CVE Notifier

CVE-2026-90617 CWE-78 7.3

GH05TCREW PentestAgent MCP HTTP Server main.py run_task os command injection

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the function run_task of the file interface/main.py of the component MCP HTTP Server. Perf…

cve.org GH05TCREW:PentestAgent 14 Sep 2026

CVE-2026-90615 CWE-79 4.3

SourceCodester Class and Exam Timetabling System subject1.php cross site scripting

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site sc…

cve.org SourceCodester:Class · and · Exam 14 Sep 2026

CVE-2026-90614 CWE-502 6.3

FedML-AI FedML MQTT+S3 Communication Backend remote_storage.py S3Storage.read_model deserialization

A weakness has been identified in FedML-AI FedML up to 0.9.6. Affected by this issue is the function S3Storage.read_model of the file fedml/core/distributed/communication/s3/remote_storage.py of the component MQTT+S3 Com…

cve.org FedML-AI:FedML 14 Sep 2026

CVE-2026-90613 CWE-617 3.3

GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertion

A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stbl_GetSampleInfos of the file isomedia/stbl_read.c of the component MP4Box. The manipulation results in reachab…

cve.org n/a:GPAC 14 Sep 2026

CVE-2026-90612 CWE-617 3.3

GPAC MP4Box scene_dump.c gf_sm_dump_command_list assertion

A vulnerability was identified in GPAC up to f1219cde. Affected is the function gf_sm_dump_command_list of the file scene_manager/scene_dump.c of the component MP4Box. The manipulation leads to reachable assertion. The a…

cve.org n/a:GPAC 14 Sep 2026

CVE-2026-90611 CWE-617 3.3

GPAC MP4Box loader_xmt.c xmt_parse_element assertion

A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmt_parse_element of the file scene_manager/loader_xmt.c of the component MP4Box. Executing a manipulation can lead to reachable assertion.…

cve.org n/a:GPAC 14 Sep 2026

CVE-2026-90610 CWE-126 3.3

GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read

A vulnerability was found in GPAC up to f1219cde. This affects the function gf_svg_attributes_copy of the file scenegraph/svg_attributes.c of the component MP4Box. Performing a manipulation results in buffer over-read. T…

cve.org n/a:GPAC 14 Sep 2026

CVE-2026-90609 CWE-476 3.3

GPAC MP4Box vrml_tools.c null pointer dereference

A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The att…

cve.org n/a:GPAC 14 Sep 2026

CVE-2026-90608 CWE-120 9.9

Totolink A3002MU boa formPortFw buffer overflow

A flaw has been found in Totolink A3002MU Hh-B20211125.1046. The affected element is the function formPortFw of the file /boafrm/formPortFw of the component boa. This manipulation of the argument service_type causes buff…

cve.org Totolink:A3002MU 14 Sep 2026

CVE-2026-90607 CWE-120 9.9

Totolink A3002MU boa formNewSchedule buffer overflow

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results i…

cve.org Totolink:A3002MU 14 Sep 2026

CVE-2026-38924 CWE-669 2.9

CVE-2026-38924

In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the …

MITRE Oraios · AI:Serena 14 Sep 2026

CVE-2026-33970 CWE-476 3.5

CVE-2026-33970

An issue was discovered in NR RRC and L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 2500, 1680, W920, W930, W1000, and Modem 5410. In the …

MITRE Samsung:Exynos · 850 · firmware 14 Sep 2026