2026

BlueKitchen BTstack versions prior to 1.8.1 contain an out-of-bounds read vulnerability in the AVRCP Controller LIST_PLA

A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to t

An Insecure Deserialization vulnerability in WatchGuard Fireware OS allows an attacker that has obtained write access to

Device Monitoring Studio 8.10.00.8925 contains a denial of service vulnerability that allows local attackers to crash th

Core FTP/SFTP Server 1.2 contains a buffer overflow vulnerability that allows attackers to crash the service by supplyin

Navicat for Oracle 12.1.15 contains a denial of service vulnerability that allows local attackers to crash the applicati

NetworkActiv Web Server 4.0 contains a buffer overflow vulnerability in the username field of the Security options that

SmartFTP Client 9.0.2615.0 contains a denial of service vulnerability that allows local attackers to crash the applicati

WebDrive 18.00.5057 contains a denial of service vulnerability that allows local attackers to crash the application by s

Softros LAN Messenger 9.2 contains a denial of service vulnerability that allows local attackers to crash the applicatio

HeidiSQL 9.5.0.5196 contains a denial of service vulnerability that allows local attackers to crash the application by s

Free IP Switcher 3.1 contains a buffer overflow vulnerability that allows local attackers to crash the application by su

BulletProof FTP Server 2019.0.0.50 contains a denial of service vulnerability in the SMTP configuration interface that a

NetSetMan 4.7.1 contains a buffer overflow vulnerability in the Workgroup feature that allows local attackers to crash t

Valentina Studio 9.0.4 contains a denial of service vulnerability that allows local attackers to crash the application b

FTPShell Server 6.83 contains a buffer overflow vulnerability that allows local attackers to crash the application by su

AL-KO Robolinho Update Software has hard-coded AWS Access and Secret keys that allow anyone to access AL-KO's AWS bucket

A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer

The Performance Library component of Gigabyte Control Center has an Insecure Deserialization vulnerability. Authenticate

Gigabyte Control Center developed by GIGABYTE has an Arbitrary File Write vulnerability. When the pairing feature is ena

An integer overflow vulnerability in the HTTP chunked transfer encoding parser in tinyproxy up to and including version

An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their i

A Privilege Dropping / Lowering Errors/Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in  cosmic-greete

User enumeration in ESET Protect (on-prem) via Response Timing.

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_

A flaw was found in libsoup. When establishing HTTPS tunnels through a configured HTTP proxy, sensitive session cookies

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file

A flaw has been found in code-projects Exam Form Submission 1.0. The impacted element is an unknown function of the file

A vulnerability was detected in Totolink A3300R 17.0.0cu.557_b20221024. The affected element is the function setVpnPassC

A security vulnerability has been detected in Totolink A3300R 17.0.0cu.557_b20221024. Impacted is the function setStatic

A weakness has been identified in Totolink A3300R 17.0.0cu.557_b20221024. This issue affects the function setUPnPCfg of

The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i

A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artif

A security flaw has been discovered in Totolink A3300R 17.0.0cu.557_b20221024. This vulnerability affects the function s

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 1

Hardcoded Password Vulnerability have been found in CENTUM. Affected products contain a hardcoded password for the user

A vulnerability was identified in Totolink A3300R 17.0.0cu.557_b20221024. This affects the function setLanCfg of the fil

Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerabl

Ghidra versions prior to 12.0.3 improperly process annotation directives embedded in automatically extracted binary data

A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or rej

A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in th

A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and proces

In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via s

A flaw has been found in Tenda FH1201 1.2.0.14(408). Affected is the function formWrlExtraSet of the file /goform/WrlExt

A vulnerability was detected in Tenda FH1201 1.2.0.14(408). This impacts the function WrlclientSet of the file /goform/W

A security vulnerability has been detected in Belkin F9K1122 1.00.33. This affects the function formSetSystemSettings of

OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pai

OpenClaw before 2026.3.8 contains a path traversal vulnerability in the skills download installer that validates the too

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability in the gateway agent RPC that allows authentica

OpenClaw before 2026.2.17 creates session transcript JSONL files with overly broad default permissions, allowing local u