Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-86217 — code-projects Hotel and Tourism Reservation in PHP Database Backup hotel_db%20(1).sql inf…

A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of the component Database Backup Handler. Th…

| Information Disclosure
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
5.0 MEDIUM
CVE-2026-86216 — code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument ro…

Remote | Cross-Site Scripting
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
4.3 MEDIUM
CVE-2026-86215 — Mstfakts College-Management-System Logout server.php session expiration

A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/server.php of the component Logout Handler. Such manipulation o…

Remote | Authentication
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
7.1 HIGH
CVE-2026-86283 — MISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data

MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the caller's access control list (ACL). The Col…

Remote | Authorization
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
9.0 CRITICAL
CVE-2026-86259 — OpenMAIC before 1.0.1 SSRF via Environment-Gated URL Validation

OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitra…

Remote | Server-Side Request Forgery
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
8.2 HIGH
CVE-2026-86258 — nbviewer through 1.0.1 Path Traversal via LocalFileHandler

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of proper path validation. Attackers can read files from sibli…

Remote | Path Traversal
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
7.5 HIGH
CVE-2026-86214 — Mstfakts College-Management-System login.php improper authentication

A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This manipulation of the argument email causes improper authenti…

Remote | Authentication
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
7.5 HIGH
CVE-2026-86213 — Mstfakts College-Management-System Search university.php mysqli_query sql injection

A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/university.php of the component Search Handler. The manipulation of…

Remote | Injection
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
5.4 MEDIUM
CVE-2026-86257 — wger before 2.6 CSV Formula Injection via member export

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HY…

wger | Remote | Injection
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
5.4 MEDIUM
CVE-2026-86256 — wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects…

wger | Remote | Misconfiguration
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
7.1 HIGH
CVE-2026-86255 — wger before 2.5 Uncontrolled Resource Consumption via date_sequence

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequen…

wger | Remote | Denial of Service
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
6.8 MEDIUM
CVE-2026-86254 — wger Incomplete Authorization Fix Cross-Tenant Account Deletion

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using raw integer comparison instead of the is…

wger | Remote | Authorization
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
8.2 HIGH
CVE-2026-86253 — h3 before 1.15.6 Path Traversal via Percent-Encoded Dot Segments

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname is not normalized, so percent-encoded dot segments (%2e%2e…

Remote | Path Traversal
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
6.9 MEDIUM
CVE-2026-86252 — h3 before 1.15.9 SSE Event Injection via Carriage Return

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage retur…

Remote | Injection
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
8.2 HIGH
CVE-2026-86251 — h3 before 1.15.9 Path Traversal via Double Decoding

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to …

Remote | Path Traversal
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
8.7 HIGH
CVE-2026-86250 — h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cooki…

Remote | Denial of Service
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
8.1 HIGH
CVE-2026-86242 — Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled (the default, gover…

Remote | Misconfiguration
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
4.3 MEDIUM
CVE-2026-86212 — Open5GS AMF/MME improper authorization

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be…

Remote | Authorization
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
5.4 MEDIUM
CVE-2026-86205 — h3 before 2.0.1-rc.18 Open Redirect via redirectBack()

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft …

Remote | Misconfiguration
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
8.7 HIGH
CVE-2022-51009 — PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry J…

Remote | Misconfiguration
Sep 06, 2026 Sep 06, 2026
Sep 06, 2026
Sep 06, 2026
Showing 20 of 12399 Results