2026

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution

Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publis

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and includin

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Li

TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In `tls_listener.rs`,

TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.1

A vulnerability was detected in D-Link DWR-M961 1.1.47. The impacted element is the function sub_4250E0 of the file /boa

A security vulnerability has been detected in D-Link DWR-M961 1.1.47. The affected element is an unknown function of the

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin

Tanium addressed an improper access controls vulnerability in Interact.

alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in t

Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authent

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prio

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the passw

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to in

A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactica

A stack overflow in the mk_http_index_lookup function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to

An out-of-bounds read in the mk_mimetype_find function (mk_server/mk_mimetype.c) of monkey commit f37e984 allows attacke

An out-of-bounds read in the header_cmp function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows attackers

A NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984 allows att

An out-of-bounds read in the mk_vhost_fdt_close function (mk_server/mk_vhost.c) of monkey commit f37e984 allows attacker

A use-after-free in the mk_http_request_end function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to

A use-after-free in the mk_string_char_search function (mk_core/mk_string.c) of monkey commit f37e984 allows attackers t

An out-of-bounds read in the mk_ptr_to_buf in mk_core function (mk_memory.c) of monkey commit f37e984 allows attackers t

An out-of-bounds read in the http_parser_transfer_encoding_chunked function (mk_server/mk_http_parser.c) of monkey commi

birkir prime <= 0.4.0.beta.0 contains a cross-site request forgery vulnerability in its GraphQL endpoint that allows att

FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload S

A vulnerability was found in Tenda AX12 Pro V2 16.03.49.24_cn. Affected by this issue is some unknown functionality of t

A weakness has been identified in Totolink A7000R 4.1cu.4154. The impacted element is the function setUploadUserData of

An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corru

A missing authentication for critical function vulnerability in KiloView Encoder Series could allow an unauthenticated a

Cross Site Scripting vulnerability in tale v.2.0.5 allows an attacker to execute arbitrary code.

Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application

Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem co

Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with

Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic

A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut

The Icinga PowerShell Framework provides configuration and check possibilities to ensure integration and monitoring of W

Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) th

immich is a high performance self-hosted photo and video management solution. Prior to version 2.5.0, API keys can escal

A vulnerability was identified in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The impacted ele

A vulnerability was determined in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. The affected ele

A vulnerability was found in Bdtask Bhojon All-In-One Restaurant Management System up to 20260116. Impacted is an unknow

A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid f