2026

A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/set

A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /go

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker w

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and rem

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chain

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without val

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenti

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “ne

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied in

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on c

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document upd

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYA

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection proc

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V vid

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decod

SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attac

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet tha

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that a

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that a

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operation

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XML

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to exec

LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows aut

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execu

A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /g

A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /

A vulnerability was determined in Linksys E1700 1.0.0.4.003. This vulnerability affects the function ssid1MACFilter of t

A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the func

Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections t

In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when con

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations a

A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to creat

jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticat

jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows a

jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to rea

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authentica

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unas

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to