CVE Notifier

CVE-2026-91750 CWE-918 6.5

WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when downloading documents from user-supplied URLs. Authenticated attackers can bypass initia…

cve.org Tencent:WeKnora 15 Sep 2026

CVE-2026-90845 CWE-79 3.5

PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting

A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross…

cve.org PHPGurukul:Daily · Expense · Tracker 15 Sep 2026

CVE-2026-90844 CWE-89 7.3

PHPGurukul Daily Expense Tracker System Login index.php sql injection

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email res…

cve.org PHPGurukul:Daily · Expense · Tracker 15 Sep 2026

CVE-2026-90843 CWE-78 8.3

SabyasachiRana WebMap New Nmap Scan functions_nmap.py nmap_newscan os command injection

A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This affects the function nmap_newscan of the file functions_nmap.py of the component New Nmap Scan Hand…

cve.org SabyasachiRana:WebMap 15 Sep 2026

CVE-2026-88743 CWE-? N/A

CVE-2026-88743

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.

MITRE n/a:n/a 15 Sep 2026

CVE-2026-88742 CWE-? N/A

CVE-2026-88742

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field.

MITRE n/a:n/a 15 Sep 2026

CVE-2026-88621 CWE-? N/A

CVE-2026-88621

OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can submit a non-HTML upload filename matching an existing file i…

MITRE n/a:n/a 15 Sep 2026

CVE-2026-88620 CWE-? N/A

CVE-2026-88620

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope aut…

MITRE n/a:n/a 15 Sep 2026

CVE-2026-88619 CWE-? N/A

CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission ch…

MITRE n/a:n/a 15 Sep 2026

CVE-2026-88618 CWE-? N/A

CVE-2026-88618

1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code.

MITRE n/a:n/a 15 Sep 2026

CVE-2026-88617 CWE-? N/A

CVE-2026-88617

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges.

MITRE n/a:n/a 15 Sep 2026

CVE-2026-88616 CWE-? N/A

CVE-2026-88616

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskServi…

MITRE n/a:n/a 15 Sep 2026