2026

GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title p

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the s

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editi

A vulnerability was found in ericc-ch copilot-api up to 0.7.0. The impacted element is the function cors of the file src

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fft

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions

Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a

Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbit

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2,

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of Special Elements used i

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation vulnerability. A high privi

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command injection vulnerability. A high privileged att

A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to

A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/mod

A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of

A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zb_users/plugin/Ap

ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automa

Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in `LocalFold

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas`

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP f

Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parame

Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media u

Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/edit

Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Ve

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Ve

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campa

OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campa

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5,

A vulnerability was determined in Qibo CMS 1.0. Affected by this issue is some unknown functionality of the file /index/

An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local

SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious to

OS Command Injection Remote Code Execution Vulnerability in UI in Progress ADC Products allows an authenticated attacker

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacke

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacke

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacke

Information exposure vulnerability has been identified in Apache Kafka. The NetworkClient component will output entire

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbeare

Apache Doris MCP Server versions earlier than 0.6.1 are affected by an improper neutralization flaw in query context han

A vulnerability was found in Qibo CMS 1.0. Affected by this vulnerability is an unknown functionality of the component I