2026

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is

Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the inf

A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_sg_mfurl_del of the file

A vulnerability was determined in davenardella snap7 up to 1.4.3. The affected element is the function TSnap7MicroClient

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown functio

A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function Adm

A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. This vulnerability affects the function AdminTopic

A vulnerability was detected in moxi624 Mogu Blog v2 up to 5.2. This affects the function BlogSortServiceImpl.addBlogSor

A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function

A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. A

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e0

A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatM

A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the fil

A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of

A flaw has been found in TDuckApp tduck-platform up to 5.3. Affected by this vulnerability is an unknown functionality o

A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admi

A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unk

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the f

A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d30995

A vulnerability was identified in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af0

MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to i

S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items

alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes o

A vulnerability was determined in jaychouchannel Tourism-Management-System up to d984d172dceca907f8b447efbdb06dc233f7938

A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Th

A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa6

A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the f

SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when proc

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authenticati

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers wi

ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitr

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser componen

PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables befo

A security flaw has been discovered in PHPGurukul Bank Locker Management System 1.0. This impacts an unknown function of

A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the

A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown f

A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unkn

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowi

procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function

Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supp

Open Notebook before 1.11.0 fails to validate the URL parameter in POST /api/sources endpoint, allowing authenticated us

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to re

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing cus

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the cont