2026

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cro

Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the

Census CSWeb 8.0.1 allows arbitrary file upload. A remote, authenticated attacker could upload a malicious file, possibl

Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file direc

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creati

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the file server endpoint does not perform perm

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is a privilege escalation vulnerability.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Subscribe::save()` method in `o

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()`

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginRunDatabaseScript

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `remindMe.json.php` endpoint pas

WWBN AVideo is an open source video platform. In versions up to and including 26.0, a user with the "Videos Moderator" p

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Permissions/setPermissio

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `ImageGallery::saveFile()` metho

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`AP

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptStr

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions

strongSwan versions 4.5.0 prior to 6.0.5 contain an integer underflow vulnerability in the EAP-TTLS AVP parser that allo

A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitiz

A vulnerability has been found in erupts erupt up to 1.13.3. Affected by this issue is the function geneEruptHqlOrderBy

A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables

Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600

Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600

A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoin

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php`

A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows atta

A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allo

A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2. The troubleshooting actioner compo

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/import.json.php` endpoi

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `createKeys()` function in the L

cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `p

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` en

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` functi

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AV

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Gallery plugin's `saveSort.json.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.ph

Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.0

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s a

A weakness has been identified in code-projects Simple Laundry System 1.0. Affected is an unknown function of the file /

A security flaw has been discovered in code-projects Simple Laundry System 1.0. This impacts an unknown function of the

A vulnerability was identified in code-projects Simple Laundry System 1.0. This affects an unknown function of the file

Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstor

The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped,

Versions of the package jsrsasign before 11.1.1 are vulnerable to Incorrect Conversion between Numeric Types due to hand