2026

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude

Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers

Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthentica

Incorrect access control in the setLanguageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated atta

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLG

Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Const

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Ankara Hosting Sit

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or em

Apache Wicket enforces the upload limits configured on a form or upload field while parsing a multipart request with Apa

YaCy Search Server through 1.941 contains an XML external entity injection vulnerability in SVG, FreeMind, and OpenSearc

Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image

A weakness has been identified in D-Link DSM-G600 1.01. This affects an unknown function of the file /load_file.cgi of t

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query strin

ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated u

ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that

Hulumi versions before v1.3.2 resolve the threat-model helper script from an unsafe root, allowing workspace files to sh

@hulumi/policies versions before 1.3.2 contain a parent spoof bypass vulnerability that allows attackers to submit spoof

A security vulnerability has been detected in klaussilveira GitList 2.0.0. Affected by this vulnerability is the functio

nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowin

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles Web

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnecti

A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the lib

WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successfu

A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e.

A vulnerability has been found in itsourcecode Online Medicine Delivery System 1.0. This issue affects the function Cust

A flaw has been found in itsourcecode Online Medicine Delivery System 1.0. This vulnerability affects the function loadR

A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultLi

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue i

A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is th

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. Affected is the function Employ

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get_4bytes of the file src/modul

A vulnerability was found in Cozmoslabs Profile Builder Plugin up to 3.16.1 on WordPress. The impacted element is the fu

A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the fi

A vulnerability was determined in SeaCMS up to 13.6. Affected is the function parseIf of the file search.php of the comp

A vulnerability was identified in TOTOLINK NR1800X 9.1.0u.6681_B20230703. This affects the function setUssd of the file

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub_456CF4 of the fil

AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web ser

A vulnerability was identified in Linux Foundation Magma 1.9.0. This affects an unknown function of the component Securi

Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements

Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of lists_show.php

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rende

SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package nam

WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails

AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/get

WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which pro

Readest is an open-source e-book reader built on Tauri. In versions prior to 0.11.16, EPUB chapter HTML is sanitized wit

Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces withou

NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that

jina-ai reader disables its private-address guard outside Google Cloud deployments, allowing unauthenticated attackers t

Qubes OS before qubes-core-dom0-linux 4.3.22 allows OS command injection during a qvm-copy-to-vm call from dom0 to an at