2026

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attack

An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker

Net::CIDR versions before 0.24 for Perl mishandle leading zeros in IP CIDR addresses, which may have unspecified impact.

A vulnerability was determined in Tenda F453 1.0.0.3. Affected is the function fromDhcpListClient of the file /goform/Dh

A vulnerability was found in Tenda F453 1.0.0.3. This impacts the function fromP2pListFilter of the file /goform/P2pList

A vulnerability has been found in psi-probe PSI Probe up to 5.3.0. This affects the function lookup of the file psi-prob

A flaw has been found in psi-probe PSI Probe up to 5.3.0. The impacted element is the function handleRequestInternal of

Crypt::SysRandom::XS versions before 0.010 for Perl is vulnerable to a heap buffer overflow in the XS function random_by

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersona

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersona

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absen

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersona

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absen

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absen

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersona

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absen

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersona

Charging station authentication identifiers are publicly accessible via web-based mapping platforms.

An unquoted Windows service executable path vulnerability in IJ Scan Utility for Windows versions 1.1.2 through 1.5.0 ma

Apache::SessionX versions through 2.01 for Perl create insecure session id. Apache::SessionX generates session ids inse

A vulnerability was detected in psi-probe PSI Probe up to 5.3.0. The affected element is an unknown function of the file

A vulnerability was identified in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. This affects an unk

A vulnerability was determined in go2ismail Free-CRM up to b83c40a90726d5e58f0cc680ffdcaa28a03fb5d1. Affected by this is

osctrl is an osquery management solution. Prior to version 0.5.0, a stored cross-site scripting (XSS) vulnerability exis

osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the `o

Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions p

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate p

Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to S

Kiteworks is a private data network (PDN). Prior to version 9.2.0, avulnerability in Kiteworks command execution functio

SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger se

Phishing Club is a phishing simulation and man-in-the-middle framework. Prior to version 1.30.2, an authenticated SQL in

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query ac

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify o

hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overw

EverShop is a TypeScript-first eCommerce platform. Versions prior to 2.1.1 have a vulnerability in the "Forgot Password"

The NVDA Dev & Test Toolbox is an NVDA add-on for gathering tools to help NVDA development and testing. A vulnerability

Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `

Zen C is a systems programming language that compiles to human-readable GNU C/C11. Prior to version 0.4.2, a command inj

wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values`

wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calli