2026

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_upload

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/fu

A weakness has been identified in D-Link DNS-320 1.0.2. The impacted element is an unknown function of the file /web/jqu

A vulnerability was identified in D-Link DNS-320 1.0.2. Impacted is an unknown function of the file /photo_center/php/up

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2

Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2

A vulnerability was determined in D-Link DNS-320 1.0.2. This issue affects some unknown processing of the file /web/web_

Use after free in Aura in Google Chrome prior to 150.0.7871.128 allowed a local attacker to potentially exploit heap cor

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitra

Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code insi

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the e

NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide

NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose

FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. T

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenti

A vulnerability was identified in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. The impacted element is an unknown function

The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /g

Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side an

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and ser

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Le

NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Co

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/fil

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthent

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the denylis

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthen

BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory ju

FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated a

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::Doma

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by

Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthentic

Huginn before 2026.09.09 contains a server-side request forgery vulnerability in the fetch_url method of ScenarioImport

HyperDX before 2.31.0 contains a server-side request forgery vulnerability that allows authenticated team members to dir

Roo Code through 3.54.0 contains a command injection vulnerability in the auto-approve execute feature that allows attac

LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey templat

DNG SDK versions 1.7.1 2536 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to prot

A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without inst

xrdp is an open source RDP server. In versions 0.10.6 and prior, when an authenticated user session is initialized using

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: cancel pending_rx_work before tak

In the Linux kernel, the following vulnerability has been resolved: i2c: stub: Reject I2C block transfers with invalid

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ip_set_

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix endpoint use-after-free i

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.listBackups()`

xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to pr

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an e

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp mes