CVE Notifier

CVE-2026-92413 CWE-476 4.3

Artifex MuPDF PDF Xref Loading pdf-stream.c pdf_open_filter null pointer dereference

A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is the function pdf_open_filter of the file pdf-stream.c of the component PDF Xref Loading. Executing …

cve.org Artifex:MuPDF 16 Sep 2026

CVE-2026-84397 CWE-79 5.4

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma…

cve.org Adobe:Adobe · Experience · Manager 16 Sep 2026

CVE-2026-18120 CWE-862 N/A

Missing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permission check applied by the normal dashboard and CSV Export flow. …

cve.org Concrete · CMS:Concrete · CMS 16 Sep 2026

CVE-2026-92406 CWE-89 7.3

SourceCodester Inventory and Monitoring System btn_functions.php add sql injection

A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments/databank/btn_functions.php?action=add. Performing a manipula…

cve.org SourceCodester:Inventory · and · Monitoring 16 Sep 2026

CVE-2026-85387 CWE-613 N/A

Concrete CMS before 9.5.4 allows a deactivated user to retain OAuth-authenticated REST API access

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account the token had been issued to. The resource server's authorization validator confir…

cve.org Concrete · CMS:Concrete · CMS 16 Sep 2026

CVE-2026-92405 CWE-89 7.3

SourceCodester Inventory and Monitoring System index.php sql injection

A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element is an unknown function of the file /index.php. Such manipulation of the argument Username leads to sq…

cve.org SourceCodester:Inventory · and · Monitoring 16 Sep 2026

CVE-2026-20331 CWE-693 9.6

Cisco Secure Adaptive Security Appliance Software, Secure Firewall Threat Defense Software and Secure Firewall Management Center Software Hardening Release - Protection Mechanism Failure Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software and Cisco Secure Firewall Management C…

cve.org Cisco:Cisco · Secure · Firewall 16 Sep 2026

CVE-2026-20234 CWE-522 9.9

Cisco Identity Services Engine Hardening Release - Insuffiencently Protected Credential Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) engineering teams have conducted a comprehensiv…

cve.org Cisco:Cisco · Identity · Services 16 Sep 2026

CVE-2026-42784 CWE-347 7.4

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confu…

cve.org Red · Hat:Confidential · Compute 16 Sep 2026

CVE-2026-76420 CWE-285 9.0

Cisco Secure Firewall Management Center Software Impersonated sftunnel Connection Vulnerability

A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. This vulnerab…

cve.org Cisco:Cisco · Secure · Firewall 16 Sep 2026

CVE-2026-20307 CWE-502 9.9

Cisco Identity Services Engine Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vul…

cve.org Cisco:Cisco · Identity · Services 16 Sep 2026

CVE-2026-20305 CWE-78 9.1

Cisco Identity Services Engine Command Injection Vulnerability

A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. …

cve.org Cisco:Cisco · Identity · Services 16 Sep 2026