2026

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operation

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to exec

In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when con

A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticat

jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows a

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users

mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/mo

A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modu

An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through

A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow

A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow

A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker

An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenti

Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDo

A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of

A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6. This affects the function get_authentication_dependen

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to refe

A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This a

In the Linux kernel, the following vulnerability has been resolved: sched/cache: Decouple sched_cache_group from mm to

A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. A

A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected b

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vul

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function Pu

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The m

ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_z

Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plu

A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a data

The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred processing through a str

The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the v

The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in drivers/fuel_gauge/fu

net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with net_nbr_get_lladdr(

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into

pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allo

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePho

AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obt

Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attack

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote una

UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-pri

LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0

Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauth

Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that igno

pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pb

GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that

OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unaut