2026

A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.

The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certai

A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.

A vulnerability was determined in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The impacted elemen

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unkn

A flaw has been found in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This issue affects the f

A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerabilit

An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0

An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 13

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unkn

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_serv

The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after

A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of t

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import featu

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJA

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vu

Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a pr

A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. A

A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unk

A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d30995

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af0

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to i

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when proc

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authenticati

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers wi

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitr

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser componen

A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown f

A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unkn

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowi

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without

Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supp

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated us

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to re

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the cont

A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceI

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspec

A vulnerability has been found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. The impacted e

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the fi

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a mem

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership