2026

Use after free vulnerability in Softing smartLink HW-DP or smartLink HW-PN webserver allows HTTP DoS. This issue affects

Stack-based buffer overflow vulnerability in Softing Industrial Automation GmbH gateways allows overflow buffers. This i

Missing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get a specific device infor

BS Producten Petcam 33.1.0.0818 is vulnerable to Incorrect Access Control. An unauthenticated attacker in physical proxi

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being u

A resample query can be used to trigger out-of-memory crashes in Grafana.

A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5,

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs aga

The '/logs' and '/logs-stream' endpoints in the log router allow any authenticated user to read the full application log

Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to ex

Fleet is open source device management software. Prior to 4.81.0, Fleet contained an issue in the user invitation flow w

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.16 and 6.7.2, the markdown

Statamic is a Laravel and Git powered content management system (CMS). Starting in version 5.7.12 and prior to versions

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing a specially crafted

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Respo

LinkAce is a self-hosted archive to collect website links. In versions prior to 2.5.3, a private note attached to a non-

changedetection.io is a free open source web page change detection tool. Prior to 0.54.7, the `jq:` and `jqraw:` include

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download e

The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Informati

A Cross-Site Request Forgery (CSRF) vulnerability in the WatchGuard Fireware OS WebUI could allow a remote attacker to t

A flaw in Node.js URL processing causes an assertion failure in native code when `url.format()` is called with a malform

DDSN Interactive cm3 Acora CMS version 10.7.1 contains an improper access control vulnerability. An editor-privileged us

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.24.8, NanoMQ’s MQTT-over-WebSoc

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated auth_length fie

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can cra

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, progressive_decompress_tile_up

Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versio

The WooPayments: Integrated WooCommerce Payments plugin for WordPress is vulnerable to unauthorized modification of data

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubi

Insecure Direct Object Reference (IDOR) vulnerability in 1millionbot Millie chat that allows private conversations of ot

When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using

OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected s

OpenClaw before 2026.3.12 applies rate limiting only after successful webhook authentication, allowing attackers to bypa

OpenClaw before 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization.

OpenClaw before 2026.3.28 contains a missing rate limiting vulnerability in the Nextcloud Talk webhook authentication th

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbi

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to be

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validati

Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpo

PdfDing is a selfhosted PDF manager, viewer and editor offering a seamless user experience on multiple devices. Prior to

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/emailAllUsers.json

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo endpoint objects/pluginSwitch.json.

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteS