2026

A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to co

A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encrypt

A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthenticated, remote attac

A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to exe

There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows a

Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenti

Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticate

Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privi

Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administra

Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier all

Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an

Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote att

Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. Th

OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file

TOTOlink A3600R v5.9c.4959 contains a buffer overflow vulnerability in the setAppEasyWizardConfig interface of /lib/cste

The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumer

The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumer

A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Dat

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0. The vulnerability is loc

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerabil

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to the lack of proper input vali

An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite

An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwr

Multiple stored cross-site scripting (XSS) vulnerabilities in the submit_add_user.asp endpoint of DDSN Interactive Acora

The King Addons for Elementor plugin for WordPress is vulnerable to multiple Contributor+ DOM-Based Stored Cross-Site Sc

pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current

A reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality of the VertiGIS FM solution a

A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can expl

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a re

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Co

OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that al

ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that al

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validati

An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrit

An arbitrary file overwrite vulnerability in Deep Thought Industries ACE Scanner PDF Scanner v1.4.5 allows attackers to

A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated att

MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote at

Dell AppSync, version(s) 4.6.0, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low

Dell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged att

A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik. The application contai

Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5

Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in

An improper access check allows unauthorized access to webservice endpoints.

Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism.

Lack of output escaping for article titles leads to XSS vectors in various locations.

Lack of output escaping leads to a XSS vector in the multilingual associations component.

Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.

The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was pote

A vulnerability was detected in Harvard University IQSS Dataverse up to 6.8. This affects an unknown function of the fil