2026

Kofax Capture, now referred to as Tungsten Capture, version 6.0.0.0 (other versions may be affected) exposes a deprecate

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0

Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.

SocialEngine versions 7.8.0 and prior contain a blind server-side request forgery vulnerability in the /core/link/previe

SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoin

An unauthenticated remote attacker is able to exhaust all available TCP connections in the CODESYS EtherNet/IP adapter s

Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless ent

Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC FunnelFormsPro allows Remote

An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS

Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application

In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv()

In the Linux kernel, the following vulnerability has been resolved: ipv4: nexthop: allocate skb dynamically in rtm_get_

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Ta

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Resc

Missing Authorization vulnerability in Navneil Naicker ACF Galerie 4 allows Exploiting Incorrectly Configured Access Con

The LabOne Web Server, backing the LabOne User Interface, contains insufficient input validation in its file access func

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a Authentication Bypass vulnerability,

Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability,

The ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPress is vulnerable to

A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O

A Generation of Error Message Containing Sensitive Information vulnerability in the Materialized View Refresh mechanism

CryptX versions before 0.088 for Perl do not reseed the Crypt::PK PRNG state after forking. The Crypt::PK::RSA, Crypt::

The reCaptcha by WebDesignBy WordPress plugin before 2.0 does not sanitize or escape the Site Key setting before outputt

The HT Mega Addons for Elementor WordPress plugin before 3.0.7 contains an unauthenticated AJAX action returning some P

GROWI provided by GROWI, Inc. is vulnerable to a regular expression denial of service (ReDoS) via a crafted input string

IP Setting Software contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Librar

EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the in

Libgcrypt before 1.12.2 mishandles Dilithium signing. Writes to a static array lack a bounds check but do not use attack

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext

uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6.

Froxlor is open source server administration software. Prior to version 2.3.6, in `Domains.add()`, the `adminid` paramet

Froxlor is open source server administration software. Prior to version 2.3.6, in `EmailSender::add()`, the domain owner

CMS ALAYA provided by KANATA Limited contains an SQL injection vulnerability. Information stored in the database may be

Froxlor is open source server administration software. Prior to version 2.3.6, `DataDump.add()` constructs the export de

Froxlor is open source server administration software. Prior to version 2.3.6, `DomainZones::add()` accepts arbitrary DN

Froxlor is open source server administration software. Prior to version 2.3.6, `PhpHelper::parseArrayToString()` writes

Froxlor is open source server administration software. Prior to version 2.3.6, the Froxlor API endpoint `Customers.updat

The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl_address' post meta

Successful exploitation of the stored cross-site scripting (XSS) vulnerability could allow an attacker to execute arbitr

The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the

The Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-S

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 202

OpenLearn is open-source educational forum software. Prior to commit 844b2a40a69d0c4911580fe501923f0b391313ab, when `saf

Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` ac

Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Versions of @papercl

PySpector is a static analysis security testing (SAST) Framework engineered for modern Python development workflows. The

STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Infor

Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system,

Luanti (formerly Minetest) is an open source voxel game-creation platform. Starting in version 5.0.0 and prior to versio