2026

Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLa

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (Get

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions u

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to an

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standa

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions

The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostna

HDF5 is software for managing data. In 1.14.1-2 and earlier, an attacker who can control an h5 file parsed by HDF5 can t

CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded

SourceCodester Engineers Online Portal v1.0 is vulnerable to SQL Injection in update_password.php via the new_password p

A SQL injection vulnerability was found in the scheduleSubList.php file of itsourcecode Online Student Enrollment System

itsourcecode Online Student Enrollment System v1.0 is vulnerable to SQL Injection in newCourse.php via the 'coursename'

A SQL injection vulnerability was found in the assignInstructorSubjects.php file of itsourcecode Online Student Enrollme

A SQL injection vulnerability was found in the instructorClasses.php file of itsourcecode Online Student Enrollment Syst

Cross Site Scripting vulnerability in Altenar Sportsbook Software Platform (SB2) v.2.0 allows a remote attacker to obtai

PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at l

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated us

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug

owntone-server 2ca10d9 is vulnerable to Buffer Overflow due to lack of recursive checking.

NASM’s disasm() function contains a stack based buffer overflow when formatting disassembly output, allowing an attacker

NASM contains a heap use after free vulnerability in response file (-@) processing where a dangling pointer to freed mem

A heap buffer overflow vulnerability exists in the Netwide Assembler (NASM) due to a lack of bounds checking in the obj_

LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/t

Local privilege escalation due to improper handling of environment variables. The following products are affected: Acron

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zootemplate Cerato

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow a

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated us

This vulnerability exists in the Atom 3x Projector due to improper exposure of the Android Debug Bridge (ADB) service ov

Denial of Service via Out of Memory vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ. A

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_mass_storage: Fix potential integer

FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remot

The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. Th

A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to

A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/icon

A vulnerability was identified in code-projects Vehicle Showroom Management System 1.0. This impacts an unknown function

A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This affects an unknown function

A vulnerability was found in code-projects Vehicle Showroom Management System 1.0. The impacted element is an unknown fu

Livestatus injection in the prediction graph page in Checkmk <2.5.0b4, <2.4.0p26, and <2.3.0p47 allows an authenticated

Livestatus injection in the notification test mode in Checkmk <2.5.0b4 and <2.4.0p26 allows an authenticated user with a

Livestatus injection in the monitoring quicksearch in Checkmk <2.5.0b4 allows an authenticated attacker to inject livest

A vulnerability has been found in code-projects Vehicle Showroom Management System 1.0. The affected element is an unkno

A flaw has been found in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the fi

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected is an unknown function of the file /updatedet

A vulnerability was found in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /chec

A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. This affects an unknown function of the