2026

The  iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing una

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and a

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbi

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerabili

jmespath.php allows users to use JMESPath, software for declaratively specifying how to extract elements from a JSON doc

Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses Industry

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before

Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt embedded in every firmwar

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound

OpenClaw before 2026.5.27 contains a state mutation vulnerability in node pairing reconnection that allows paired nodes

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 through 2.10.2 on Linux contains an Improper Authentic

GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments

The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that i

WordPress Plugin Baggage Freight Shipping Australia 0.1.0 contains an unrestricted file upload vulnerability that allows

Fortra's  Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd

remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.

ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The applica

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin p

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volum

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the rat

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNu

Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the

Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoi

RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generatio

An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component

Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in th

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and ab

An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplyi

An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscenc

An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitra

An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to exec

An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary cod

Bernd Bestel grocy v4.6.0 was discovered to contain a SQL injection vulnerability in the product-group parameter at /sto

Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.

Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.

Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.

Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms

Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formid

Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <=

Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, N

Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <=

Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja For