2026

madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering fu

A flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected b

A vulnerability was detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Aff

A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207c

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-co

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInf

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF ta

libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A spec

The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functiona

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access

The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diag

The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with acce

The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An at

The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. A

The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi cre

A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file cr

A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability

Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access i

The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the

The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portion

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attack

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attack

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attack

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attack

A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOrigina

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the f

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowle

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separ

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value en

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not re

TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is re

TREK is a collaborative travel planner. Prior to 3.3.0, getSharedTripData in server/src/services/shareService.ts returns

Docmost is open-source collaborative wiki and documentation software. From 0.21.0 until 0.95.0, any authenticated worksp

Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a

Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low priv

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN

Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member

Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authent

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image

A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function get_fi

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markd

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlle

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlle

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-ac

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP si

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. F

xhtml-purifier is a Node.js library to take in raw/unknown/untrusted HTML and output cleaned, purified, trusted HTML. Ve