2026

Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application

10-Strike LANState 8.8 contains a local buffer overflow vulnerability in structured exception handling that allows local

Snes9K 0.0.9z contains a buffer overflow vulnerability in the Netplay Socket Port Number field that allows local attacke

MyBB Last User's Threads in Profile Plugin 1.2 contains a persistent cross-site scripting vulnerability that allows atta

MyBB Downloads Plugin 2.0.3 contains a persistent cross-site scripting vulnerability that allows regular members to inje

7 Tik 1.0.1.0 contains a denial of service vulnerability that allows attackers to crash the application by submitting ex

VPN Browser+ 1.1.0.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the appli

sheed AntiVirus 2.3 contains an unquoted service path vulnerability in the ShavProt service that allows local attackers

Hotspot Shield 6.0.3 contains an unquoted service path vulnerability in the hshld service binary that allows local attac

IObit Malware Fighter 4.3.1 contains an unquoted service path vulnerability in the IMFservice and LiveUpdateSvc services

Netgate AMITI Antivirus build 23.0.305 contains an unquoted service path vulnerability in the AmitiAvSrv and AmitiAntivi

NETGATE Registry Cleaner build 16.0.205 contains an unquoted service path vulnerability in the NGRegClnSrv service that

Spy Emergency build 23.0.205 contains an unquoted service path vulnerability in the SpyEmrgHealth and SpyEmrgSrv service

IObit Advanced SystemCare 10.0.2 contains an unquoted service path vulnerability in the AdvancedSystemCareService10 serv

The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 2.4

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page

The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure i

The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'feed_data'

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePres

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 39

PraisonAI is a multi-agent teams system. Prior to version 4.5.97, SubprocessSandbox in all modes (BASIC, STRICT, NETWORK

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version

PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates

PraisonAI is a multi-agent teams system. Prior to version 1.5.90, run_python() in praisonai constructs a shell command s

PraisonAI is a multi-agent teams system. Prior to version 4.5.90, passthrough() and apassthrough() in praisonai accept a

Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1

Emlog is an open source website building system. In versions 2.6.2 and prior, a path traversal vulnerability exists in t

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus a

Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorizat

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to ver

RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine. In versions 0.24.0 and prior, a Server-Side Templ

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability w

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability e

Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API meth

Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior t

Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical

OS command injection in the browser-based authentication component in Amazon Athena ODBC driver before 2.0.5.1 on Linux

Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow

Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC drive

Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0

Improper neutralization of special elements in the authentication components in Amazon Athena ODBC driver before 2.1.0.0

A specific administrative endpoint is accessible without proper authentication, exposing device management functions.

prompts.chat prior to commit 1464475, contains an identity confusion vulnerability due to inconsistent case-sensitive an

prompts.chat prior to commit 30a8f04 contains a server-side request forgery vulnerability in the Fal.ai media status pol