2026

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because userna

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying

Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATT

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespac

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permiss

SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace-

Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 con

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loop

Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors

Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to

Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain p

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid

Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the se

Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 passes the raw 'updates' request parameter in AppController::acti

Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to ex

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that all

Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows

FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because

Crawl4AI 0.7.0 before 0.9.4 contains a server-side request forgery vulnerability that allows API clients to reach intern

Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 can evaluate user-controlled value

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain privileged legacy InfoStud

Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a ser

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side req

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive info

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_opens

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in l

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated atta

A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the fil

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.

A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicp

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker w

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chain

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on c

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document upd

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of

Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYA

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection proc

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V vid

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decod

SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that