CVE Notifier

CVE-2026-92247 CWE-434 4.7

synaptikcms synaptik-cms Admin File Manager file-manager.php rename unrestricted upload

A security vulnerability has been detected in synaptikcms synaptik-cms up to 1.3.4.4. This affects the function rename of the file admin/file-manager.php of the component Admin File Manager. The manipulation leads to unr…

cve.org synaptikcms:synaptik-cms 16 Sep 2026

CVE-2026-73450 CWE-345 6.9

Security Advisory 0161

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere …

cve.org Arista · Networks:EOS 16 Sep 2026

CVE-2026-92221 CWE-89 4.7

gedelumbung HospitalManagement app_global_admin_model.php generate_index_pasien sql injection

A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerability is the function generate_index_pasien of the file application/models/app_glo…

cve.org gedelumbung:HospitalManagement 16 Sep 2026

CVE-2026-92220 CWE-400 5.3

vllm-project vLLM MoRIIO Acknowledgement moriio_connector.py MoRIIOWrapper._handle_release_message resource consumption

A vulnerability was found in vllm-project vLLM 0.26.0/0.27.0. Affected is the function MoRIIOConnectorScheduler.request_finished/MoRIIOConnectorWorker.get_finished/MoRIIOWrapper._handle_release_message of the file vllm/d…

cve.org vllm-project:vLLM 16 Sep 2026

CVE-2026-92217 CWE-915 6.3

a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/message-processor.ts of the component Message Parsing. This m…

cve.org a2ui-project:a2ui 16 Sep 2026

CVE-2026-92299 CWE-862 7.4

@jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers ca…

cve.org Jitsi:@jitsi/electron-sdk 16 Sep 2026

CVE-2026-92298 CWE-338 4.8

EspoCRM through 10.0.8 Weak Token Generation via rand()

EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can gues…

cve.org EspoCRM:EspoCRM 16 Sep 2026

CVE-2026-92216 CWE-601 4.3

a2ui-project a2ui Binder generic-binder.ts openUrl redirect

A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation re…

cve.org a2ui-project:a2ui 16 Sep 2026

CVE-2026-92215 CWE-918 7.3

a2ui-project a2ui FileResolver file_resolver.py httpx.get server-side request forgery

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.get of the file agent_sdks/python/a2ui_agent/src/a2ui/extensions/file_resolve/file_resolver.py of the…

cve.org a2ui-project:a2ui 16 Sep 2026

CVE-2026-92214 CWE-79 3.5

a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting

A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projects/a2a-chat-canvas/src/lib/services/sanitizer-markdown-renderer-service.ts of th…

cve.org a2ui-project:a2ui 16 Sep 2026

CVE-2026-92213 CWE-74 5.5

a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulat…

cve.org a2ui-project:a2ui 16 Sep 2026

CVE-2026-88593 CWE-? N/A

CVE-2026-88593

kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization…

MITRE n/a:n/a 16 Sep 2026