2026

facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser

facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unau

facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows u

Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Ap

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. Th

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollin

NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of

A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authentica

An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this

phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows admi

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated

phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, al

SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cov

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler

SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows

Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthentica

Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corru

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a

The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in

Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modu

Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extrac

Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote att

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an i

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized c

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows att

A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function

A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privile

SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAp

Unauthenticated Broken Access Control in Gillion <= 4.13 versions.

Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.

Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce &#8211; Checkout Manager <= 3.0.5 versi

Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.

Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.

Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.

Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.

Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.

Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.

Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.

NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows una

Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress <= 2.97.6 versions.

Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions.

Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions.