2026

The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficien

The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insuffi

The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insuffici

An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full a

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go

SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivilege

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Ful

It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some

Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affe

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Ma

Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. T

Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24

Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gatew

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague

Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization reque

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to l

ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Manag

A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/datafram

A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the func

A security vulnerability has been detected in EIPStackGroup OpENer up to 2.3.0. Affected is the function CreateMessageRo

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref i

A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function i

A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulner

The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross-Site Request Forger

The Passeum Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and inclu

A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_patte

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function o

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a sha

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users

When returning errors, functions in the net/textproto package would include its input as part of the error. This might a

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to versio

GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XS

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to versio

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the M

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an In

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN

QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attack

Out of bounds write in openSeaChest’s --showSupportedFormats in Seagate’s openSeaChest v25.05.3 on all supported platfor

Out of bounds write in openSeaChest’s Trim/Unmap operation in Seagate’s openSeaChest v26.03.0 on all supported platforms

Out of bounds write and reads in openSeaChest’s --showSCSIDefects in Seagate’s openSeaChest v25.05.3 on all supported pl

A vulnerability was determined in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The impacted elem

A vulnerability was found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The affected element i

Fixed a VM panic caused by unbounded recursion in the grpcfuse kernel module when a container created deeply nested dire

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Versions prior to 7

A vulnerability has been found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. Impacted is the f