2026

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-stock.php file

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0 in the view

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Sales and Inventory System 1.0. The vulner

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more

A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where

A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block ter

Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search pa

Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-i

In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not p

A vulnerability was found in OpenBMB XAgent 1.0.0. This impacts the function check_user of the file XAgentServer/applica

A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.s

Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed

Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-i

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in admin/manage_category.php via

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/manage_product.php

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the admin/view_product.php fi

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifi

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifi

A SQL Injection vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Actions.php file (specifi

A Stored Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Categ

The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whiteli

Wazuh authd contains a heap-buffer overflow vulnerability that allows attackers to cause memory corruption and malformed

The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an a

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint serves SVG files with the 'image/svg+xml' content type without

The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log

The '/api/v1/files/images/{flow_id}/{file_name}' endpoint does not enforce any authentication or authorization checks, a

A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attac

The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'. When

A local file disclosure vulnerability in the XInclude processing component of Inkscape 1.1 before 1.3 allows a remote at

A flaw has been found in OpenBMB XAgent 1.0.0. The impacted element is the function FunctionHandler.handle_tool_call of

A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. The affected element is an unknown f

A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. This impacts an unknown function of the

A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/m

A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs aga

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the AI plugin's `save.json.php` endp

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_corre

WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in t

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.ph

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that h

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, a

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5,

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. P

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField

GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaL

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.