2026

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for exp

The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cjtoolbo

MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dash

A prototype pollution vulnerability in Software Mansion React Native Worklets before 0.12.2 allows an attacker-controlle

A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. A

madpsy ka9q_ubersdr before 0.1.58 has a stored cross-site scripting (XSS) vulnerability in the chat message rendering fu

A flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected b

A vulnerability was detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Aff

A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207c

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl

A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. T

Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKC

Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth

Incomplete property masking in the SANnav logging subsystem permits SNMP authentication and privacy passwords to be reco

containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely sep

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-stor

IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated U

Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-co

Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate,

Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerr

Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction l

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorizat

A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInf

A security flaw has been discovered in jhen0409 react-native-debugger up to 0.14.0. The impacted element is the function

Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users

Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace

LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF ta

libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A spec

The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functiona

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access

The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diag

The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with acce

The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An at

The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update proce

The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. A

The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi cre

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extensio

An information exposure vulnerability in the job scheduling component of SANnav allows sensitive credentials to be writt

A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when pro

A vulnerability was determined in chonkie-inc littrs 0.6.1/0.6.2. Impacted is the function Sandbox::mount of the file cr

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this i

A security flaw has been discovered in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected by this vulnerability

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoO

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 m

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers t

Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which c