2026

AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.js

In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowin

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClie

In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a

In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title

HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the

TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low En

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docke

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransp

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to ar

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attac

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary marku

Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing una

Decap CMS before 3.11.0 contains a path traversal vulnerability in the local proxy containment guard that uses plain str

browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints,

PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allo

PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authentica

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form ha

UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in Conf

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token

LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated acc

kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactiv

Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent document

Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL re

Coze Studio through 0.5.1 fails to restrict the server URL supplied when registering plugin tools, allowing authenticate

OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verif

GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated use

OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing

Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated att

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper t

Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's

Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypas

LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to wr

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist val

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source co

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with r

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated a

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten he

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set hel

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to a

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches