2026

Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with rendere

An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauth

An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication

BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authe

MyBB Delete Account Plugin 1.4 contains a cross-site scripting vulnerability in the account deletion reason input field.

PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execut

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app con

YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read l

Epson USB Display 1.6.0.0 contains an unquoted service path vulnerability in the EMP_UDSA service running with LocalSyst

PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the address parameter of the change_params.p

PDF Complete Corporate Edition 4.1.45 contains an unquoted service path vulnerability in the pdfcDispatcher service that

Nsauditor 3.2.2.0 contains a denial of service vulnerability that allows attackers to crash the application by overwriti

Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the ap

AgataSoft PingMaster Pro 2.1 contains a denial of service vulnerability in the Trace Route feature that allows attackers

PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the 'Comments / Special Instructions' parame

Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network p

LogonExpert 8.1 contains an unquoted service path vulnerability in the LogonExpertSvc service running with LocalSystem p

Softros LAN Messenger 9.6.4 contains an unquoted service path vulnerability in the SoftrosSpellChecker service that allo

Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in u

dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to over

MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious

MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for threa

In the Linux kernel, the following vulnerability has been resolved: ublk: fix use-after-free in ublk_partition_scan_wor

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_

In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL ptr issue after soft reset

In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from mon_handle_a

In the Linux kernel, the following vulnerability has been resolved: libceph: make free_choose_arg_map() resilient to pa

In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply

In the Linux kernel, the following vulnerability has been resolved: nfsd: check that server is running in unlock_filesy

In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not chang

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: avoid dereferencing ERR_PTR in

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix race condition for gdev->srcu If two

In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethto

In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in h

In the Linux kernel, the following vulnerability has been resolved: net: do not write to msg_get_inq in callee NULL po

In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: Fix crash when adding interface

In the Linux kernel, the following vulnerability has been resolved: idpf: detach and close netdevs while handling a res

In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to

In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO pa

In the Linux kernel, the following vulnerability has been resolved: wifi: avoid kernel-infoleak from struct iw_point s

In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correcti

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid chain re-validation if

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free warning in btrfs_get_or_c

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: ensure worker is torn down When an IR

An unauthenticated information disclosure vulnerability in Newgen OmniApp allows attackers to enumerate valid privileged

A signed integer overflow in docopt.cpp v0.6.2 (LeafPattern::match in docopt_private.h) when merging occurrence counters

A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an atta

Null pointer dereference in free5gc pcf 1.4.0 in file internal/sbi/processor/ampolicy.go in function HandleDeletePolicie

An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck

Missing Authorization vulnerability in Syed Balkhi Sugar Calendar (Lite) sugar-calendar-lite allows Exploiting Incorrect