2026

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 26

An issue was discovered in DPU in Samsung Mobile Processor Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 26

N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field

A security vulnerability has been detected in Totolink A3002MU Hh-B20211125.1046. This issue affects the function formIp

A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. This vulnerability affects the function formFilter

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component

A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote

An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. L

In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the config

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unkn

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is t

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_serv

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the f

The mcumgr SMP settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete(

The MQTT-SN client keepalive handler process_ping() in subsys/net/lib/mqtt_sn/mqtt_sn.c removes the gateway record after

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affec

A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an un

A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_

FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in

FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in lib

A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-LI

A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function Online

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function Per

A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of t

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFr

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the confi

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import featu

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJA

TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectAre

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vu

A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php.

Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected

A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0. Impacted is the function saveTodos of the file s

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpd

A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the fi

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a pr

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.

A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function _authorize_http

A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gf_list_count of the file utils/lis

A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field of

A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gf_node_list_add_child of th

Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as