CVE Notifier

CVE-2026-88592 CWE-? N/A

CVE-2026-88592

kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by TrustHostFilter against the trust.host whitelist. However, the URL parameter vali…

MITRE n/a:n/a 16 Sep 2026

CVE-2026-79298 CWE-? N/A

CVE-2026-79298

An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrary code via the BOOTia32.efi and a crafted cloak32.dat file on the ESP.

MITRE n/a:n/a 16 Sep 2026

CVE-2026-51990 CWE-? N/A

CVE-2026-51990

An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component

MITRE n/a:n/a 16 Sep 2026

CVE-2026-38999 CWE-? N/A

CVE-2026-38999

A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the se…

MITRE n/a:n/a 16 Sep 2026

CVE-2025-56566 CWE-? N/A

CVE-2025-56566

MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage. An attacker with physical access to the device can extract this material from an SPI flash …

MITRE n/a:n/a 16 Sep 2026

CVE-2025-56565 CWE-? N/A

CVE-2025-56565

DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within non-volatile memory. The exposed material includes SSH private keys, dynamic DNS p…

MITRE n/a:n/a 16 Sep 2026

CVE-2025-56563 CWE-? N/A

CVE-2025-56563

A Server-Side Request Forgery vulnerability exists in sat_proxy.php in Zenith Satellite Tracker 1.0. The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host …

MITRE n/a:n/a 16 Sep 2026

CVE-2026-92184 CWE-918 6.3

ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery

A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. Affected is the function urllib.request.urlopen of the file integrations/aws-strands/python/src/ag_ui_strands/utils.py of the component Multimodal Conten…

cve.org ag-ui-protocol:ag-ui 15 Sep 2026

CVE-2026-15640 CWE-290 N/A

Authentication Bypass via SAML Response Manipulation

Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user.

cve.org Delinea:Secret · Server · (On-Prem) 15 Sep 2026

CVE-2026-15639 CWE-79 N/A

Reflected Cross-Site Scripting

An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker.

cve.org Delinea:Secret · Server · (On-Prem) 15 Sep 2026

CVE-2026-15638 CWE-327 N/A

Cryptographic Padding Oracle

An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.

cve.org Delinea:Secret · Server · (On-Prem) 15 Sep 2026

CVE-2026-73460 CWE-863 6.1

Security Advisory 0160

On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate premat…

cve.org Arista · Networks:EOS 15 Sep 2026