2026

PEAR is a framework and distribution system for reusable PHP components. Prior to version 1.33.0, logic bug in the roadm

Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior expose sensitive information in web management responses.

Shenzhen Tenda AC7 firmware version V03.03.03.01_cn and prior contain an improper output encoding vulnerability in the w

A security flaw has been discovered in Ziroom ZHOME A0101 1.0.1.0. This issue affects the function macAddrClone of the f

When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, ev

Heap-based Buffer Overflow vulnerability in Archer AX53 v1.0 and AX12 v1.0 (tdpserver modules) allows adjacent attackers

eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management

SSH Hostkey misconfiguration vulnerability in Archer AX53 and Archer BE3600 (tmpserver modules) allows attackers to obta

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent a

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent a

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent a

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent a

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent a

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent a

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent a

Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent a

HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensiti

HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow

HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to

HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow au

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2,

An authenticated user with high privileges may trigger a denial‑of‑service condition in TP-Link Archer BE230 v1.2 by res

A lack of proper input validation in the HTTP processing path in TP-Link Archer BE230 v1.2 (web modules) may allow a cra

Creativeitem Academy LMS 7.0 contains reflected Cross-Site Scripting (XSS) vulnerabilities via the search parameter to t

Arbitrary File Upload in podinfo thru 6.9.0 allows unauthenticated attackers to upload arbitrary files via crafted POST

Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive app

chetans9 core-php-admin-panel through commit a94a780d6 contains an authentication bypass vulnerability in includes/auth_

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application us

pdfminer.six before 20251230 contains an insecure deserialization vulnerability in the CMap loading mechanism. The libra

JEEWMS 1.0 is vulnerable to SQL Injection. Attackers can inject malicious SQL statements through the id1 and id2 paramet

FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly s

FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks aut

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-code

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled'

A vulnerability exists in Quick Heal Total Security 23.0.0 in the quarantine management component where insufficient val

NetBox is an open-source infrastructure resource modeling and IP address management platform. A reflected cross-site scr

The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following. Attackers can format a USB dri

An Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 (version equal to or