2026

PHP EI-Tube Script 3 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary

Zuz Music 2.1 contains a persistent cross-site scripting vulnerability that allows unauthenticated attackers to inject m

Listing Hub CMS 1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQ

PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute

Care2x 2.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL

WordPress Plugin ad manager wd 1.0.11 contains an arbitrary file download vulnerability that allows unauthenticated atta

All in One Video Downloader 1.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute

Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and

This vulnerability exists in GX Earth ONT models due to the transmission of user credentials in plaintext over HTTP in i

This vulnerability exists in GX Earth ONT models due to improper handling of user-supplied input in multiple diagnostic

A flaw was found in the OpenShift Cloud Credential Operator Mint-mode IAM policies for AWS. Operator credentials are pro

A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the sys

A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/r

A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflo

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the libra

HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site script

HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to

HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by

HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing s

HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an ar

A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user t

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Tips and Tricks HQ WP eMembe

A security vulnerability has been detected in modelscope ms-swift up to 4.2.0. This affects the function Template._save_

Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rlottie: b

Fixed AES-128-CBC keys inside the AcerConnect OTA application let attackers forge authorization credentials for arbitrar

The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems t

The web administration panel binds broadly to the public IPv6 address space on port [::]:8080 without default firewall l

The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary

In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Photo Galler

Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks. This issue affects

Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Mani

Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation. T

Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. This issue affects rl

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. This iss

A weakness has been identified in PaddlePaddle FastDeploy up to 2.4.1. Affected by this issue is the function hash_featu

Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. This issue affects rlottie: be

The account validation endpoint /v1/User/validate returns comprehensive user profile data sheets, which can be crawled b

Weak validation logic within device dissociation API routines allows a remote entity to forcefully unbind unrelated user

Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious

The device encrypts data using AES-CBC with static zero-filled Initialization Vectors (IVs), making it susceptible to re

Broadcast events allow malicious software to rewrite the device's default Mobile Device Management (MDM) endpoint addres

High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric enc

The system Binder boundary accepts unverified pass-through AT commands, giving local applications the power to read base

There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR.  An attacker may obtain admini

Incoming VPN network profile settings fail to process special characters safely, enabling command injection via maliciou

System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identifi

Leftover debug modules contain fixed credentials for internal AWS Cognito test sandboxes, risking asset exploitation.

Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote prof

Internal multimedia session archives are accessible without authentication, exacerbated by loose Cross-Origin Resource S