2026

Sellacious eCommerce 4.6 contains a persistent cross-site scripting vulnerability in the Manage Your Addresses module th

Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and p

PHPFusion 9.03.50 contains a persistent cross-site scripting vulnerability in the print.php page that fails to properly

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based li

Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenti

ChurchCRM is an open-source church management system. Versions prior to 6.7.2 have a Stored Cross-Site Scripting (XSS) v

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor

A security vulnerability has been detected in itsourcecode Directory Management System 1.0. The affected element is an u

A weakness has been identified in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. Impacted is an unknown function of the

A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig

After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigb

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer

A vulnerability was identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_40AC74 of the comp

A vulnerability was found in Free5GC SMF up to 4.1.0. Affected by this issue is the function HandleReports of the file /

A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an

A vulnerability has been found in Free5GC SMF up to 4.1.0. Affected by this vulnerability is the function HandlePfcpSess

A flaw has been found in Free5GC SMF up to 4.1.0. Affected is the function HandlePfcpAssociationReleaseRequest of the fi

Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-s

Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access con

An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensit

Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL.

Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can

Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files.

Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file r

Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can

Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input valida

Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Com

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_tar

Dell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command

Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command

Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technolog

Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no

Improper access control in the WCF endpoint in Edgemo (now owned by Danoffice IT) Local Admin Service 1.2.7.23180 on Win

An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote

An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authen

A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Re

An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker ver

A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker

Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telne

Tanium addressed an improper access controls vulnerability in Tanium Server.

A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZ

A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() fun

A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function fromAdvSetMacMtuWan of th

PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`POST /api/

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6

Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated

gradle-completion provides Bash and Zsh completion support for Gradle. A command injection vulnerability was found in gr

tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame