2026

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticate

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnera

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerabil

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity w

HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when i

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation wor

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid f

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which l

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize th

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/web

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /c

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally s

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concaten

A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries admin

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker

An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected

An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR c

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerabilit

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privil

A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/w

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instan

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql para

In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arb

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability. An unauthe

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerab

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability. An unauthentica