2026

Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, cu

ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows re

10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServ

Kmaleon 1.1.0.205 contains an authenticated SQL injection vulnerability in the 'tipocomb' parameter of kmaleonW.php that

AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by

AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inje

HTTPDebuggerPro 9.11 contains an unquoted service path vulnerability that allows local attackers to potentially execute

MilleGPG5 5.7.2 contains a local privilege escalation vulnerability that allows authenticated users to modify service ex

MTPutty 1.0.1.21 contains a sensitive information disclosure vulnerability that allows local attackers to view SSH conne

Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attac

Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup res

Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrar

Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settin

phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arb

AWebServer GhostBuilding 18 contains a denial of service vulnerability that allows remote attackers to overwhelm the ser

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML

A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogX

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the wanSpeed parameter of the sub_65B5C function. T

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the cloneType parameter of the sub_65B5C function.

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files int

Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" para

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a pro

Certain error messages returned by the application expose internal system details that should not be visible to end user

The application discloses all used components, versions and license information to unauthenticated actors, giving attack

Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft throu

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through

The AffiliateX – Amazon Affiliate Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to

The Supreme Modules Lite plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and includin

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending du

An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site

An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions thr

Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.

An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without

An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing

An attacker with limited permissions may still be able to write files to specific locations on the device, potentially l

Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead

Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authenticatio

Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover cre

The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the ris

Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete inst

Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially comprom

An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system dat

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modificatio

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Chec

Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenti

A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads wh