiyi121 SxDevOps MCP STDIO Server Management services.py subprocess.Popen command injection (CVSS 5.1, aiyiyi121 SxDevOps)
- [CVE-2026-93964](https://cve.now/CVE-2026-93964.md): NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication (CVSS 6.9, NginxProxyManager nginx-proxy-manager)
- [CVE-2026-93963](https://cve.now/CVE-2026-93963.md): itsourcecode Leave Management System controller.php sql injection (CVSS 5.3, itsourcecode Leave Management System)
- [CVE-2026-93962](https://cve.now/CVE-2026-93962.md): Kamailio CDP Diameter Receiver receiver.c shm\_malloc heap-based overflow (CVSS 6.9, Kamailio)
- [CVE-2026-93961](https://cve.now/CVE-2026-93961.md): Dromara UJCMS UserController UserController.java usernameExist improper authorization (CVSS 6.9, Dromara UJCMS)
- [CVE-2026-86553](https://cve.now/CVE-2026-86553.md): A password reset vulnerability in ZTE SmartLife APP (CVSS 8.8, ZTE SmartLife)
- [CVE-2026-86552](https://cve.now/CVE-2026-86552.md): A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP (CVSS 5.4, ZTE SmartLife)
- [CVE-2026-93960](https://cve.now/CVE-2026-93960.md): Pixelfed OAuth Scope ApiV1Controller.php instancePeers missing authentication (CVSS 5.3, Pixelfed)
- [CVE-2026-93959](https://cve.now/CVE-2026-93959.md): SourceCodester Online Reviewer Management System btn\_functions.php sql injection (CVSS 6.9, SourceCodester Online Reviewer Management System)
- [CVE-2026-86551](https://cve.now/CVE-2026-86551.md): Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product (CVSS 3.3, ZTE NX741J)
- [CVE-2026-94084](https://cve.now/CVE-2026-94084.md): Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response\_header with (CVSS 9.4, OISF Suricata)
- [CVE-2026-94083](https://cve.now/CVE-2026-94083.md): Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even th (CVSS 9.4, OISF Suricata)
- [CVE-2026-93958](https://cve.now/CVE-2026-93958.md): D-Link R95 DHMAPI ssi system os command injection (CVSS 9.4, D-Link R95)
- [CVE-2026-93957](https://cve.now/CVE-2026-93957.md): olivier-ls PHP-FTS Filter Matching SearchEngine.php matchesSingleFilter comparison (CVSS 5.3, olivier-ls PHP-FTS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.