2026

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and inclu

The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vul

The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file typ

Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a crit

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Op

The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the

Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection

n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able

Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (R

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind

llama.cpp is an inference of several LLM models in C/C++. In commits 55d4206c8 and prior, the n_discard parameter is par

Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (S

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker t

Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnera

Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing u

A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client

INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that ca

Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage fu

SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary throug

V-SOL GPON/EPON OLT Platform v2.03 contains multiple reflected cross-site scripting vulnerabilities due to improper inpu

V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to manipu

Yahei-PHP Prober 0.4.7 contains a remote HTML injection vulnerability that allows attackers to execute arbitrary HTML co

FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to acce

FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to i

FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginIns

SOCA Access Control System 180612 contains a cross-site scripting vulnerability in the 'senddata' POST parameter of logg

NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a cross-site request forgery vulnerability that allows attac

devolo dLAN Cockpit 4.3.1 contains an unquoted service path vulnerability in the 'DevoloNetworkService' that allows loca

FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulne

FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 contains an authenticated OS command injection vulnerability that

FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains hard-coded SSH credentials that cannot be changed throu

FLIR Thermal Camera F/FC/PT/D Stream firmware version 8.0.0.64 contains an unauthenticated vulnerability that allows rem

FLIR Thermal Camera F/FC/PT/D firmware version 8.0.0.64 contains an information disclosure vulnerability that allows una

REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions ca

MONAI (Medical Open Network for AI) is an AI toolkit for health care imaging. In versions up to and including 1.5.1, a P

axios4go is a Go HTTP client library. Prior to version 0.6.4, a race condition vulnerability exists in the shared HTTP c

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment

User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacke

A weakness has been identified in bluelabsio records-mover up to 1.5.4. The affected element is an unknown function of t

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of Internatio

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of Internatio

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of Internatio

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of Internatio

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of Internatio

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of Internatio

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of Internatio

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of Internatio