2026

Ghidra before 12.1 contains a heap-use-after-free vulnerability in the decompiler's HighVariable::merge() function durin

Ghidra before 12.2 contains an unauthenticated path traversal vulnerability in the IsfServer that accepts TCP connection

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to

Ghidra before 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows

Ghidra before 12.0.3 contains an out-of-memory vulnerability in the rust_demangle function that allocates unbounded outp

Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry

Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code th

Ghidra before 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metach

Ghidra 11.0 before 12.1 contains a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabas

Ghidra before 12.1 contains a path traversal vulnerability in SameDirDebugInfoProvider that fails to validate filenames

Ghidra before 12.1 contains a heap-use-after-free vulnerability in SleighBuilder::generatePointerAdd caused by iterator

Ghidra 10.2 before 12.1 contains an uncontrolled resource consumption vulnerability in ExportTrie.parseTrie() that lacks

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM Portfolio a

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block th

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block th

Ghidra before 11.2 contains a use after free vulnerability in the Sleigh backend caused by undefined static initializati

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.too

Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.too

An HTML injection vulnerability in the "fetch links" email sent by Thinkst Applied Research Canarytokens, enabling Inter

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages

Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debus

The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8

The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'grid[properties][borderCol

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all version

The aThemes Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title_tag' Widge

Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the  in Permission, Cache, and

The Schema & Structured Data for WP & AMP WordPress plugin before 1.60 does not check user capabilities on its frontend

The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and o

The Anti-Spam by CleanTalk. Spam protection WordPress plugin before 6.79 does not properly sanitize content within a cus

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL state

A vulnerability has been found in some Dahua products could allow an unauthenticated remote attacker to send a specially

A vulnerability has been found in some Dahua products could allow an authenticated remote attacker to send a specially c

A vulnerability has been found in some Dahua products. An attacker may obtain the device’s CA root certificate. If that

An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could pote

NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as (stub) resolver over UDP, lacks m

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vu

A buffer overflow vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vu

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile()

The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerabl

A buffer overflow vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t

A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vul

An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user a

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a r

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attack

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A NULL pointer dereference vulnerability has been reported to affect File Station 6. If a remote attacker gains a user a

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attack

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote