2026

An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora.

A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploi

This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe

A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allo

A vulnerability was detected in Tenda A18 Pro 02.03.02.28. This vulnerability affects the function form_fast_setting_wif

A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected is the function strcpy of the fil

Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authent

Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject

The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vuln

Bitcoin Core 0.13.0 through 29.x has an integer overflow.

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer

A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /gof

Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, t

Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unau

OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that al

Bitcoin Core through 29.0 allows a denial of service via a crafted transaction.

A vulnerability was found in D-Link DIR-513 1.10. This affects the function formEasySetPassword of the file /goform/form

A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown functio

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery (CSRF) vulnerability e

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists i

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability e

Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a F

Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Clas

The error_description parameter is vulnerable to Reflected XSS. An attacker can bypass the domain's WAF using a Safari-s

An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callb

SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd.

Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-

WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS)

WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS)

WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vuln

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL

ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users t

H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in t

Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea

Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea

Greenshot is an open source Windows screenshot utility. Versions 1.3.312 and below have untrusted executable search path

Uptime Kuma is an open source, self-hosted monitoring tool. In versions 1.23.0 through 2.2.0, the fix from GHSA-vffh-c9p

H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability i

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream i

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. In versions 0.16.2 and be

Frigate is a network video recorder (NVR) with realtime local object detection for IP cameras. Versions prior to 0.17.0-

pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Deserialization of Untrusted Data vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Object Injectio

Cross-Site request forgery (CSRF) vulnerability in joshuae1974 Flash Video Player allows Cross Site Request Forgery.This

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Vasilis Triantafyl

The RockPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.17.

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.

Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.8.4 and