2026

SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attacker

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTAgent is vulnerable t

PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, there is an arbitrary fi

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.

HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) befo

HCL BigFix Service Management (SM) is affected by use of a vulnerable WSGI Server was identified. Deploying an outdated

A vulnerability was determined in Dotouch XproUPF 2.0.0-release-088aa7c4. Affected is an unknown function of the compone

Open edX Platform enables the authoring and delivery of online learning at any scale. The HTML sanitizer clean_thread_ht

This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS T

A privacy issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.5 and iPadOS 26.5. An attac

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME t

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, an ap

HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certai

Claude HUD through 0.0.12, patched in commit 234d9aa, constructs OSC 8 terminal hyperlink escape sequences using raw cwd

An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due t

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single_unit.php that allows a

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in single.php that allows authen

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_note.php that allows auth

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_JF.php that allows au

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in opena.php that allows authent

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_facnote.php that allows a

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in street_view.php that allows a

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_nm.php that allows aut

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in do_unit_mail.php that allows

Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in search.php that allows authen

RT is an open source, enterprise-grade issue and ticket tracking system. Versions prior to 5.0.10 and 6.0.0 through 6.0.

Missing password field masking vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view, Hi

pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed t

A path traversal vulnerability was identified in Kibana's dashboard management functionality. An authenticated user with

Uncontrolled resource consumption in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025

Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout Bobber + Tech 2025 model year allow

Improper handling of physical conditions in the bike-shutdown control of the Indian Motorcycle Scout Bobber + Tech 2025

Nextcloud is an open source content collaboration platform. From version 33.0.0 to before version 33.1.0, after unlockin

Nextcloud is an open source content collaboration platform. From version 1.3.6 to before version 8.4.0, an improper chec

GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations t

The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configu

A lack of runtime integrity in GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass file system read-only pr

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a networ

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0

Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML int