2026

The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sani

The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration

PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-

A security flaw has been discovered in SourceCodester Car Driving School Management System 1.0. Impacted is an unknown f

A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthent

A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. The affected element is an

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stor

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementati

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementat

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API w

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementati

Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remot

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a ma

Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malici

Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote att

A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function

A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown

A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment f

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE serv

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authe

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authe

An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has comp

An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated at

A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthentic

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privil

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthent

A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authe

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (saml

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex d

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_tra

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic.

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores por

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget i

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processin

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply() function in net/nfs-common.c that allows attack

U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an out-of-bounds write vulnerability in the __net_defra

The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. T

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowin

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash a

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to

In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connectio

A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everythin

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with h

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authe

An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated r