2026

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_JF.php that allows au

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in opena.php that allows authent

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_facnote.php that allows a

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows a

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_nm.php that allows aut

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authen

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.

Missing password field masking vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view, Hi

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed t

A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with

Uncontrolled resource consumption in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025

Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allow

Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025

Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlockin

Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper chec

GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations t

The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configu

A lack of runtime integrity in GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass file system read-only pr

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a networ

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0

Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML int

Weblate is a web based localization tool. Prior to version 2026.5, Weblate's live search preview renders unit source and

Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Reque

During WiFi association, Naxclow device firmware prints the host network’s SSID, PSK, and negotiated WPA keys in clearte

Allegra downloadAttachment Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote at

Flowise before 3.1.0 (npm package flowise, versions 3.0.13 and earlier) uses a weak hardcoded default value 'Secre$t' fo

The Zephyr PL011 UART driver (drivers/serial/uart_pl011.c) contains an unbounded software loop in pl011_irq_tx_enable()

A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permissio

Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr memory read/write commands,

Insufficient data validation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker t

FatFs R0.16 and earlier contains a divide-by-zero in exFAT sync logic bug when crafted metadata causes n_fatent - 2 to b

FatFs prior to R0.16 that use GPT scanning with 'FF_LBA64 = 1' contains an issue where an unbounded loop count derived f

FatFs R0.16 and earlier contains an uninitialized cluster exposure when f_lseek() extends files beyond EOF without zero-

Guardian language-system fails to sanitize the name GET parameter before outputting it into an HTML input value attribut

Guardian language-system fails to sanitize the id GET parameter before inserting it into multiple HTML form action attri

Guardian language-system fails to sanitize the id GET parameter before inserting it into HTML source and form action att

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defens

The MAX32xxx USB device controller driver (drivers/usb/udc/udc_max32.c, compatible adi_max32_usbhs) dereferenced an endp

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile ima

Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in pac