2026

A vulnerability was determined in itsourcecode School Management System 1.0. This affects an unknown function of the fil

Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) att

A vulnerability was found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/f

TapinRadio 2.12.3 contains a denial of service vulnerability in the application proxy username configuration that allows

TapinRadio 2.12.3 contains a denial of service vulnerability in the application proxy address configuration that allows

AbsoluteTelnet 11.12 contains a denial of service vulnerability in the SSH2 username input field that allows local attac

AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by

AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by

QuickDate 1.3.2 contains a SQL injection vulnerability that allows remote attackers to manipulate database queries throu

Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability in the registration key input that allows attacke

Wedding Slideshow Studio 1.36 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code b

SprintWork 2.3.1 contains multiple local privilege escalation vulnerabilities through insecure file, service, and folder

Parallaxis Cuckoo Clock 5.0 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by

DBPower C300 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers to retrie

Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash th

eLection 2.0 contains an authenticated SQL injection vulnerability in the candidate management endpoint that allows atta

ATutor 2.2.4 contains a SQL injection vulnerability in the admin user deletion page that allows authenticated attackers

ACE Security WiP-90113 HD Camera contains a configuration disclosure vulnerability that allows unauthenticated attackers

AMSS++ version 4.31 contains a SQL injection vulnerability in the mail module's maildetail.php script through the 'id' p

AMSS++ 4.7 contains an authentication bypass vulnerability that allows attackers to access administrative accounts using

SpotFTP-FTP Password Recover 2.4.8 contains a denial of service vulnerability that allows attackers to crash the applica

aSc TimeTables 2020.11.4 contains a denial of service vulnerability that allows attackers to crash the application by ov

Core FTP LE 2.2 contains a denial of service vulnerability that allows attackers to crash the application by overwriting

Business Live Chat Software 1.0 contains a cross-site request forgery vulnerability that allows attackers to change user

Cyberoam Authentication Client 2.1.2.7 contains a buffer overflow vulnerability that allows remote attackers to execute

Wing FTP Server versions prior to 6.2.7 contain a cross-site request forgery (CSRF) vulnerability in the web administrat

A vulnerability has been found in UTT 进取 520W 1.7.7-180627. The affected element is the function strcpy of the file /gof

Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's

3DP-MANAGER is an inbound generator for 3x-ui. In version 2.0.1 and prior, the application automatically creates an admi

Nebula is a scalable overlay networking tool. In versions from 1.7.0 to 1.10.2, when using P256 certificates (which is n

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a denial of service (DoS) vuln

Spree is an open source e-commerce solution built with Ruby on Rails. Prior to versions 5.0.8, 5.1.10, 5.2.7, and 5.3.2,

AdonisJS is a TypeScript-first web framework. Prior to versions 10.1.3 and 11.0.0-next.9, a prototype pollution vulnerab

Vim is an open source, command line text editor. Prior to version 9.1.2132, a heap buffer overflow vulnerability exists

DataHub is an open-source metadata platform. Prior to version 1.3.1.8, the LDAP ingestion source is vulnerable to MITM a

A flaw has been found in ggml-org llama.cpp up to 55abc39. Impacted is the function llama_grammar_advance_stack of the f

A vulnerability was detected in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/for

OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injec

OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an arbitrary

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.6.11, a path traversal in th

Spree is an open source e-commerce solution built with Ruby on Rails. A critical IDOR vulnerability exists in Spree Comm

NiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filen

Payload is a free and open source headless content management system. Prior to 3.74.0, a cross-collection Insecure Direc

Payload is a free and open source headless content management system. Prior to 3.73.0, when querying JSON or richText fi

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.10.1, the existing layers o

NiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown conte

Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping accepts an

BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-auth

The Agentspace service was affected by a vulnerability that exposed sensitive information due to the use of predictable

Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large person