2026

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffe

The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.6

Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStati

Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allow

Incorrect Privilege Assignment vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Privile

In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix workqueue list corruption by removin

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF and double free in s

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix re-decryption of RESPONSE packets If a

In the Linux kernel, the following vulnerability has been resolved: rxgk: Fix potential integer overflow in length chec

IBM Langflow OSS 1.0.0 through 1.9.1 could allow remote code execution due to improper validation of symbolic links duri

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 t

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was publish

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's web-based config

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. Prior to 2026-05-07, Pi.Alert's SaveConfigFile()

A stack-based buffer overflow condition exists in WOSDefaultHttpModule.dll when processing a long URL path starting with

A stack-based buffer overflow condition exists in WOSDeviceDropFolder.dll when processing a long URL path starting with

Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port 7878 and processes r

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to bef

In the Linux kernel, the following vulnerability has been resolved: block: add pgmap check to biovec_phys_mergeable bi

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix race between ICReq handling and queu

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADD_ADDR rtx: fix potential data-race T

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate dacloffset before building DA

SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability

A command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 f

A command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 f

A command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305

A command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firm

In Casdoor versions 2.362.0 and earlier, the SAML service provider implementation does not validate the AudienceRestrict

Casdoor versions 2.362.0 and earlier contain a vulnerability enabling cross-organization token exchange. The GetTokenExc

Casdoor versions 2.362.0 and earlier do not verify that a JWT used for token exchange is still active. The GetTokenExcha

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticate

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component:

Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. Prior to 8.36.1, Marten's full-text search API

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versi

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in

The WP Maps Pro plugin for WordPress is vulnerable to Privilege Escalation via Administrator Account Creation in all ver

The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in version

Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requ

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device.

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file conta

The upload.cgi binary, responsible for processing device backups, contains a hardcoded AES encryption key. This allows a

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command

DreamMaker developed by Interinfo has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers