2026

Moeditor 0.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payload

Marky 0.0.1 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts i

Markright 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to embed malicious payloads

Markdownify 1.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payl

Markdown Explorer 0.1.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious code thr

Freeter 1.2.1 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads

Schlix CMS 2.2.6-6 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject ma

WifiHotSpot 1.0.0.0 contains an unquoted service path vulnerability in its WifiHotSpotService.exe that allows local atta

Sandboxie 5.49.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowin

DHCP Broadband 4.1.0.1503 contains an unquoted service path vulnerability in its service configuration that allows local

BOOTP Turbo 2.0.0.1253 contains an unquoted service path vulnerability in its Windows service configuration. Attackers c

WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash t

Acer Backup Manager 3.0.0.99 contains an unquoted service path vulnerability in the NTI IScheduleSvc service that allows

Acer Updater Service 1.2.3500.0 contains an unquoted service path vulnerability that allows local users to execute code

iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowin

Acer ePowerSvc 6.0.3008.0 contains an unquoted service path vulnerability that allows local users to potentially execute

DiskBoss Service 12.2.18 contains an unquoted service path vulnerability in its binary path configuration that allows lo

RarmaRadio 2.72.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowi

Ubee EVW327 contains a cross-site request forgery vulnerability that allows attackers to enable remote access without us

DupTerminator 1.4.5639.37199 contains a denial of service vulnerability that allows attackers to crash the application b

Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers

Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models all

mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01

In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user

A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able

In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web

A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as a

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app

This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1

This issue was addressed with improved permissions checking. This issue is fixed in macOS Sequoia 15.1. An app may be ab

Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery. Prior to

Dask distributed is a distributed task scheduler for Dask. Prior to 2026.1.0, when Jupyter Lab, jupyter-server-proxy, an

Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. Prior to 0.13.0

RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signat

PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with acc

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_4C408 function. T

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime functi

Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU

User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by

Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss com

Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component

SteelSeries Nahimic 3 1.10.7 allows Directory traversal.

In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some

In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered wit

Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arb

TheLibrarians web_fetch tool can be used to retrieve the Adminer interface content, which can then be used to log into t