2026

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated vi

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOr

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to

A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify w

A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted e

Thelia 2.6.1 contains an absolute path traversal vulnerability in its Smarty template handling that enables SSTI and rem

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without val

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenti

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “ne

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied in

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted

LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attac

LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet tha

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that a

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that a

LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XML

LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows aut

LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execu

A vulnerability has been found in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. Affected by this issue is the func

In Progress ShareFile Storage Zones Controller v5.12.6 and below, processing of queue items can send acknowledgements to

In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations a

jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to creat

jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-

jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to rea

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authentica

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unas

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to

jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to

MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators

MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to

yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to

TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler th

lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to

TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fiel

RT-Thread through 5.3.0 contains a memory corruption vulnerability in the legacy USB CDC virtual COM port driver that al

LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged user

Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler

A flaw has been found in Yungengxin Cloud Billing 2024.11.28.11. Affected by this vulnerability is the function sub_1400

A flaw has been found in Yungengxin Yun Jia Security Guard up to 2.7.1.9. Impacted is the function sub_14000885C in the

A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file

A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2. This vulnerability affects unknown cod

A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugi

A security flaw has been discovered in Zen Cart up to 2.2.2. Affected by this issue is some unknown functionality of the