CVE-2026-82779

OS Command Injection in Contec CPS Series Allows Remote Code Execution

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

CVSS 4.0 · 8.7 High EPSS 1.9% KEV · Not listed

Vendors

—

Products

—

CVE-2026-82794

SolarView Compact OS Command Injection in Schedule Settings

SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

CVSS 4.0 · 8.7 High EPSS 1.9% KEV · Not listed

Vendors

Contec

Products

Sv-cpt-mc310 Sv-cpt-mc310f

CVE-2026-82796

Cross‑Site Scripting in SolarView Compact Image Management Allows OS Command Execution

SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Contec

Products

Sv-cpt-mc310 Sv-cpt-mc310f

CVE-2026-49446

Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers and before invoking AdminOnlyWithRedirect. An attacker with a valid x-cstln-auth API key for an enrolled device who reaches Cosmos through the Constellation Nebula tunnel can supply a chosen x-cosmos-user value to a route with AuthEnabled enabled when the upstream application trusts that forward-auth header. The request can bypass Cosmos JWT, password, MFA, and AdminOnly checks, allowing user impersonation and admin-tier reads or writes exposed by the proxied application. This issue is fixed in version 0.22.19.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Azukaar

Products

Cosmos-server

CVE-2026-48987

pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event_manager.py appends a Client object to the clients list for each unique uuid submitted to the authenticated getEvents API endpoint, but get_events does not invoke the available clean method to remove inactive clients. An authenticated user can repeatedly submit unique UUID values, causing retained client objects and process memory to grow without bound even after requests stop. The resulting memory exhaustion can trigger an operating-system out-of-memory termination of pyLoad or host-wide instability and denial of service. This issue is fixed in version 0.5.0b3.dev101.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Pyload

Products

Pyload

CVE-2026-87016

Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and get_user_by_scim_external_id in backend/open_webui/models/users.py used JSON contains matching that compiled to SQL LIKE substring matching on SQLite. An OAuth subject containing percent or underscore wildcard characters could resolve to a different stored identity, potentially selecting an administrator account and issuing the attacker that account's session; PostgreSQL deployments were not affected. This issue is fixed in version 0.11.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Open-webui Openwebui

Products

Open-webui Open Webui

CVE-2026-18905

IBM ContextForge MCP Gateway is affected by server-side request forgery via DNS TOCTOU at tool invocation

IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain sensitive information due to a DNS rebinding vulnerability during tool invocation.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Contextforge Contextforge-mcp-gateway

CVE-2026-91835

OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in interpretation conflict. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version 0.1.7 is sufficient to resolve this issue. The patch is identified as 04401337b3adb9343bd338b21e5e258bf49ca9c8. You should upgrade the affected component.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Openclaw

Products

Clawscan

CVE-2026-91825

MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit

Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4. If the attacker instead omitted distribution but supplied a different sharing_group_id, that authorization branch was skipped. Later, MISP’s field-recovery logic restored the existing event distribution from storage. For events already configured with sharing-group distribution, the unauthorized sharing-group ID could therefore be saved. The fix adds authorization checks in both the controller and Event::_edit() whenever a non-empty sharing_group_id is supplied without distribution. The model now calls SharingGroup::checkIfAuthorised() before persisting the change. Version affected: ≤2.5.45

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Misp

Products

Misp

CVE-2026-91819

MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs POST, PUT, PATCH, and DELETE, CakePHP also clears the parsed request body. MISP’s security component then determines whether to perform _validatePost() and _validateCsrf() based on whether request data remains. With a value such as: _method=GET the body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body Version affected: ≤2.5.45

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Misp

Products

Misp

CVE-2026-91091

GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of the file scenegraph/base_scenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2026-91088

GPAC URL url.c gf_url_concatenate_ex heap-based overflow

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gf_url_concatenate_ex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable of addressing this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2026-91086

GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow

A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_process of the file filters/reframe_mpgvid.c of the component MPEG Video Reframer. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version abi-16.23 can resolve this issue. The name of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac

CVE-2026-91004

SourceCodester Online Faculty Clearance System delete_faculty1.php sql injection

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete_faculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Online Faculty Clearance System

CVE-2026-91003

D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow

A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Service. This manipulation of the argument redirct_url causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

D-link

Products

Di-8300

CVE-2026-91001

D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow

A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS Configuration. Performing a manipulation of the argument serv/user/host/wild/mx/bmx/cust/ip results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

D-link

Products

Di-8400

CVE-2026-90879

zyx0814 FilePress Publish search.php sql injection

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zyx0814

Products

Filepress

CVE-2026-90846

PHPGurukul Daily Expense Tracker System forgot-password.php sql injection

A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the file /dets/forgot-password.php. The manipulation of the argument email/contactno leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Daily Expense Tracker System

CVE-2026-90841

PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Blood Donor Management System

CVE-2026-90824

GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow

A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Gpac

Products

Gpac