2026

Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains a PHP object injection vulnerability in the billing mo

An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The a

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.ph

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parse

Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-sta

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates per

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powe

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated use

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization de

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1,

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1,

Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1,

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs

Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker

Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avati

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file

NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expres

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy

NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controll

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can i

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause SQL injection. A succe

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an improper authentic

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate v

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause missing authentication

NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a

NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious dat

NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause re

A flaw has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. This issue affects the function move_u

A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in

A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function check_a

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerabi

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems HashBar –

Privilege escalation due to weak configuration while temporary file handling.

Privilege escalation due to weak configuration during package extraction process.

Exposed dangerous function lead to privilege escalation via gRPC server.

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inc

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured

Authentication Bypass Using an Alternate Path or Channel vulnerability in Magepeople inc. Taxi Booking Manager for WooCo

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qty'

The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (import

The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in a

The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an

Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in

Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label

Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long