2026

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerabi

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of th

A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (l

Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the devic

ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() fu

A vulnerability has been found in CartoDB carto-api-client 0.5.29. This impacts the function addFilter of the file src/f

A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/e

A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spaw

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown function of the f

A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validate_path of th

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction

A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get/claw_net_post of th

A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of

A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function Ch

A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvo

A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the funct

A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file i

The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by c

A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This impacts the function matchesAllowlis

A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file

Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segme

OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData(

SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-n

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permi

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on em

SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to

SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows aut

SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain e

SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the

SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated

SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames agains

SurrealDB versions before 1.1.0 fail to enforce recursion depth limits when parsing nested SurrealQL statements includin

SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or names

SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing s

SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations,

SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when script

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls

SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing quer

SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope use

SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operati

SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY r

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owne

SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics whe

SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELE

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runti

Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: fro