2026

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Li

A reachable infinite loop via an integer wraparound is present in Silicon Labs' Matter SDK which allows an attacker to t

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.6.8, there is a potential vulnerability in Traefik managi

Arduino App Lab is a cross-platform IDE for developing Arduino Apps. Prior to 0.4.0, a vulnerability was identified in t

authentik is an open-source identity provider. Prior to 2025.8.6, 2025.10.4, and 2025.12.4, when using a SAML Source tha

LavinMQ is a high-performance message queue & streaming server. Before 2.6.6, an authenticated user could access metadat

LavinMQ is a high-performance message queue & streaming server. Before 2.6.8, an authenticated user, with the “Policymak

authentik is an open-source identity provider. Prior to 2025.10.4 and 2025.12.4, with a malformed cookie it was possible

authentik is an open-source identity provider. From 2021.3.1 to before 2025.8.6, 2025.10.4, and 2025.12.4, when using de

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, FrankenPHP’s CGI path splitting logic improperly han

FrankenPHP is a modern application server for PHP. Prior to 1.11.2, when running FrankenPHP in worker mode, the $_SESSIO

Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kuberne

webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable

A heap buffer overflow in the processRequest function of Open TFTP Server MultiThreaded v1.7 allows attackers to cause a

A stack overflow in the ZBarcode_Encode function of Monkeybread Software MBS DynaPDF Plugin v21.3.1.1 allows attackers t

thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating

TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the

Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to p

Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executa

NextVPN 4.10 contains an insecure file permissions vulnerability that allows local users to modify executable files with

newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not inco

newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisi

mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vul

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.10.0, an attacker can cause unbounded memo

webtransport-go is an implementation of the WebTransport protocol. Prior to v0.10.0, an attacker can cause a denial of s

webtransport-go is an implementation of the WebTransport protocol. From 0.3.0 to 0.9.0, an attacker can cause excessive

CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds p

p2r3 Bareiron commit: 8e4d4020d is vulnerable to Buffer Overflow, which allows unauthenticated remote attackers to cause

p2r3 bareiron commit: 8e4d4020d contains an Out-of-bounds Read, which allows unauthenticated remote attackers to get rel

An issue in filosoft Comerc.32 Commercial Invoicing v.16.0.0.3 allows a local attacker to execute arbitrary code via the

A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resul

Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and

Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously cr

Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Gl

Improper input validation within RAS TA Driver can allow a local attacker to access out-of-bounds memory, potentially re

In Infoblox NIOS through 9.0.7, insecure deserialization can result in remote code execution.

In Infoblox NIOS through 9.0.7, a High-Privileged User Can Trigger an Arbitrary File Write via the Account Creation Mech

FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to 17.0.5 and 16.0.17, F

BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default passwo

Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment. The /execute

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl

Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HT

An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the

An issue in the "My Details" user profile functionality of Ideagen Q-Pulse 7.1.0.32 allows an authenticated user to view

Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges

npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server d

The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creatio

Unrestricted Upload of File with Dangerous Type vulnerability in NTN Information Processing Services Computer Software H

An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to sen

Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string.