2026

facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , a reflected XSS occurs wh

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to 2.1.1, a stored XSS can be i

Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their ni

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members

WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns al

PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync stre

SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoin

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulne

If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low pr

Kubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to deploy name

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, th

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to befo

InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF token

Multiple i-フィルター products are configured with improper file access permission settings. Files may be created or overwrit

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular us

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user p

Due to missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal, a user with high privileges cou

Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform un

SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content

SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacke

SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated

SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP reques

SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks f

The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational d

Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute

Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute

The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthoriz

The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthoriz

The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which coul

The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.

Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could

Affected Product(s)Version(s)InfoSphere Data Architect9.2.1

IBM Planning Analytics Advanced Certified Containers 3.1.0 through 3.1.4 could allow a local privileged user to obtain s

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Seri

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restric

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink t

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

SiYuan is a personal knowledge management system. Prior to 3.5.10, a privilege escalation vulnerability exists in the pu

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-1