2026

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to

Sakai is a Collaboration and Learning Environment (CLE). From versions 23.0 to before 23.5, and versions 25.0 to before

Document Merge Service is a document template merge service providing an API to manage templates and merge them with giv

GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versio

Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote u

Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticat

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbit

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default.

Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it.

Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages.

The Joyland AI app accepts any TLS certificates from any server without validation.

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Withou

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to acce

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay

A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insuffic

A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adj

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versi

- Improper Privilege Management vulnerability in Johnson Controls Easy IO FG allows (Brute Force). This issue affects E

Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive inform

Lektor 3.3.14 and 3.4.0b15 contains a cross-site request forgery vulnerability in the admin API blueprint that allows un

Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin e

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or i

Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser.  The interfa

An argument injection issue in the diff scan operation in AWS security-agent-mcp-server before version 0.2.0 might allow

Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setu

Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. Af

djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when d

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when de

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerabi

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Pro

A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the

An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when config

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.

A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enab

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause

A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions

Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write acc

Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured

geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU tim