2026

The endpoint ‘/ws/apiprensa/getVideoUltimasSeccion’ contains an SQL injection vulnerability in the id_seccion parameter.

The endpoint ‘/ws/apiprensa/getVideoNextPrev’ is vulnerable to SQL injection via the id_ambito parameter. Unsanitized in

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id_video and id_ambito parameters. Th

SQL injection vulnerability in the ‘/ws/apiprensa/getVideoSubcanal’ endpoint due to improper handling of the id_video pa

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the paren

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. Whil

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF e

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the fi

A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of t

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE242

Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink

A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Techno

Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Fu

A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected p

Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attac

In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which con

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowi

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce

In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C:

Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.

Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.

Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.

Subscriber Broken Access Control in Ditty <= 3.1.67 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.

Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.

Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.

Unauthenticated Cross Site Scripting (XSS) in WP w3all phpBB <= 3.0.6 versions.

Unauthenticated PHP Object Injection in Hash Form <= 1.4.1 versions.

Unauthenticated Cross Site Scripting (XSS) in CozyStay <= 1.10.0 versions.

Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.

Unauthenticated PHP Object Injection in Geo Controller <= 8.9.8 versions.

Subscriber SQL Injection in Like Button Rating <= 2.6.61 versions.

Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.

Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.

Editor PHP Object Injection in Fluent Boards Pro <= 2.0.11 versions.

Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.

Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.

Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.

Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Realtyna Organic IDX plugin <= 5.4.1 versions.

Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.

Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A

Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An att