2026

A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allo

A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2. The troubleshooting actioner compo

A security vulnerability has been detected in kalcaddle kodbox 1.64. This impacts the function loginAfter/tfaVerify of t

A weakness has been identified in kalcaddle kodbox 1.64. This affects the function checkBin of the file /workspace/sourc

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/import.json.php` endpoi

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `createKeys()` function in the L

cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating

A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Recor

A stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Man

Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Recor

A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Manag

A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Manag

A security flaw has been discovered in kalcaddle kodbox 1.64. The impacted element is an unknown function of the file /w

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `p

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` en

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` functi

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AV

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Gallery plugin's `saveSort.json.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.ph

A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files

A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file

Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1'

WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exis

WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability

WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the Customiz

SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete d

Blob Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by prov

Liquid Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by pr

Luminance Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by

Paint Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by pro

Pixel Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by pro

Tree Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by prov

A vulnerability was determined in kalcaddle kodbox 1.64. Impacted is the function shareSafeGroup of the file /workspace/

A vulnerability was found in HybridAuth up to 3.12.2. This issue affects some unknown processing of the file src/HttpCli

A vulnerability was found in CodePhiliaX Chat2DB up to 0.3.7. This affects the function Upload of the file chat2db-serve

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mec

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 stores sensitive information, including administrative

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement CSRF protections on state-changing e

Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which conta

Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.0

Use of hard-coded credentials in Klinika XP and KlinikaXP Insertino allowed an unauthorized attacker access to several i

SQL Injection in Cuantis. This vulnerability allows an attacker to retrieve, create, update and delete databases through

A vulnerability has been found in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This vulnerability affects u

A flaw has been found in Shenzhen HCC Technology MPOS M6 PLUS 1V.31-N. This affects an unknown part of the component Car

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s a

Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exp

Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 a