CVE Notifier

CVE-2026-19941 CWE-345 5.9

checkwildcard() accepts an out-of-zone NSEC as a wildcard-nonexistence proof

An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an upstream level of the zone name to mask the existence of a victim's wild…

cve.org ISC:BIND · 9 16 Sep 2026

CVE-2026-61590 CWE-306 7.4

djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-in…

cve.org djust-org:djust 16 Sep 2026

CVE-2026-19662 CWE-416 5.9

qpcache NOQNAME proof use-after-free crashes recursive resolver

An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC-signed zone hosted by an authoritative server under the control of the …

cve.org ISC:BIND · 9 16 Sep 2026

CVE-2026-19667 CWE-197 7.5

Remote assertion failure via 16-bit length truncation in `dns_ncache_add()`

If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named`…

cve.org ISC:BIND · 9 16 Sep 2026

CVE-2026-92364 CWE-89 6.3

itsourcecode Leave Management System index.php sql injection

A vulnerability has been found in itsourcecode Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /module/employee/index.php. The manipulation of the argument ID leads to …

cve.org itsourcecode:Leave · Management · System 16 Sep 2026

CVE-2026-81736 CWE-1050 7.5

Remote CPU denial of service through cached SVCB/HTTPS AliasMode trees

If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response. This issue affects BIND 9 …

cve.org ISC:BIND · 9 16 Sep 2026

CVE-2026-85104 CWE-924 N/A

Brain stimulation parameters can be modified via Bluetooth in Sooma

In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters.

cve.org Sooma:Sooma · tDCS · Home 16 Sep 2026

CVE-2026-92363 CWE-400 4.3

ag-ui-protocol ag-ui JSON sse_parser.cpp resource consumption

A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sse_parser.cpp of the component JSON Parser. Executing a manipulation can lead to resource consumption. The attack…

cve.org ag-ui-protocol:ag-ui 16 Sep 2026

CVE-2026-92469 CWE-639 8.1

microservices-platform through 6.0.0 Arbitrary File Deletion via Missing Ownership Check

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs no ownership validation. Authenticated attackers can enumera…

cve.org zlt2000:microservices-platform 16 Sep 2026

CVE-2026-92468 CWE-639 6.5

microservices-platform through 6.0.0 Arbitrary Elasticsearch Index Read via search-center

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in…

cve.org zlt2000:microservices-platform 16 Sep 2026

CVE-2026-92467 CWE-620 8.3

microservices-platform through 6.0.0 Unverified Password Change via /users/password

zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that allows authenticated users to change any account password by omitting the current…

cve.org zlt2000:microservices-platform 16 Sep 2026

CVE-2026-92466 CWE-862 8.8

microservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to false, disabling all permission checks after authentication. A…

cve.org zlt2000:microservices-platform 16 Sep 2026