2026

An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a r

A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator a

A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains an admin

An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a re

An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a re

A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a r

An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a re

A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains an admini

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote

mreporting is the more reporting GLPI plugin. Prior to 1.9.4, there is a possible SQL injection on date change. This vul

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a P

The BFG Tools – Extension Zipper plugin for WordPress is vulnerable to Path Traversal in all versions up to, and includi

The Mail Mint plugin for WordPress is vulnerable to blind SQL Injection via the 'forms', 'automation', 'email/templates'

IBM Sterling B2B Integrator versions 6.1.0.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5, and 6.2.1.0 through 6.2.1.1, an

The Bookster – WordPress Appointment Booking Plugin plugin for WordPress is vulnerable to SQL Injection via the ‘raw’ pa

Server-Side Request Forgery (SSRF) vulnerability in Alobaidi Extend Link extend-link allows Server Side Request Forgery.

A null pointer dereference vulnerability in the certificate downloader CGI program of the Zyxel VMG3625-T50B firmware ve

A null pointer dereference vulnerability in the account settings CGI program of the Zyxel VMG3625-T50B firmware versions

A null pointer dereference vulnerability in the IP settings CGI program of the Zyxel VMG3625-T50B firmware versions thro

A null pointer dereference vulnerability in the Wake-on-LAN CGI program of the Zyxel VMG3625-T50B firmware version throu

Pimcore is an Open Source Data & Experience Management Platform. In versions up to and including 11.5.14.1 and 12.3.2, t

Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to impr

A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.

A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.

A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall.

Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which

Bitnami Sealed Secrets is vulnerable to a scope-widening attack during the secret rotation (/v1/rotate) flow. The rotati

VideoLAN VLC for Android prior to version 3.7.0 contains a path traversal vulnerability in the Remote Access Server rout

Inefficient Regular Expression Complexity (CWE-1333) in the AI Inference Anonymization Engine in Kibana can lead Denial

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `posts_nearby` was

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can vi

The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, an

Kiteworks is a private data network (PDN). Prior to version 9.2.0, a vulnerability in Kiteworks configuration allows upl

code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_view.php?te

code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/modal_edit.php.

Chamilo is a learning management system. Prior to version 1.11.30, Chamilo is vulnerable to deserialization of untrusted

In ExtremeCloud IQ – Site Engine (XIQ‑SE) before 26.2.10, a vulnerability in the NAC administration interface allows an

A vulnerability in WatchGuard Fireware OS may allow an attacker to bypass the Fireware OS filesystem integrity check and

A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker

A vulnerability in the REST API of Cisco Secure FMC Software could allow an authenticated, remote attacker to conduct SQ

The Apocalypse Meow plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to,

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Stylemix uListing ulisti

MarkUs is a web application for the submission and grading of student assignments. Prior to version 2.9.4, MarkUs allows

Agentgateway is an open source data plane for agentic AI connectivity within or across any agent framework or environmen

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version

The Community Events plugin for WordPress is vulnerable to SQL Injection via the 'ce_venue_name' CSV field in the `on_sa

An administrator may attempt to block all networks by specifying "\*" or "all" as the network identifier. However, these

An administrator may attempt to block all traffic by configuring a pass filter with an empty table. However, in UBR, an

A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal