CVE-2026-36937
Sourcecodester Online Resort Management System v1.0 is vulnerable to SQL injection in /orms/admin/reservations/view_details.php.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- LOW
- Conflicts
- 1
Data & Insights
CVE Explorer
Search one exact, source-linked CVE snapshot by CVE ID or explicit vendor and product tokens. Provider severity, KEV, conflicts, and stale state remain separate observations—not a Baitaphish risk rating.
Exact snapshot results
353,537 CVE records
CVE-2026-36933
An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test feature.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-3693
A flaw has been found in Shy2593666979 AgentChat up to 2.3.0. This issue affects the function get_user_info/update_user_info of the file /src/backend/agentchat/api/v1/user.py of the component User Endpoint. This manipulation of the argument user_id causes improper control of resource identifiers. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- Shy2593666979
- Product
- AgentChat
- Provider severity
- HIGH, MEDIUM
- Conflicts
- 1
CVE-2026-36923
Sourcecodester Cab Management System 1.0 is vulnerable to SQL Injection in the file /cms/admin/bookings/view_booking.php.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-36922
Sourcecodester Cab Management System v1.0 is vulnerable to SQL injection in the file /cms/admin/categories/view_category.php.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-36920
Sourcecodester Online Reviewer System v1.0 is vulnerable to SQL Injection in the file /system/system/admins/assessments/examproper/questions-view.php.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-3692
In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server.
PUBLISHED
- Vendor
- Progress Software
- Product
- Flowmon
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-36919
Sourcecodester Online Reviewer System v1.0 is vulnerale to SQL Injection in the file /system/system/admins/assessments/examproper/exam-update.php.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-36912
A NULL pointer dereference in the AP4_AtomSampleTable::GetSample() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36911
A division-by-zero vulnerability in the CStreamSwitcherOutputPin::DecideBufferSize function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-36910
An access violation in the BaseSplitterFile::Read function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-3691
OpenClaw Client PKCE Verifier Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose stored credentials on affected installations of OpenClaw. User interaction is required to exploit this vulnerability in that the target must initiate an OAuth authorization flow. The specific flaw exists within the implementation of OAuth authorization. The issue results from the exposure of sensitive data in the authorization URL query string. An attacker can leverage this
PUBLISHED
- Vendor
- OpenClaw
- Product
- OpenClaw
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-36909
A NULL pointer dereference in the AP4_TkhdAtom::GetTrackId() function of Aleksoid1978 MPC-BE before commit 4341cb3 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-36908
A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-36907
A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-36906
Cross Site Scripting vulnerability in iotgateway v.3.0.1 allows a remote attacker to execute arbitrary code via the Log Record Function
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-3690
OpenClaw Canvas Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of OpenClaw. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the the authentication function for canvas endpoints. The issue results from improper implementation of authentication. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-29311.
PUBLISHED
- Vendor
- OpenClaw
- Product
- OpenClaw
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-3689
OpenClaw Canvas Path Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of OpenClaw. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of the path parameters provided to the canvas gateway endpoint. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vu
PUBLISHED
- Vendor
- OpenClaw
- Product
- OpenClaw
- Provider severity
- MEDIUM
- Conflicts
- 0
CVE-2026-3688
The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.10. This is due to the 'wcfmvm_membership_change' AJAX action not validating user permission to modify other users. This makes it possible for authenticated attackers, with vendor level access and above, to change any user's role to 'wcfm_vendor' by changing their membership plan.
PUBLISHED
- Vendor
- wclovers
- Product
- WCFM Membership – WooCommerce Memberships for Multivendor Marketplace
- Provider severity
- HIGH
- Conflicts
- 0
CVE-2026-36874
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_student.php.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-36873
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_admin.php.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-36872
Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load_book.php.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- LOW
- Conflicts
- 1
CVE-2026-36848
Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36841
TOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDevice function.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-36837
TOTOLINK A3002RU V3 <= V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the hostname parameter in the formMapDelDevice function.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-3683
A vulnerability was detected in bufanyun HotGo up to 2.0. This issue affects the function ImageTransferStorage of the file /server/internal/logic/common/upload.go of the component Endpoint. The manipulation results in server-side request forgery. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- bufanyun
- Product
- HotGo
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-36829
An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7. The server validates session cookies using a filesystem existence check based on a user-controlled cookie value without proper sanitization, allowing directory traversal and bypass of authentication.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- CRITICAL
- Conflicts
- 1
CVE-2026-36828
A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7. The CGI component allows authenticated users to execute arbitrary shell commands with root privileges via the action=runcmd parameter.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36827
A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7. The web management interface invokes the backend helper /usr/sbin/pappiw and passes user-controlled parameters to it. The helper performs unsafe argument processing using eval, which allows command injection when attacker-controlled input is included in the arguments. As a result, an authenticated remote attacker with access to the management interface may execute arbitrary shell commands.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-36823
Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36822
Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the macAddr parameter of the formDelStaState function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36821
Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the picCropName parameter of the formCropAndSetWewifiPic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36820
Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-3682
A security vulnerability has been detected in welovemedia FFmate up to 2.0.15. This vulnerability affects the function Execute of the file /internal/service/ffmpeg/ffmpeg.go. The manipulation leads to argument injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- welovemedia
- Product
- FFmate
- Provider severity
- MEDIUM
- Conflicts
- 2
CVE-2026-36819
Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the bindMACAddr parameter of the fromSetDhcpRules function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36818
Shenzhen Tenda Technology Co., Ltd Tenda W20E v15.11.0.6 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter of the formAddWewifiWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36817
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteUserInfo parameter of the formAddWebAuthWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36816
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the wewifiWhiteUserInfo parameter of the formAddWewifiWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36815
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the hostname parameter of the formSetNetCheckTools function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36813
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the picCropName parameter of the formCropAndSetWewifiPic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36811
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the picName parameter of the formDelwebAuthPic function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36810
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the gotoUrl parameter of the formPortalAuth function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-3681
A weakness has been identified in welovemedia FFmate up to 2.0.15. This affects the function fireWebhook of the file /internal/service/webhook/webhook.go. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
PUBLISHED
- Vendor
- welovemedia
- Product
- FFmate
- Provider severity
- MEDIUM
- Conflicts
- 1
CVE-2026-36809
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthWhiteID parameter of the formModifyWebAuthWhiteUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36808
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserInfo parameter of the formAddWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36807
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the formAddWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36806
Shenzhen Tenda Technology Co., Ltd Tenda W15E v15.11.0.10 was discovered to contain a buffer overflow in the webAuthUserPwd parameter of the formModifyWebAuthUser function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36805
Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to contain multiple buffer overflows in the Saveqqlist function via the qqStr and markStr parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36803
Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the qossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1
CVE-2026-36802
Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the SafeMacFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
PUBLISHED
- Vendor
- n/a
- Product
- n/a
- Provider severity
- HIGH
- Conflicts
- 1