Daily digest
Sunday 20 September 2026
A quiet day: only 104 new CVEs against a recent average of about 633. Of those, 9 critical and 30 high. 48 arrived with exploitation evidence or public exploit code already attached. SourceCodester was the most-affected vendor with 10.
New this day, ranked by depth score
The 12 that matter most of the 104 published.
CVE-2026-94089Critical· 10.0PoCA vulnerability was determined in D-Link DIR-868L 2.01b05
A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfa_authentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lea…
CVE-2026-94003Critical· 10.0PoCA vulnerability has been found in Comfast CF-N1-S 2.6.0.1
A vulnerability has been found in Comfast CF-N1-S 2.6.0.1. Impacted is the function get_css_path_from_uri of the file /cgi-bin/mbox-config of the component Web Management Interface. The manipulation leads to stack-based buffer overflow. …
CVE-2026-90817Critical· 9.8PoCAn unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an uninte…
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in which a malicious user could potentially exploit it by manipulating HTTP requests to access an uninte…
CVE-2026-93958Critical· 9.1PoCA vulnerability was found in D-Link R95 BE9500_1.00.16
A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. The manipulation of the argument NTPServer results in os command injection. The attack c…
CVE-2026-88854Critical· 9.3PoCJoomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with …
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with …
CVE-2026-94036High· 8.8PoCA security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402
A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402. The impacted element is an unknown function of the file /ubus of the component routerd. The manipulation of the argument passwd_set results…
CVE-2026-93962High· 8.3PoCA weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1
A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can le…
CVE-2026-94109High· 8.0PoCopenEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing …
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing …
CVE-2026-94084Critical· 9.4Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
CVE-2026-94083Critical· 9.4Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade)
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). Thi…
CVE-2026-94038High· 7.3PoCA security vulnerability has been detected in NonceGeek dim-sum-app
A security vulnerability has been detected in NonceGeek dim-sum-app. This impacts the function textSearchV2Handler of the file deno/main.tsx of the component Deno Backend. Such manipulation of the argument supabase_url leads to server-si…
CVE-2026-94015High· 7.3PoCA vulnerability was identified in SourceCodester Drug Recommendation System 1.0
A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drug_recommender/Admin/edit_user.php. Such manipulation of the argument ID leads to sql injection. The attack …
Most-changed records
Existing CVEs whose severity, score, KEV or exploitation status moved.
- CVE-2019-9901Envoy 1.9.0 and before does not normalize HTTP URL pathsseverity, cvss37
- CVE-2025-71348picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methodsexploit_available45
- CVE-2014-6407Arbitrary Code Execution in Dockercvss41
- CVE-2026-81000net: tun: bound receive headroomcvss, exploit_available55
- CVE-2026-78030DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a mo…severity, cvss54
- CVE-2026-89538SUNRPC: Reject krb5 v2 wrap tokens with oversized ec fieldseverity, cvss54
- CVE-2026-89558md/raid10: fix still_degraded being inverted in raid10_sync_request()severity, cvss54
- CVE-2026-89636smb: client: clear ce->tgthint in free_tgts()severity, cvss54
Most-affected vendors
By CVEs published in the period.