2026

Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an att

Hitachi Coding Software Suite contains an Incorrect Authorization vulnerability that allows an unprivileged user to perf

Hitachi Coding Software Suite contains a vulnerability related to Use of Hard-coded Cryptographic Key. The Hardcoding of

Hitachi Coding Software Suite contains a vulnerability related to the Cleartext Transmission of Sensitive Information wh

Hitachi Coding Software Suite contains a vulnerability related to Missing Authentication for Critical Function. This all

Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker t

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an

A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent u

An OS command injection vulnerability in Genian SSL PNS allows an attacker who knows only the client access ID, without

An improper privilege management vulnerability in Genian SSL PNS allows an attacker to escalate to super administrator p

An unrestricted file upload vulnerability caused by insufficient file extension and integrity verification in Genian SSL

A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by mani

Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy serv

The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized mod

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy

A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderControlle

A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderContro

The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Sc

The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up

The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions

A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanl

A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/S

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Crede

A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty

BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a

Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary me

Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute ar

An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP

A vulnerability has been found in immich-app Immich up to 2.7.5. This affects the function checkSharedLinkAccess of the

A flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcos_construct_fci_44 of the file s

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src

simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware tha

DeepWiki-Open through commit d92819a contains an unauthenticated arbitrary file read vulnerability in the GET /codemap/f

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's leng

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that f

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation Syste

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated att

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options()

iperf3 3.20–3.21 (esnet/iperf) has a pre-auth heap buffer overflow in decrypt_rsa_message(): a 256-byte RSA buffer is BI

Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to send a privileged PendingIntent i

Prior to v66.0.0.733.524 of Meta Horizon OS, OVRMediaService could be induced to send a privileged PendingIntent includi

Devika v1.0 is vulnerable to Code Injection via the Runner.run_code function in src/agents/runner/runner.py.

Devika v1.0 is vulnerable to Code Injection in the Runner.execute function in src/agents/runner/runner.py which allows a

DeepTutor v1.4.0 is vulnerable to command execution in /tutorbot/agent/tools/shell.py:ExecTool.execute.

DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.

agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts. An externally

In DB-GPT 0.7.5 and 0.8.0, a skill uploaded through the real /api/v1/skills/upload route can later be executed through t