2026

In Modem, there is a possible system crash due to improper input validation. This could lead to local denial of service

A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown functi

A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function test_default_

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processin

A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the fil

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /p

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is som

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unkn

A security vulnerability has been detected in JeecgBoot up to 3.9.3. This vulnerability affects the function exportXls o

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON

A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an un

A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the

nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix co

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gy

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/cor

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create ro

wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views ret

h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing a

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allo

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME.

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack() utility that fails to saniti

PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creat

PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields

PocketMine-MP versions before 3.15.4 contain a denial of service vulnerability in the InventoryTransaction component's f

The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted fo

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from b

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources

The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message

A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmF

A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dm

A flaw has been found in code-projects Daily Expense Manager 1.0. Affected is an unknown function of the file /Daily-Exp

A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customer

A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /mo

The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting

The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPr

The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions

A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /mod

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of t

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the f

A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never att

libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zer

libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instructio

libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular unco

rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received fro

The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its heade