2026

SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details controller that a

Nidesoft 3GP Video Converter 2.6.18 contains a local stack buffer overflow vulnerability in the license registration par

PMB 5.6 contains a local file disclosure vulnerability in getgif.php that allows attackers to read arbitrary system file

M/Monit 3.7.4 contains a privilege escalation vulnerability that allows authenticated users to modify user permissions b

M/Monit 3.7.4 contains an authentication vulnerability that allows authenticated attackers to retrieve user password has

Zortam Mp3 Media Studio 27.60 contains a buffer overflow vulnerability in the library creation file selection process th

docPrint Pro 8.0 contains a local buffer overflow vulnerability in the 'Add URL' input field that allows attackers to ex

YATinyWinFTP contains a denial of service vulnerability that allows attackers to crash the FTP service by sending a 272-

Intelbras Router RF 301K firmware version 1.1.2 contains an authentication bypass vulnerability that allows unauthentica

Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers t

10-Strike Network Inventory Explorer 8.65 contains a buffer overflow vulnerability in exception handling that allows rem

WebDamn User Registration Login System contains a SQL injection vulnerability that allows unauthenticated attackers to b

ILIAS Learning Management System 4.3 contains a server-side request forgery vulnerability that allows attackers to read

aSc TimeTables 2021.6.2 contains a denial of service vulnerability that allows attackers to crash the application by ove

OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitr

EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components o

A weakness has been identified in Open5GS up to 2.7.6. This vulnerability affects the function sgwc_s5c_handle_modify_be

A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.s

A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (D

A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service

A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Deni

A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying craft

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hija

Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevatio

WSS Agent, prior to 9.8.5, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereb

In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the pr

A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended de

A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (C

A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote atta

An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject ar

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution.

Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile

In the Linux kernel, the following vulnerability has been resolved: perf: Ensure swevent hrtimer is properly destroyed

A security flaw has been discovered in Open5GS up to 2.7.6. This affects the function sgwc_s5c_handle_bearer_resource_fa

A vulnerability was identified in rethinkdb up to 2.4.3. Affected by this issue is some unknown functionality of the com

Vulnerable cross-model authorization in juju. If a charm's cross-model permissions are revoked or expire, a malicious us

The WP Adminify plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin

The Stop Spammers Classic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in

The Snow Monkey Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path valida

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administr

Nord VPN 6.31.13.0 contains an unquoted service path vulnerability in its nordvpn-service that allows local attackers to

ShareMouse 5.0.43 contains an unquoted service path vulnerability that allows local users to potentially execute arbitra

Input Director 1.4.3 contains an unquoted service path vulnerability in its Windows service configuration that allows lo

ForensiT AppX Management Service 2.2.0.4 contains an unquoted service path vulnerability that allows local users to pote

PDW File Browser version 1.3 contains stored and reflected cross-site scripting vulnerabilities that allow authenticated

Program Access Controller 1.2.0.0 contains an unquoted service path vulnerability in PACService.exe that allows local at

Prey 1.9.6 contains an unquoted service path vulnerability that allows local users to potentially execute code with elev

IP Watcher 3.0.0.30 contains an unquoted service path vulnerability in its Windows service configuration that allows loc