CVE Notifier

CVE-2026-91774 CWE-862 4.3

Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive tea…

cve.org YaoApp:yao 15 Sep 2026

CVE-2026-91773 CWE-639 4.3

Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repos…

cve.org charmbracelet:soft-serve 15 Sep 2026

CVE-2026-91772 CWE-601 6.1

Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect…

cve.org halo-dev:halo 15 Sep 2026

CVE-2026-91771 CWE-22 8.8

Weights & Biases wandb before 0.29.0 Path Traversal via File Download

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with dire…

cve.org wandb:wandb 15 Sep 2026

CVE-2026-91770 CWE-639 6.5

IceHRM before 36.0.0 Broken Access Control via Employee ID

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skil…

cve.org gamonoid:icehrm 15 Sep 2026

CVE-2026-90848 CWE-79 4.3

Governikus AusweisApp StartPAOSResponse cross site scripting

A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross si…

cve.org Governikus:AusweisApp 15 Sep 2026

CVE-2026-85657 CWE-79 5.4

Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile_fields_user_email_value_prefix’ parameter i…

Wordfence publishpress:Co-Authors, · Multiple · Authors 15 Sep 2026

CVE-2026-85575 CWE-79 6.4

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine_product_ti…

Wordfence roxnor:ShopEngine · Elementor · WooCommerce 15 Sep 2026

CVE-2026-90847 CWE-78 9.1

EFM ipTIME C200E System Setup iux_set.cgi os command injection

A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_set.cgi of the component System Setup. This manipulation causes os command injection. It is possible t…

cve.org EFM:ipTIME · C200E 15 Sep 2026

CVE-2026-90846 CWE-89 7.3

PHPGurukul Daily Expense Tracker System forgot-password.php sql injection

A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injectio…

cve.org PHPGurukul:Daily · Expense · Tracker 15 Sep 2026

CVE-2026-91752 CWE-789 7.5

GNU libextractor before 1.15 Stack Overflow via OLE2

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craf…

cve.org GNU:libextractor 15 Sep 2026

CVE-2026-91751 CWE-22 8.3

Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can …

cve.org flextype:flextype 15 Sep 2026