2026

A vulnerability has been found in Shibby Tomato 1.28.0000. This vulnerability affects the function start_6rd_tunnel of t

In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there

A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versi

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Versi

A flaw has been found in Shibby Tomato 1.28.0000. This affects the function start_dhcpc of the file /sbin/rc of the comp

An integer underflow in bt_mesh_sol_recv() in the Bluetooth Mesh solicitation handling (subsys/bluetooth/mesh/solicitati

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create c

CoreShop is a Pimcore enhanced eCommerce solution. In versions 5.0.1 through 5.1.0-beta.1,, the GitHub Actions workflow

NAVTOR NavBox through version 4.16.1.20 contains hard-coded credentials within its Windows Communication Foundation (SOA

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp im

Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` whi

Froxlor is open source server administration software. Version 2.3.6 contains a symlink-following flaw in the root-owned

Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_she

Froxlor is open source server administration software. Prior to version 2.3.7, the `DomainZones.add` API endpoint does n

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory

A missing upper-bound check in the udpif_set_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB wr

SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANS

Cross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.

In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properti

The netty incubator codec.bhttp is a java language binary http parser. The library implements Oblivious HTTP (RFC 9458)

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.21.Final, HKDF_expand return

Seagull Software BarTender 2021 R1 through 12.0.1 contains an insecure deserialization vulnerability that allows low-pri

Seagull Software BarTender 2010, 2016, and 2019 contain an unauthenticated remote code execution vulnerability in the .N

OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly

nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured No

An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensitive information and

The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The application does not

The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command inje

In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another p

Deserialization of Untrusted Data in the Java replace-resolve path in Apache Fory fory-core Java SDK before 1.1.0 on Jav

Net::CIDR::Set versions through 0.20 for Perl did not validate network masks. The mask portion of a network mask could

Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses. The add method called the _encode method t

Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks. Unicode digits such as the Ar

Etsy::StatsD versions through 1.002002 for Perl allow metric injections. The metric names and values are not checked fo

Net::Statsd versions before 0.13 for Perl allow metric injections. The metric names are not checked for newlines, colon

Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router u

tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names,

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.0.17, `go.opentelemetry.io/otel/schema/v1

An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. The oslo.messaging RabbitMQ driver does not pe

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose a public

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `configUp

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `log_js_e

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. I

bacnet_stack 1.3.1 contains an Out-of-bounds Read in bacnet_tag_number_decode which allows attackers to cause a denial o

GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing atta

A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplie