2026

Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment f

Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a

A flaw has been found in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected ele

A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf7

A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vu

A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Th

Zetetic SQLCipher before 4.15.0 allows SQL injection. The sqlcipher_export convenience function can be used to copy the

AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpo

AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStr

AiSOC versions 7.5.0 before 12.0.0 use a hard-coded constant for JWT verification in the realtime WebSocket and SSE serv

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated

AiSOC versions 9.0.0 before 12.0.0 fail to enforce authentication on the response-action API endpoints when AISOC_DEV_MO

A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affecte

A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/st

A vulnerability was detected in Nothings stb up to 2c980bb59875b0d32144a71867fbdebb2f77cd20. The impacted element is the

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authe

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authe

An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has comp

An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated at

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attack

A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthentic

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privil

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthent

An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SA

A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an u

A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authe

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, au

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read o

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (saml

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - Collection ext

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /ap

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundati

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foun

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension a

anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex d

LightLLM through 1.2.0 contains a memory exhaustion vulnerability in the NCCL control channel when started with --pd_tra

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization e

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with -

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetw

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic.

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores por

U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID

U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget i

U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_reply() function in net/nfs-common.c when processin