2026

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered u

Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other wa

fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that al

Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that all

AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the

Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated empl

Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modif

Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employ

tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to bl

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefix

Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers

Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's us

Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth()

WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authen

WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated a

99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to r

99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allow

Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated member

LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attac

yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users

ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attacker

OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to

WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL thro

Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impe

HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRechar

HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeControlle

data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServic

Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows

qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to acce

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated a

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers

WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any t

Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user r

Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role

WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL

IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL

Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to v

Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to

EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to

EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manag

APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to acc

Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin

Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c beca

Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted

Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tic

Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows

Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other

IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, de