CVE Notifier

CVE-2026-82519 CWE-862 4.3

Really Simple Security < 9.8.2 Authorization Bypass via profile-page update handler

Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attackers to bypass enforced two-factor authentication indefinitely b…

cve.org reallysimpleplugins:Really · Simple · Security 14 Sep 2026

CVE-2026-90812 CWE-266 4.3

cosmicstack-labs mercury-agent Shell Command Permission permissions.ts checkShellCommand privileges assignment

A security vulnerability has been detected in cosmicstack-labs mercury-agent up to 1.2.0. This impacts the function checkShellCommand of the file src/capabilities/permissions.ts of the component Shell Command Permission.…

cve.org cosmicstack-labs:mercury-agent 14 Sep 2026

CVE-2026-15893 CWE-617 6.5

Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS

net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c derives a randomized ND reachable time from ipv6->base_reachable_time as min_reachable + sys_rand32_get() % (max_reachable - min_reachable), where min_reachable…

cve.org zephyrproject:zephyr 14 Sep 2026

CVE-2026-90811 CWE-200 3.3

cosmicstack-labs mercury-agent Shell Permission Manifest permissions.ts PermissionManager.checkShellCommand information disclosure

A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell…

cve.org cosmicstack-labs:mercury-agent 14 Sep 2026

CVE-2026-18151 CWE-362 4.2

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition during the WebSocket handshake process.

cve.org IBM:i 14 Sep 2026

CVE-2026-82035 CWE-22 7.1

PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the output filename is constructed by joining a document-controll…

cve.org PyMuPDF:PyMuPDF 14 Sep 2026

CVE-2026-90810 CWE-285 6.3

cosmicstack-labs mercury-agent Shell Command Permission Check permissions.ts PermissionManager.checkShellCommand improper authorization

A security flaw has been discovered in cosmicstack-labs mercury-agent up to 1.1.13. The impacted element is the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of th…

cve.org cosmicstack-labs:mercury-agent 14 Sep 2026

CVE-2026-18515 CWE-22 4.3

IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to uplo…

cve.org IBM:i 14 Sep 2026

CVE-2026-19543 CWE-20 6.2

Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent

IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 performs input validation exclusively on the client side and fails to enforce the same restrictions on the server side. …

cve.org IBM:Common · Licensing 14 Sep 2026

CVE-2026-89023 CWE-862 8.6

ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API

ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthenticated attackers to access and manipulate protected resources. …

cve.org ThemeAtelier:Domain · For · Sale 14 Sep 2026

CVE-2026-90809 CWE-88 7.3

HKUDS nanobot ExecTool shell.py ExecTool._spawn argument injection

A vulnerability was identified in HKUDS nanobot up to 0.2.1. The affected element is the function ExecTool._guard_command/ExecTool._spawn of the file nanobot/agent/tools/shell.py of the component ExecTool. Such manipulat…

cve.org HKUDS:nanobot 14 Sep 2026

CVE-2026-59178 CWE-306 9.8

ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its authentication credentials from `$ESPHOME_USERNAME` and `$ESPHOME_PASSWORD`. Earl…

cve.org esphome:device-builder 14 Sep 2026