CVE Notifier

CVE-2026-91087 CWE-416 7.3

GPAC Compositor media_object.c gf_mo_get_od_id use after free

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free…

cve.org n/a:GPAC 15 Sep 2026

CVE-2026-91086 CWE-122 6.3

GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow

A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_process of the file filters/reframe_mpgvid.c of the component MPEG Video Reframer. Such manipulation lea…

cve.org n/a:GPAC 15 Sep 2026

CVE-2026-90711 CWE-290 9.1

proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IP…

cve.org proxy-addr:proxy-addr 15 Sep 2026

CVE-2026-91005 CWE-434 6.3

SourceCodester Online Faculty Clearance System Profile Picture Upload edit_picture.php move_uploaded_file unrestricted upload

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. This affects the function move_uploaded_file of the file production/edit_picture.php of the component Profile Picture Upload. Performing a …

cve.org SourceCodester:Online · Faculty · Clearance 15 Sep 2026

CVE-2026-89141 CWE-639 6.5

AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.7 via the 'mediaId' parameter due to missing …

Wordfence tigroumeow:AI · Engine · – 15 Sep 2026

CVE-2026-75983 CWE-269 7.5

Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::m…

Wordfence arraytics:Eventin · – · Event 15 Sep 2026

CVE-2026-15402 CWE-79 6.4

Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to…

Wordfence arraytics:Eventin · – · Event 15 Sep 2026

CVE-2026-91004 CWE-89 7.3

SourceCodester Online Faculty Clearance System delete_faculty1.php sql injection

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1.php. Such manipulation of the argument ID leads to sql inject…

cve.org SourceCodester:Online · Faculty · Clearance 15 Sep 2026

CVE-2026-18232 CWE-? N/A

WP Directory Kit <= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map_infowindow

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draf…

WPScan Unknown:WP · Directory · Kit 15 Sep 2026

CVE-2026-16593 CWE-? N/A

WP Directory Kit <= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings

The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement, allowing authenticated users with access to the page builder (Editor and above) …

WPScan Unknown:WP · Directory · Kit 15 Sep 2026

CVE-2026-16592 CWE-? N/A

WP Directory Kit <= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes

The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing users with a role as low as Contributor to disclose non-public listing content, in…

WPScan Unknown:WP · Directory · Kit 15 Sep 2026

CVE-2026-86701 CWE-926 2.5

CVE-2026-86701

Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component…

cve.org NTT · DOCOMO · BUSINESS, 15 Sep 2026