2026

luci-lib-px5g (LuCI) contains a heap-based buffer overflow in the native ASN.1 encoding routine asn1_add_obj (x509write.

SiYuan versions before v3.7.4 fail to validate that packageName matches the downloaded package content in bazaar install

SiYuan versions before v3.8.0 contain an incomplete path blocklist in the MCP file tool that fails to restrict access to

SiYuan before v3.8.0 interpolates secret placeholders into the destination URL parameter of the http_request MCP tool, a

WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 contains an authorization bypass vulnerability in th

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php th

AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that all

AVideo through commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthentica

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability

A weakness has been identified in TRENDnet TEW-823DRU 1.1.02b01. This vulnerability affects the function nvram_get of th

The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0

The The kk Star Ratings – Rate Post & Collect User Feedbacks plugin for WordPress is vulnerable to arbitrary shortcode e

The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allow

The Conekta Payment Gateway WordPress plugin before 6.2.2 does not verify the authenticity of incoming payment gateway w

The FiboSearch WordPress plugin before 1.34.1 does not consistently exclude password-protected products from its unauth

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordP

The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordP

The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8

OliveTin gives access to predefined shell commands from a web interface. The `filterToDefinedArgumentsOnly` function in

WeeChat (Wee Enhanced Environment for Chat) is a free chat client. In versions 4.3.0 through 4.9.0, the WeeChat relay mo

Combodo iTop is a web based IT service management tool.Prior to 3.2.3, an unauthenticated user could delete the .readonl

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools incl

CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without aut

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/ove

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Ver

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc7609508355

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and a

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not ass

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote,

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote,

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allo

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote,

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote,

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote,

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote,

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authent

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remot

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that m

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under diff

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-co

FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyO

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresql_scaler.go constru

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. Picotls im

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/typ

Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sens

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the logi

A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.6.2. This issue affects the function FlwInstanceControl