2026

A vulnerability was identified in cu silicon up to 0.1.5. Affected by this vulnerability is the function create_app of t

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown cod

A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWrite

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-co

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.

Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.

Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic <= 6.0.9.8 versions.

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin s

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractIte

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL up

Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions.

Unauthenticated Cross Site Scripting (XSS) in LeadConnector <= 4.0.5 versions.

Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Uncode <= 2.12.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Email Subscribers & Newsletters <= 5.9.33 versions.

Subscriber SQL Injection in Charitable <= 1.8.12.1 versions.

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the

The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a ver

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallo

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/migrate.php

Incorrect access control in the showSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker

A flaw was found in GDB's STABS debug format parser. The read_member_functions() function in gdb/stabsread.c contains a

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access a

Goploy is an open-source automation deployment system. Prior to version 1.18.0, a severe path traversal vulnerability ex

A flaw has been found in MegaEase EaseProbe up to 2.3.0. Affected is the function realIP of the file web/server.go of th

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate end

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown fu

A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unaut

A vulnerability was determined in ieungSoft Ultra RAMDisk Pro 1.82. This issue affects some unknown processing in the li

The affected Ebyte product does not provide separation between limited and administrative management functions. A low

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated a

Incorrect access control in the delPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage o

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown funct

ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerabi

Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attacker

Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated

Incorrect access control in the setWiFiSignalCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated at

In Eclipse Theia versions 1.73.0 up to but not including 1.75.0, the AI "Agent Mode" file-change tools (writeFileContent