2026

A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Ser

MoviePilot contains a path traversal vulnerability in the AliPan, U115, and Rclone cloud storage download handlers where

Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow in the page parameter

A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of

Markdown Preview Enhanced 0.8.x with crossnote engine 0.9.28 contains a code injection vulnerability in the WaveDrom ren

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.1 use `uniqid` for generatin

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper se

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 11.0.6 and prior to version 25.

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an Authenticated Local Fil

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the HAX CMS NodeJS applica

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. An SQL injection vulnerability exists in Open X

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, an authenticated attac

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Starting in version 9.5.0 and prior to version

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, a flaw in Open XDMoD's

Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific,

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista E

An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Mana

A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Ge

A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Fire

An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge

Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauth

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper val

A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Beca

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced Go Wrapper for Amazon Aurora PostgreSQL w

An untrusted search path issue in the GlobalDatabasePlugin in the AWS Advanced JDBC Wrapper for Amazon Aurora PostgreSQL

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for Wor

The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for Wor

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability e

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability e

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` functio

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vu

HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF)

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0 of HAX CMS PHP, the `saveFi

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0

UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Co

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrat

Markdown Preview Enhanced before 0.8.28 parses WaveDrom diagrams by evaluating untrusted markdown content with eval(), a

Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block

Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not val

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting i

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to v