2026

Shopware is an open commerce platform. /api/_info/config route exposes information about active security fixes. This vul

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Li

Unhead is a document head and template manager. Prior to 2.1.11, The link.href check in makeTagSafe (safe.ts) uses Strin

Unhead is a document head and template manager. Prior to 2.1.11, useHeadSafe() can be bypassed to inject arbitrary HTML

A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge coul

A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attack

A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticate

A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could a

A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge co

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a SQL injection vulnerability via the add_group() function. This v

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade func

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi

A flaw has been found in projectsend up to r1945. This impacts an unknown function of the file includes/Classes/Auth.php

Hyperterse is a tool-first MCP framework for building AI-ready backend surfaces from declarative config. Prior to v2.2.0

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI dev server configures Vite with server.fs.

Tina is a headless content management system. Prior to 2.1.8, the TinaCMS CLI development server exposes media endpoints

Tina is a headless content management system. Prior to 2.1.8 , the TinaCMS CLI dev server combines a permissive CORS con

Tina is a headless content management system. Prior to 2.1.7, a path traversal vulnerability exists in the TinaCMS devel

multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header

llama.cpp is an inference of several LLM models in C/C++. Prior to b8146, the gguf_init_from_file_impl() in gguf.cpp is

Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed un

Tina is a headless content management system. Prior to 2.1.2, TinaCMS allows users to create, update, and delete content

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 6.8.16, th

A vulnerability allowing a Backup Viewer to perform remote code execution (RCE) as the postgres user.

A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.

A vulnerability was detected in projectsend up to r1945. This affects the function realpath of the file /import-orphans.

A security vulnerability has been detected in Tenda i12 1.0.0.6(2204). The impacted element is the function formwrlSSIDg

Netartmedia Real Estate Portal 5.0 contains an SQL injection vulnerability that allows unauthenticated attackers to mani

Netartmedia Real Estate Portal 5.0 contains a SQL injection vulnerability that allows unauthenticated attackers to manip

Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipul

Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipul

202CMS v10 beta contains a blind SQL injection vulnerability that allows unauthenticated attackers to manipulate databas

202CMS v10 beta contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database que

Netartmedia Event Portal 2.0 contains a time-based blind SQL injection vulnerability that allows unauthenticated attacke

Netartmedia PHP Real Estate Agency 4.0 contains an SQL injection vulnerability that allows unauthenticated attackers to

Netartmedia PHP Dating Site contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate d

Netartmedia PHP Car Dealer contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbi

Netartmedia PHP Business Directory 4.2 contains an SQL injection vulnerability that allows unauthenticated attackers to

Netartmedia Jobs Portal 6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate

Netartmedia Deals Portal contains an SQL injection vulnerability in the Email parameter of loginaction.php that allows u

uHotelBooking System contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate databas

Placeto CMS Alpha rv.4 contains an SQL injection vulnerability that allows authenticated attackers to manipulate databas

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to m

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to m

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to m

Inout EasyRooms Ultimate Edition v1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to m

XooGallery Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database q

XooGallery Latest contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database q