Six low-severity, unrelated vulnerabilities from our September 2026 intake share a common trait: each is a single, narrow finding in a small or niche codebase, not substantial enough on its own to justify a full profile, but worth recording individually rather than omitting from coverage.
CVE-2026-86217: information disclosure in code-projects Hotel and Tourism Reservation
Affects code-projects Hotel and Tourism Reservation in PHP 1.0. Per the vulnerability record, an unknown function handling the file /ht/hotel_db (1).sql — the component’s database backup handler — discloses information when manipulated. The attack can be launched remotely, and a public exploit reportedly exists. CVSS base 5.3 (medium). A publicly accessible database-backup file path is a common misconfiguration class in small PHP projects; if the .sql backup itself is directly web-accessible, this could expose the full application database, not just the disclosure the CVE description narrowly names — treat this as worth verifying directly against your own deployment rather than assuming the scope is limited.
CVE-2026-86238: reflected XSS in Online Examination System
Affects projectworlds Online Examination System 1.0. Per the vulnerability record, the feedback.php file’s Feedback Form component fails to sanitize the Name/Subject parameters, allowing cross-site scripting via a remote, publicly-disclosed exploit. CVSS base 4.3 (medium).
CVE-2026-86301: reflected XSS in Hospital Information System
Affects code-projects Hospital Information System 1.0. Per the vulnerability record, the ID argument in /HIS/src/patients/editPatient.php’s Patient Management component is not sanitized, allowing cross-site scripting via a remote, publicly-disclosed exploit. CVSS base 3.5 (medium). Handling patient records makes input sanitization especially important here even though the CVSS score is modest — any deployment of this software with real patient data should not treat this as a low priority regardless of the numeric score.
CVE-2026-86226: reflected XSS in Online Attendance System
Affects Projectwolds Online Attendance System 1.0. Per the vulnerability record, the email argument in profile.php is not sanitized, allowing cross-site scripting via a remote, publicly-disclosed exploit. CVSS base 3.5 (medium).
CVE-2026-86227: out-of-bounds read in Valkey
Affects valkey-io Valkey up to 9.0.5/9.1.1 (the Redis-compatible in-memory data store). Per the vulnerability record, the kvstoreGetHashtable function in src/kvstore.c has an out-of-bounds read triggerable via the didx argument. The record itself provides an unusually clear exploitability caveat, worth quoting directly: exploitation “requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) — an attacker-position DoS at boot, not network pre-auth.” In other words, this is not remotely triggerable by an arbitrary network client; it requires an attacker who already has the ability to influence the RDB file Valkey loads at startup in a cluster-mode deployment.
The Valkey project’s own issue tracker, per the record, closed this report stating it “is worth fixing for the sake of memory safety… but I don’t think it meets our bar for a security disclosure.” A patch (4691888e7fab3df128f0bde5750c9fde2ae552fa) is nonetheless available. CVSS base 3.1 (low), consistent with the maintainer’s own assessment of low practical severity given the access precondition.
CVE-2026-86237: disputed SSRF report in OpenAgents
Affects openagents-org OpenAgents up to 0.8.19/0.9.3.post20. Per the vulnerability record, the test_default_model function in sdk/src/openagents/sdk/transports/http.py allows server-side request forgery via manipulation of the base_url argument, exploitable remotely, with a public exploit reportedly available.
This one carries a genuine dispute worth stating plainly. The record notes the “endpoint and both sinks unchanged since filing; only the file moved,” and that the “maintainer closed [the report] as inapplicable yet the identical unguarded code still ships in 0.9.3.post20.” It also notes that “sibling admin endpoints do call the shipped-but-unused-by-this-handler _require_admin()” — implying an authorization helper exists elsewhere in the codebase but isn’t applied to this particular handler. We’re reporting the technical claim (unguarded base_url in a shipped code path) alongside the maintainer’s disputed-closure status, rather than asserting either side’s position as settled — this is a claim/counter-claim situation, not a confirmed-and-fixed vulnerability. CVSS base 5.3 (medium).
Confidence
Confidence is medium across this roundup: the four PHP student/hobby-project findings (86217, 86238, 86301, 86226) trace to standard CVE records with named functions and files but no vendor security advisory (these are largely unmaintained or loosely maintained small projects); the Valkey finding traces to the project’s own issue tracker and includes the maintainer’s own severity assessment; the OpenAgents finding is explicitly disputed between the reporter and maintainer.
Why this matters
Not every disclosed vulnerability deserves the same depth of individual coverage — a single unsanitized parameter in a small, unmaintained student project doesn’t carry the same operational weight as a CVE in widely deployed infrastructure software. But low-severity findings in software used for real record-keeping (patient management, attendance tracking, hotel reservations) still matter to whoever is actually running that software, and misconfiguration-adjacent findings (like a database backup file that shouldn’t be web-accessible) are worth flagging even at “medium” CVSS. The Valkey and OpenAgents entries illustrate a different lesson: not every disclosed report survives maintainer review as a confirmed, exploitable-as-described vulnerability — read the access preconditions and disputed status before treating a CVE ID as proof of an exploitable flaw in your own deployment.
Frequently Asked Questions
Are these six vulnerabilities related to each other? No — they affect six entirely unrelated codebases (small PHP student projects, Valkey, and OpenAgents) and are grouped here because each is individually low-severity and narrow in scope, not because they share a root cause.
Is the Valkey vulnerability remotely exploitable? Not directly. Per the project’s own record, it requires cluster mode plus the ability to influence the RDB file Valkey loads at startup — not an arbitrary network client.
Is the OpenAgents SSRF report confirmed? It’s disputed. The maintainer closed it as inapplicable, but the report states the same unguarded code path still ships in the current release. We report both positions rather than asserting either as settled.
Are any of these six vulnerabilities being actively exploited? No evidence of active exploitation has been reported for any of the six as of this writing; none are listed in CISA’s KEV catalog.
Data sourced from National Vulnerability Database (NVD)/CVE records and each project’s own issue tracker where noted, aggregated September 2026. See more vulnerability intelligence.