2026

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10,

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Arch

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restri

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10,

Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with in

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 an

Dayforce ESS Excelity is vulnerable to Path Traversal  in file download functionality. An unauthenticated attacker can s

Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted

Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenti

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and contr

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600).

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.c

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814. This vulnerability affects unknown cod

A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files o

An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This comp

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express

mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its produc

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, includin

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocke

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational

Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform a

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target res

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerabil

The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. Th

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verifi

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endp

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getF

A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/s

A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packag

A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1. This affects the function saveUploadedFile

A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packag

A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allow

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Informati

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When cop

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config syn

A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function get_file of the file /tmp/wpa_

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa

A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of

Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JV

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration version

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 202

An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prio