https://vulnogram.org/ Most recent CVEs assigned by VulDB (vuldb). https://vulnogram.org/seaview/icons/vuldb.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-114040 https://vulnogram.org/CVE-2026-114040 A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get_model_meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the a… Medium Wed, 21 Oct 2026 03:45:17 GMT https://vulnogram.org/CVE-2026-114039 https://vulnogram.org/CVE-2026-114039 A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injection. The attac… Medium Wed, 21 Oct 2026 03:30:13 GMT https://vulnogram.org/CVE-2026-113744 https://vulnogram.org/CVE-2026-113744 A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewall… Critical Wed, 21 Oct 2026 01:30:24 GMT https://vulnogram.org/CVE-2026-113743 https://vulnogram.org/CVE-2026-113743 A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file models/tt_transformers/tt/load_checkpoints.py. This manipulation of the argument weight_map causes path… High Wed, 21 Oct 2026 01:15:29 GMT https://vulnogram.org/CVE-2026-113741 https://vulnogram.org/CVE-2026-113741 A vulnerability has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this issue is some unknown functionality of the file /404.php. Such manipulation of the argument useruid leads to cross site scripting. The attack may be perf… Medium Wed, 21 Oct 2026 01:00:23 GMT https://vulnogram.org/CVE-2026-113740 https://vulnogram.org/CVE-2026-113740 A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is possible to be… Medium Wed, 21 Oct 2026 00:45:16 GMT https://vulnogram.org/CVE-2026-113738 https://vulnogram.org/CVE-2026-113738 A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This vulnerability affects the function extract_mtp_heads of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py of the comp… High Wed, 21 Oct 2026 00:30:24 GMT https://vulnogram.org/CVE-2026-113737 https://vulnogram.org/CVE-2026-113737 A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d09. This affects the function validate_indexed_tensors of the file qwen-mtp-gguf/scripts/qwen_mtp_gguf_pipeline.py. Executing a manipulation o… Medium Wed, 21 Oct 2026 00:15:22 GMT https://vulnogram.org/CVE-2026-113736 https://vulnogram.org/CVE-2026-113736 A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03. The impacted element is the function login_prepare_hnap of the file etc/defnodes/defaultvalue.xml of the component HNAP Login. The manipulation of the argument Password leads to empty pas… Critical Wed, 21 Oct 2026 00:00:32 GMT https://vulnogram.org/CVE-2026-113735 https://vulnogram.org/CVE-2026-113735 A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Affected by this vulnerability is the function mydlink_set_root_pwd of the file /mnt/mtd/aoni_ipc. Executing a manipulation can lead to use of weak credentials. The attack may be launched r… Medium Tue, 20 Oct 2026 23:45:35 GMT https://vulnogram.org/CVE-2026-113707 https://vulnogram.org/CVE-2026-113707 A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be perf… Medium Tue, 20 Oct 2026 23:30:22 GMT https://vulnogram.org/CVE-2026-113706 https://vulnogram.org/CVE-2026-113706 A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible… Medium Tue, 20 Oct 2026 23:15:22 GMT https://vulnogram.org/CVE-2026-113705 https://vulnogram.org/CVE-2026-113705 A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be execut… Medium Tue, 20 Oct 2026 22:45:09 GMT https://vulnogram.org/CVE-2026-113704 https://vulnogram.org/CVE-2026-113704 A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPush… High Tue, 20 Oct 2026 22:00:25 GMT https://vulnogram.org/CVE-2026-113643 https://vulnogram.org/CVE-2026-113643 A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of… Medium Tue, 20 Oct 2026 18:15:12 GMT https://vulnogram.org/CVE-2026-113507 https://vulnogram.org/CVE-2026-113507 A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from r… Medium Tue, 20 Oct 2026 17:30:15 GMT https://vulnogram.org/CVE-2026-113506 https://vulnogram.org/CVE-2026-113506 A vulnerability has been found in aaPanel up to 8.25.0. The affected element is the function ExecShell of the file class/public/common.py of the component File Manager. The manipulation of the argument sfile/dfile/access/user leads to os command inje… Critical Tue, 20 Oct 2026 17:15:12 GMT https://vulnogram.org/CVE-2026-113505 https://vulnogram.org/CVE-2026-113505 A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send_file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be exe… Medium Tue, 20 Oct 2026 16:15:14 GMT https://vulnogram.org/CVE-2026-113466 https://vulnogram.org/CVE-2026-113466 A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation le… Medium Unsupported When Assigned Tue, 20 Oct 2026 14:45:12 GMT https://vulnogram.org/CVE-2026-113411 https://vulnogram.org/CVE-2026-113411 A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWindow.js of the component Window Open Handler. The manipulation of the argument url results in improper authoriz… High Tue, 20 Oct 2026 14:30:19 GMT https://vulnogram.org/CVE-2026-113397 https://vulnogram.org/CVE-2026-113397 A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads… High Unsupported When Assigned Tue, 20 Oct 2026 14:15:12 GMT https://vulnogram.org/CVE-2026-113396 https://vulnogram.org/CVE-2026-113396 A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable cause… High Unsupported When Assigned Tue, 20 Oct 2026 14:00:20 GMT https://vulnogram.org/CVE-2026-113395 https://vulnogram.org/CVE-2026-113395 A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results… High Unsupported When Assigned Tue, 20 Oct 2026 13:45:18 GMT https://vulnogram.org/CVE-2026-113394 https://vulnogram.org/CVE-2026-113394 A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiat… High Unsupported When Assigned Tue, 20 Oct 2026 13:30:14 GMT https://vulnogram.org/CVE-2026-113393 https://vulnogram.org/CVE-2026-113393 A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument upload_path/upload_nam… Medium Unsupported When Assigned Tue, 20 Oct 2026 13:15:17 GMT https://vulnogram.org/CVE-2026-113392 https://vulnogram.org/CVE-2026-113392 A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal… High Unsupported When Assigned Tue, 20 Oct 2026 13:00:16 GMT https://vulnogram.org/CVE-2026-113391 https://vulnogram.org/CVE-2026-113391 A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be e… Critical Unsupported When Assigned Tue, 20 Oct 2026 12:45:19 GMT https://vulnogram.org/CVE-2026-113390 https://vulnogram.org/CVE-2026-113390 A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/mainfunction.cgi of the component CGI Interface. This manipulation of the argument usefile/usescript/option causes… Critical Unsupported When Assigned Tue, 20 Oct 2026 12:30:17 GMT https://vulnogram.org/CVE-2026-113389 https://vulnogram.org/CVE-2026-113389 A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results… Critical Unsupported When Assigned Tue, 20 Oct 2026 12:00:14 GMT https://vulnogram.org/CVE-2026-113388 https://vulnogram.org/CVE-2026-113388 A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument host/port/… Medium Tue, 20 Oct 2026 11:45:15 GMT https://vulnogram.org/CVE-2026-113385 https://vulnogram.org/CVE-2026-113385 A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application… Medium Tue, 20 Oct 2026 11:15:14 GMT https://vulnogram.org/CVE-2026-113384 https://vulnogram.org/CVE-2026-113384 A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was con… Medium Tue, 20 Oct 2026 11:00:12 GMT https://vulnogram.org/CVE-2026-113383 https://vulnogram.org/CVE-2026-113383 A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack i… Medium Tue, 20 Oct 2026 10:45:12 GMT https://vulnogram.org/CVE-2026-113382 https://vulnogram.org/CVE-2026-113382 A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_fil… Medium Tue, 20 Oct 2026 10:15:19 GMT https://vulnogram.org/CVE-2026-113381 https://vulnogram.org/CVE-2026-113381 A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argument sPattern c… High Tue, 20 Oct 2026 09:45:06 GMT https://vulnogram.org/CVE-2026-113378 https://vulnogram.org/CVE-2026-113378 A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The at… Medium Disputed Tue, 20 Oct 2026 09:30:14 GMT https://vulnogram.org/CVE-2026-112373 https://vulnogram.org/CVE-2026-112373 A security vulnerability has been detected in H3C Magic NX15 NX15V100R017. This impacts the function sub_416874 of the file /usr/bin/usrlist. Such manipulation leads to stack-based buffer overflow. It is possible to launch the attack remotely. The ex… High Mon, 19 Oct 2026 23:00:16 GMT https://vulnogram.org/CVE-2026-112372 https://vulnogram.org/CVE-2026-112372 A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit… Medium Mon, 19 Oct 2026 22:45:19 GMT https://vulnogram.org/CVE-2026-112371 https://vulnogram.org/CVE-2026-112371 A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed r… Critical Mon, 19 Oct 2026 22:30:17 GMT https://vulnogram.org/CVE-2026-112370 https://vulnogram.org/CVE-2026-112370 A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The exploit has be… Critical Mon, 19 Oct 2026 22:15:15 GMT https://vulnogram.org/CVE-2026-112361 https://vulnogram.org/CVE-2026-112361 A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the component CSP. Such manipulation leads to protection mechanism failure. The attack can be executed remotely. U… Medium Mon, 19 Oct 2026 21:45:06 GMT https://vulnogram.org/CVE-2026-112360 https://vulnogram.org/CVE-2026-112360 A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack m… High Mon, 19 Oct 2026 21:30:19 GMT https://vulnogram.org/CVE-2026-112358 https://vulnogram.org/CVE-2026-112358 A weakness has been identified in TiBillet Lespass up to 10e87909c5d526dffa6d424c104fc12860740537. This vulnerability affects the function get_img_from_url of the file ApiBillet/serializers.py of the component APIv1. Executing a manipulation of the a… Medium Mon, 19 Oct 2026 21:15:15 GMT https://vulnogram.org/CVE-2026-112302 https://vulnogram.org/CVE-2026-112302 A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to b… High Mon, 19 Oct 2026 21:00:23 GMT https://vulnogram.org/CVE-2026-112301 https://vulnogram.org/CVE-2026-112301 A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can b… High Mon, 19 Oct 2026 20:45:16 GMT https://vulnogram.org/CVE-2026-112300 https://vulnogram.org/CVE-2026-112300 A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation… Medium Mon, 19 Oct 2026 20:30:18 GMT https://vulnogram.org/CVE-2026-112299 https://vulnogram.org/CVE-2026-112299 A vulnerability was determined in smrealms smr up to f40380c017bc35cd8db6ffdb9d4e78bf65b9d43d. Affected is the function isUrlReachable of the file src/pages/Account/AlbumEditProcessor.php of the component Album Website. Executing a manipulation of th… Medium Mon, 19 Oct 2026 20:15:27 GMT https://vulnogram.org/CVE-2026-112297 https://vulnogram.org/CVE-2026-112297 A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument base_url causes se… Medium Mon, 19 Oct 2026 19:45:05 GMT https://vulnogram.org/CVE-2026-112254 https://vulnogram.org/CVE-2026-112254 A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function _fetch_html of the file locations/services/property_url_importer.py of the component Property URL Importer. The manipulation of the argume… Medium Mon, 19 Oct 2026 19:30:12 GMT https://vulnogram.org/CVE-2026-112252 https://vulnogram.org/CVE-2026-112252 A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql… High Mon, 19 Oct 2026 19:00:17 GMT