2026

A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeC

A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinal

A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src

A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the function filepath.Joi

A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the fi

Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via Environment Variables.

A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a data

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Admini

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of th

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Interuse i-Bos. T

The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a str

The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controller retains the receiv

The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_upd.c retains the rec

The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation retains

i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_DIR_BOTH. The I2S_DI

The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the v

The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key

The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fu

net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(

The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status re

The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channel name of a rejected

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the c

pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allo

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API client

pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows unauthenticated att

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePho

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId ha

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler tha

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that a

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handle

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition h

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authent

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or r

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserControlle

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleContr

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler tha

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to