2026

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown func

A vulnerability was detected in sambitraj Student-Management-System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. This

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Abstra

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.

Incorrect access control in the setSyslogCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attack

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown functi

Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control

Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a

Incorrect access control in the setWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attack

Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This i

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHea

Improper neutralization of input during web page generation in Apache Wicket. The <wicket:label> tag is provided by org

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.Button

AjaxEditableChoiceLabel in wicket-extensions, when constructed with a non-null IChoiceRenderer, writes the display value

ResourceIsolationRequestCycleListener protects a Wicket application against cross-site request forgery by rejecting requ

Improper validation of resource URL attributes in Apache Wicket allows an unauthenticated remote attacker to read files

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored c

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to th

DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, an

ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method tha

A security flaw has been discovered in diem-project diem up to 5.1.3. The impacted element is an unknown function of the

A vulnerability was identified in diem-project diem up to 5.1.3. The affected element is the function executeCommand of

A flaw has been found in IObit Uninstaller 15.5.0.11. This affects the function IRP_MJ_DEVICE_CONTROL in the library IUF

A vulnerability was detected in klaussilveira GitList 2.0.0. Affected by this issue is the function SimpleXMLElement of

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept or

ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpo

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-sup

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sani

@pdfme/common before 5.5.10 contains a server-side request forgery vulnerability in the getB64BasePdf function that fetc

pdfme schemas before 5.5.10 contains a cross-site scripting vulnerability in the multiVariableText property panel that a

pdfme pdf-lib versions before 5.5.10 contain an unbounded buffer growth vulnerability in the DecodeStream.ensureBuffer()

Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EH

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isVali

A flaw has been found in yaojingang GEOFlow up to 2.1.0. This issue affects the function preview of the file app/Http/Co

A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file a

Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, a

Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing atta

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in

nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUr

A vulnerability was determined in jeecgboot jeewx-boot up to 641ab52c3e1845fec39996d7794c33fb40dad1dd. This issue affect

When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that c

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /r

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality

A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backe

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker

GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.

NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow appl

A security flaw has been discovered in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4