2026

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Tal

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Ent

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulne

A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability fo

A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of CR

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability

A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-ena

The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via

The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inc

The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Unrestricted Fi

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms

TarsWeb decides whether a request comes from a trusted local caller using a client-controlled header. app.js sets Koa's

TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods i

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSa

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type

A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit

A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Conne

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Pro

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabilit

A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability f

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths (extension of

Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.

The Reviews and Rating – Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all version

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by pa

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authen

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attack

Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can

EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote atta

CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remot

CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability.

A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability

The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed c

Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message

A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on th

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously c

When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address

With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logi

Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, res

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by comm

The Mang Board WP plugin for WordPress is vulnerable to Missing Authorization via Authentication Cookie Forgery in all v