2026

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TP-Link Deco BE25 v1.0 (

Improper input handling in the administration web interface on TP-Link Deco BE25 v1.0 allows crafted input to be execute

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, rich text cell content rendered via

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Creator

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, user-controlled content in comments

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, comments rendered via v-html withou

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password reset flow did not rev

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not valid

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, shared view passwords were stored i

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, an authenticated user with Editor r

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the password forgot endpoint return

NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, a stored XSS vulnerability exists i

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, t

sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php.

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php.

An issue was discovered in goform/formsetUsbUnload in Tenda AC15V1.0 V15.03.05.18_multi. The value of `v1` was not check

An integer overflow in the tt_var_load_item_variation_store function of the Freetype library in versions 2.13.2 and 2.13

Memory corruption while using alignments for memory allocation.

An issue was discovered in /goform/WifiWpsStart in Tenda AC6V2.0 V15.03.06.23_multi. The index and mode are controllable

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.0 and prio

Memory Corruption when processing invalid user address with nonstandard buffer address.

Memory Corruption when adding user-supplied data without checking available buffer space.

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.

Memory Corruption when accessing trusted execution environment without proper privilege check.

Transient DOS when MAC configures config id greater than supported maximum value.

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.

Memory Corruption when concurrent access to shared buffer occurs due to improper synchronization between assignment and

Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.

Memory corruption while handling different IOCTL calls from the user-space simultaneously.

Memory Corruption when accessing buffers with invalid length during TA invocation.

Transient DOS when an LTE RLC packet with invalid TB is received by UE.

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server imposes no limi

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server (`ws://127.0.0.

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts mod

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may exploit the vulnerability by specifying the value

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` wi

In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an

Cross Site Scripting vulnerability in Wethink Technology Inc 720yun pano-sdk 0.5.877 allows a remote attacker to execute

Chamilo is a learning management system. Prior to version 1.11.30, in the application, deserialization of data is perfor

Chamilo is a learning management system. Prior to version 1.11.30, the open parameter of help.php fails to properly sani

Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulne

Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulne

Chamilo is a learning management system. Prior to version 1.11.30, there is a reflected cross-site scripting (XSS) vulne