2026

NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side

Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the

A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the abil

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (def

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request ma

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request ma

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `Clien

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling

Multiple Finka programs use hard-coded Firebird database credentials (shared across all instances of this software). A m

Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the sec

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior do not implement rate limiting or accoun

Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side c

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded i

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior lack CSRF protections for state-changing

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior reflect unsanitized user input in the we

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext withi

Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session ide

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain hard-coded administrative creden

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerabilit

FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnera

Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to mod

Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software

A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the fil

A vulnerability was found in Intelbras TIP 635G 1.12.3.5. This vulnerability affects unknown code of the component Ping

WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a

Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualB

WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses P

Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SS

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a p

bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involvi

A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall.

A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.

A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.

Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to impr

TOTOLINK X5000R V9.1.0cu.2415_B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI read

The CPSD CryptoPro Secure Disk application boots a small Linux operating system to perform user authentication before us

Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption a

Uninitialized memory in the Graphics: Text component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Invalid pointer in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and Thunderbird 148

Information disclosure, mitigation bypass in the Settings UI component. This vulnerability was fixed in Firefox 148 and

Race condition in the JavaScript: GC component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 148 and

Spoofing issue in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 148 and Thunder

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.

Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148 and Thunderbird 148.