2026

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts a

A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown f

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element

A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx

Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. This issue affects xClick

Improper input validation vulnerability in bizwell xClick allows Stored XSS. This issue affects xClick: R2, R3, and R3.

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in us

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate t

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated e

A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includ

A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown function

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by th

A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component St

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function th

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing

WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url en

A vulnerability was determined in EFM ipTIME C200E 1.094. The impacted element is an unknown function of the file iux_se

A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the fi

A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of

A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vu

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widg

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown f

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is a

A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of

DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attack

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetch

GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by una

Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFa

A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the

A vulnerability was detected in GNU Binutils 2.47. The affected element is the function _bfd_elf_strtab_delref of the fi

A security vulnerability has been detected in GNU Binutils 2.47. Impacted is the function _bfd_write_merged_section of t

A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the f

Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them int

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricte

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the Acl

A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the cle

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in

The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGE

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 Fail to sanitize Team obje

Takahe through 0.11.0 fails to restrict URL schemes in link hrefs within federated post content and profile summaries, a

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoi

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated

A security flaw has been discovered in GNU Binutils 2.47. This vulnerability affects the function elf_orphan_compatible