2026

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via th

FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbit

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors

A security vulnerability has been detected in jina-ai reader up to 1574bfd380d249c86c82db4dace0d9c8fe17e2b1. This issue

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a sp

Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding

ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attacke

Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that all

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Criti

Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnera

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communicati

Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between contr

A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to

WebsiteBaker CMS before 2.13.10 contains an unrestricted file upload vulnerability in the module installation feature th

WebsiteBaker CMS before 2.13.10 contains a code injection vulnerability in the Droplets editor that allows authenticated

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3

OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows attackers with valid credentials to ci

OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoi

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki. Thi

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated use

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature t

Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to exe

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN53

A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown function

A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library A

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when ev

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalatio

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitra

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints,

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHea

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning end

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injecti

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.s

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xm

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-em

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the f

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_l

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional

In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional