2026

An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to ex

WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN pac

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security fe

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code ins

A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash

A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fe

A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function save_pipeli

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function import_session

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/

A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file sr

A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instruct

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote at

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated atta

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client

cpp-httplib is a C++ header-only HTTP/HTTPS library. In version 0.49.0, the chunked-response trailer output path writes

The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to byp

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout m

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HT

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management inte

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access

The affected Ebyte device web management interface does not restrict the interface from being rendered within an extern

go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() function in app/admin/s

A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An at

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within applicat

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload

The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The us

Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the r

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web manag

Ebyte device web management interface does not consistently enforce authentication before granting access to administra

Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacke

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level atta

Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker to deliver a payload that

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, th

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to s

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. T

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2

Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2

An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows atta

An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attacke