2026

The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check

There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models.

There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products

Due to a Cross-Site Scripting (XSS) vulnerability in SAP Business Connector, an unauthenticated attacker could craft a m

Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthen

SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated u

The User Management Engine (UME) in NetWeaver Application Server for Java (NW AS Java) utilizes an obsolete cryptographi

Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticat

Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attack

Due to insufficient input handling, the SAP Identity Management REST interface allows an authenticated administrator to

Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an a

Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authent

Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthe

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The

SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the fu

SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensiti

SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to upload any file (including

SAP Fiori App Intercompany Balance Reconciliation allows an attacker with high privileges to send uploaded files to arb

Under certain conditions SAP Fiori App Intercompany Balance Reconciliation application allows an attacker to access info

Due to a Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App Intercompany Balance Reconciliation an attacke

SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switc

SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module

OpenCode is an open source AI coding agent. The markdown renderer used for LLM responses will insert arbitrary HTML into

OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP serv

Metabase is an open-source data analytics platform. Prior to 55.13, 56.3, and 57.1, self-hosted Metabase instances that

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. Prior to 4.10.0, Cross-Site Reque

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapsli

TinyOS versions up to and including 2.1.2 contain a stack-based buffer overflow vulnerability in the mcp2200gpio utility

Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal mod

LangChain versions up to and including 0.3.1 contain a regular expression denial-of-service (ReDoS) vulnerability in the

LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vuln

LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability i

Emlog is an open source website building system. emlog v2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-a

hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.93, the server uses the Origin

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, WebErpMesv2 con

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Prior to 1.19, the WebErpMesV2

Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulner

Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1)

Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR_4.121.0 allows remote

A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersona

Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to

Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', a

A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a

Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution). The application receive

A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote a