2026

The Synectix LAN 232 TRIO 3-Port serial to ethernet adapter exposes its web management interface without requiring authe

A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denia

A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may

A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject c

A vulnerability has been found in bolo-blog bolo-solo up to 2.6.4. This impacts the function importFromCnblogs of the fi

The Menu Icons by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘_wp_attachment_im

MOMA Seismic Station Version v2.4.2520 and prior exposes its web management interface without requiring authentication,

A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation

IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and

IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 th

IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user

Easy Transfer Wifi Transfer v1.7 for iOS contains a persistent cross-site scripting vulnerability that allows remote att

School ERP Pro 1.0 contains a remote code execution vulnerability that allows authenticated admin users to upload arbitr

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorizati

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.3, a denial-of-service vulnerability

Fastify is a fast and low overhead web framework, for Node.js. Prior to version 5.7.2, a validation bypass vulnerability

Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isC

Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inc

Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists

Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City

Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwi

A flaw has been found in bolo-blog bolo-solo up to 2.6.4. This affects the function importFromMarkdown of the file src/m

Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control.

Edimax EW-7438RPn 1.13 contains an information disclosure vulnerability that exposes WiFi network configuration details

Edimax EW-7438RPn 1.13 contains a cross-site request forgery vulnerability in the MAC filtering configuration interface.

EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to

Netis E1+ 1.2.32533 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve W

Netis E1+ version 1.2.32533 contains a hardcoded root account vulnerability that allows unauthenticated attackers to acc

Maian Support Helpdesk 4.3 contains a cross-site request forgery vulnerability that allows attackers to create administr

School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messag

School ERP Pro 1.0 contains a SQL injection vulnerability in the 'es_messagesid' parameter that allows attackers to mani

School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary file

Easy Transfer 1.7 iOS mobile application contains a directory traversal vulnerability that allows remote attackers to ac

VirtualTablet Server 3.0.2 contains a denial of service vulnerability that allows attackers to crash the service by send

PHP AddressBook 9.0.0.1 contains a time-based blind SQL injection vulnerability that allows remote attackers to manipula

webERP 4.15.1 contains an unauthenticated file access vulnerability that allows remote attackers to download database ba

Fishing Reservation System 7.5 contains multiple remote SQL injection vulnerabilities in admin.php, cart.php, and calend

webTareas 2.0.p8 contains a file deletion vulnerability in the print_layout.php administration component that allows aut

i-doit Open Source CMDB 1.14.1 contains a file deletion vulnerability in the import module that allows authenticated att

Booked Scheduler 2.7.7 contains a directory traversal vulnerability in the manage_email_templates.php script that allows

Victor CMS version 1.0 contains a SQL injection vulnerability in the 'post' parameter on post.php that allows remote att

LanSend 3.2 contains a buffer overflow vulnerability in the Add Computers Wizard file import functionality that allows r

Remote Desktop Audit 2.3.0.157 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code

Victor CMS 1.0 contains an authenticated file upload vulnerability that allows administrators to upload PHP files with a

Victor CMS 1.0 contains a stored cross-site scripting vulnerability in the 'comment_author' POST parameter that allows a

CraftCMS 3 vCard Plugin 1.0.0 contains a deserialization vulnerability that allows unauthenticated attackers to execute

CloudMe 1.11.2 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code through c

Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the NLST command that allows attackers to ove

Konica Minolta FTP Utility 1.0 contains a buffer overflow vulnerability in the LIST command that allows attackers to ove