2026

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flo

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that

plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthent

LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC h

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsa

A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc parasites without en

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows at

Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the r

Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Aut

EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manag

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/

An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-

OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a

ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handl

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete ot

ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that ex

MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authent

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node a

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can acce

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts i

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-manage

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret mast

Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to r

SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers

SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-

Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versio

Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacke

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a

An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a

Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration fil

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool l

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or de

A malicious user with physical access to the device can boot the switch from factory settings without authentication, us

Default factory credentials with administrative access are enabled and persist even after configuring other administrato

No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to t

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption.

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. T

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. T

PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/co

PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Passwor

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST e