2026

An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacke

Editor SQL Injection in Amelia <= 2.4.9 versions.

Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions.

Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.

Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions.

Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions.

Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affect

A race condition in the document value layer of MongoDB Server can allow concurrent server threads to operate on the sam

An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP

OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows u

MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs owner

MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wec

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103

Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-d

Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to re

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILG

Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field b

Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILG

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DI

NextGen Connect (Mirth Connect) versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through

When XML batch processing is turned on and the XPath option is selected, the raw batch input goes through a default XPat

The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURIT

A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ20

A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restri

An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an att

Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket

NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibi

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in t

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in t

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in t

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in t

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connecti

Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an u

libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site

An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypa

WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unau

WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due

WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerabili

Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerabi

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not inc

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed eleme