2026

dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS

SQL Injection in MuuCMF T6 v1.9.4.20260115 allows an unauthenticated attacker to compromise the entire database, achieve

D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub_42EF14 of the file /bin/alphapd. The man

OpenClaw before 2026.4.20 contains an improper environment variable validation vulnerability in MCP stdio server configu

A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and

A vulnerability was detected in OpenClaw up to 2026.1.24. The impacted element is the function handleBlueBubblesWebhookR

Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries. Alien::FreeImage contains versi

A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function createDevContext of the f

An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark function

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.5 and iPadOS 26.5, macO

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, the Outline comment section perm

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaul

A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature acc

Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomca

YAML::Syck versions before 1.38 for Perl has an out-of-bounds read. The base60 (sexagesimal) parsing code in perl_syck

Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allow

Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow via the task_mavobc_entry fun

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClien

The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU we

Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.

Oinone Pamirs 7.0.0 contains a command injection vulnerability in CommandHelper.executeCommands. The method starts a she

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, a sto

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, Excel

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, whe

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.1.124, the

Crypt::DSA versions before 1.20 for Perl generate seeds using rand. Seeds were generated using Perl's built-in rand fun

A weakness has been identified in CoreWorxLab CAAL up to 1.6.0. The affected element is an unknown function of the file

A vulnerability was determined in Oinone Pamirs up to 7.2.0. Affected by this issue is the function RSQLToSQLNodeConnect

A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h

A flaw has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The affected element is th

A vulnerability has been found in fishaudio Bert-VITS2 up to 8f7fbd8c4770965225d258db548da27dc8dd934c. The impacted elem

A vulnerability was found in adenhq hive up to 0.11.0. This affects the function _read_events_tail of the file core/fram

A vulnerability was determined in Metasoft 美特软件 MetaCRM up to 6.4.0 Beta06. This impacts an unknown function of the file

A vulnerability was identified in xiandafu beetl up to 3.20.2. Affected is an unknown function of the file beetl-classic

A vulnerability was found in vercel ai up to 3.0.97. The affected element is the function validateDownloadUrl of the fil

A security flaw has been discovered in linlinjava litemall up to 1.8.0. This impacts the function list of the file litem

A flaw has been found in projectworlds hospital-management-system-in-php 1.0. Affected by this vulnerability is the func

Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections. The values from the set_add method were n

Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration

Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects A

Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36,

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via crafted module listed in t

An issue in gohttp commit 34ea51 allows attackers to execute a directory traversal via supplying a crafted request.

An authorization vulnerability exists in Innoshop 0.6.0. After logging into the frontend, an attacker can directly acces