2026

LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reac

Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows aut

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends cl

LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php

SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated

SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that

Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped

NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-data

A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of th

A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add

A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret of the file secret_

A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs

A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulnerability is the func

A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function CasP3ProxyValidate

A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the

A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the function String.Repl

A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the function validatePaypalOrd

A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_file of the file syst

A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This affects the function

A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.path.join of the com

A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unknown functionality of

The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allow

The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions,

The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installatio

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL qu

The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL qu

The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext pa

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputt

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one

The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputtin

The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets bef

A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /

A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_q

A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v of the fi

A vulnerability was determined in Studio-Saelix Sencho up to 0.94.1. This vulnerability affects unknown code of the file

A vulnerability has been found in Studio-Saelix Sencho up to 0.97.1. Affected by this issue is the function isValidRemot

eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allo

CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint tha

CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to

CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authe

1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowin

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule ha

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list

CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated c

ConvertX through 0.19.0 contains an arbitrary file read vulnerability that allows authenticated users to read server fil

1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldControll

mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to de

mall4j through 4.0 contains an information disclosure vulnerability that allows authenticated customers to read other sh