CVE Notifier

CVE-2026-90894 CWE-88 7.8

Parallels Desktop local privilege escalation via appliance extract argument injection

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_service.socket. PrlSrv_LoginLocal accepts peer credentials. No Parallels signature. No admin group. …

cve.org Parallels:Parallels · Desktop · for 14 Sep 2026

CVE-2026-90703 CWE-78 9.1

D-Link DWR-M921 formDiskCreateShare system os command injection

A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShare. Such manipulation of the argument folderpath leads to os command injection. T…

cve.org D-Link:DWR-M921 14 Sep 2026

CVE-2026-90895 CWE-862 N/A

MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection

Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsistencies. The patch shows that CLI access could differ from…

cve.org MISP:MISP 14 Sep 2026

CVE-2026-90702 CWE-78 9.1

D-Link DWR-M921 formDiskFormat system os command injection

A flaw has been found in D-Link DWR-M921 1.1.52. Impacted is the function system of the file /boafrm/formDiskFormat. This manipulation of the argument partition causes os command injection. The attack may be initiated re…

cve.org D-Link:DWR-M921 14 Sep 2026

CVE-2026-90701 CWE-89 7.3

subhajitkhan online-clinic-management-system listdoctor.php sql injection

A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is an unknown function of the file listdoctor.php. Performing a manipulati…

cve.org subhajitkhan:online-clinic-management-system 14 Sep 2026

CVE-2026-90893 CWE-352 N/A

MISP UserSettingsController CSRF Protection Bypass on setTheme, setHomePage, and eventIndexColumnToggle Endpoints

MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActio…

cve.org MISP:MISP 14 Sep 2026

CVE-2026-90700 CWE-89 6.3

itsourcecode Sales and Inventory System pro_edit1.php sql injection

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. Such manipulation of the argument prodcode leads to sql injecti…

cve.org itsourcecode:Sales · and · Inventory 14 Sep 2026

CVE-2026-88932 CWE-400 5.3

multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run it…

cve.org multer:multer 14 Sep 2026

CVE-2026-90699 CWE-78 9.9

D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection

A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack…

cve.org D-Link:DWR-M920 14 Sep 2026

CVE-2026-90698 CWE-125 5.3

memcached mcmc Tokenizer proto_text.c try_read_command_asciiauth out-of-bounds

A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results…

cve.org n/a:memcached 14 Sep 2026

CVE-2026-90697 CWE-639 4.3

SourceCodester Inventory Management System invoice.php authorization

A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to…

cve.org SourceCodester:Inventory · Management · System 14 Sep 2026

CVE-2026-89321 CWE-409 4.3

CVE-2026-89321

Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/{namespace}/{ext…

cve.org Eclipse · Foundation:Eclipse · OpenVSX 14 Sep 2026