CVE Notifier

CVE-2026-79551 CWE-? N/A

CVE-2026-79551

Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key.

MITRE n/a:n/a 15 Sep 2026

CVE-2026-79425 CWE-? N/A

CVE-2026-79425

An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.

MITRE n/a:n/a 15 Sep 2026

CVE-2026-79411 CWE-? N/A

CVE-2026-79411

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The us…

MITRE n/a:n/a 15 Sep 2026

CVE-2026-79410 CWE-? N/A

CVE-2026-79410

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods.

MITRE n/a:n/a 15 Sep 2026

CVE-2026-79409 CWE-? N/A

CVE-2026-79409

An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components.

MITRE n/a:n/a 15 Sep 2026

CVE-2026-79303 CWE-? N/A

CVE-2026-79303

kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures.

MITRE n/a:n/a 15 Sep 2026

CVE-2026-52484 CWE-? N/A

CVE-2026-52484

An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component

MITRE n/a:n/a 15 Sep 2026

CVE-2026-51134 CWE-? N/A

CVE-2026-51134

The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml.

MITRE n/a:n/a 15 Sep 2026

CVE-2026-51133 CWE-? N/A

CVE-2026-51133

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml compo…

MITRE n/a:n/a 15 Sep 2026

CVE-2026-39040 CWE-? N/A

CVE-2026-39040

BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.

MITRE n/a:n/a 15 Sep 2026

CVE-2026-39039 CWE-? N/A

CVE-2026-39039

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the p…

MITRE n/a:n/a 15 Sep 2026

CVE-2026-39038 CWE-? N/A

CVE-2026-39038

BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.

MITRE n/a:n/a 15 Sep 2026