2026

A vulnerability was identified in VS Revo RevoUninstaller 2.5.x/2.6.x. The affected element is the function IOCtl_Handle

A vulnerability was determined in GALAYOU Y4 1.0.0. Impacted is an unknown function of the component Web Server. This ma

A vulnerability was found in Comma AI Openpilot 0.11. This issue affects the function pickle.load/pickle.loads of the fi

A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. This vulnerability affects unknown code of

A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. This affects an unknown part of the component

A vulnerability was detected in Grit42 Grit up to 0.11.0. Affected by this issue is some unknown functionality of the fi

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Affected by this vulnerability is an unknow

A weakness has been identified in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function replace_country in the library

driftregion iso14229 through 0.9.0 contains an integer underflow and downstream out-of-bounds read in the Handle_0x27_Se

LiamBindle MQTT-C through version 1.1.6 contains a heap-based out-of-bounds read and integer underflow in the mqtt_unpac

Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-passwor

nanoMODBUS through v1.23.0 contains an off-by-one buffer overflow in the recv_msg_header function of the Modbus/TCP serv

Config::IniFiles versions before 3.001000 for Perl allow OS command injection and file overwrite via a 2-arg open() of t

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments

The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy s

In OpenStack Ironic before 37.0.1, when applying a PATCH to update fields in volume properties the user is authorized fo

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provide

A vulnerability has been found in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The impa

A vulnerability was detected in CodeAstro Student Attendance Management System 1.0. Impacted is an unknown function of t

A security vulnerability has been detected in D-Link DCS-935L 1.10.01. This issue affects the function snprintf of the f

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentic

SQL Injection in reports/catalogue_out.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x b

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Sc

The Meow Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che

The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming conne

The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scri

The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Incorrect Authorizatio

The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcod

The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vu

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing h

The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and o

We have released version 5.24.0 of the Grafana Operator. This patch includes a MEDIUM severity security fix for a path t

The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in vers

A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts wr

A race condition was found in the abrt-dbus D-Bus service's ChownProblemDir method. ChownProblemDir opens the dump direc

A time-of-check time-of-use (TOCTOU) race condition was found in the abrt-dbus D-Bus service's SetElement method. Betwee

The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in v

Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote at

Allegra exportReport Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attacker

Heap buffer out-of-bounds write vulnerability in Avira Antivirus engine when scanning a malformed POSIX tar archive may

Information disclosure vulnerability in Avira Password Manager when used with Mozilla Firefox may allow a remote attacke

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Loca

Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may all

Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malforme

An authorization flaw in MISP’s object add/edit handling allowed an authenticated user with object editing permissions t

Capgo before 12.128.2 contains a denial of service vulnerability allowing attackers to register accounts using arbitrary

Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remo

OpenClaw before 2026.5.7 contains a hostname validation vulnerability in retry endpoint checks that allows matching host