2026

A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon_check_session_url of the f

A vulnerability was found in EFM ipTIME A8004T 14.18.2. This impacts the function httpcon_check_session_url of the file

A vulnerability has been found in Free5GC pcf up to 1.4.1. This affects the function HandleCreateSmPolicyRequest of the

A flaw has been found in Open5GS up to 2.7.6. The impacted element is the function sgwc_tunnel_add of the file /src/sgwc

A vulnerability was detected in Open5GS up to 2.7.6. The affected element is the function sgwc_s5c_handle_create_bearer_

An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerabilit

A security vulnerability has been detected in Open5GS up to 2.7.6. Impacted is the function sgwc_s11_handle_create_indir

A weakness has been identified in Yealink MeetingBar A30 133.321.0.3. This issue affects some unknown processing of the

A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3. This vulnerability affects unknown code of the file

OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically mak

A vulnerability was identified in Zhong Bang CRMEB up to 5.6.3. This affects the function detail/tidyOrder of the file /

EPSON EasyMP Network Projection 2.81 contains an unquoted service path vulnerability in the EMP_NSWLSV service that allo

TFTP Turbo 4.6.1273 contains an unquoted service path vulnerability that allows local attackers to potentially execute a

DHCP Turbo 4.61298 contains an unquoted service path vulnerability that allows local attackers to potentially execute ar

BOOTP Turbo 2.0.1214 contains an unquoted service path vulnerability that allows local attackers to potentially execute

SpyHunter 4 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary cod

Iskysoft Application Framework Service 2.4.3.241 contains an unquoted service path vulnerability that allows local users

Deep Instinct Windows Agent 1.2.29.0 contains an unquoted service path vulnerability in the DeepMgmtService that allows

Veritas NetBackup 7.0 contains an unquoted service path vulnerability in the NetBackup INET Daemon service that allows l

Avast SecureLine 5.5.522.0 contains an unquoted service path vulnerability that allows local users to potentially execut

QWE DL 2.0.1 mobile web application contains a persistent input validation vulnerability allowing remote attackers to in

Banco Guayaquil 8.0.0 mobile iOS application contains a persistent cross-site scripting vulnerability in the TextBox Nam

WiFi File Transfer 1.0.8 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject

Webile 1.0.1 contains a directory traversal vulnerability that allows remote attackers to manipulate file system paths w

Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malic

BootCommerce 3.2.1 contains persistent input validation vulnerabilities that allow remote attackers to inject malicious

Knap Advanced PHP Login 3.1.3 contains a persistent cross-site scripting vulnerability that allows remote attackers to i

Stripe Green Downloads Wordpress Plugin 2.03 contains a persistent cross-site scripting vulnerability allowing remote at

Free Photo & Video Vault 0.0.2 contains a directory traversal web vulnerability that allows remote attackers to manipula

WebMO Job Manager 20.0 contains a cross-site scripting vulnerability in search parameters that allows remote attackers t

Simple CMS 2.1 contains a non-persistent cross-site scripting vulnerability in the preview.php file's id parameter. Atta

Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL c

Simple CMS 2.1 contains a persistent cross-site scripting vulnerability in user input parameters that allows remote atta

PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated

PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted paramete

PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users

PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and

Affiliate Pro 1.7 contains multiple reflected cross-site scripting vulnerabilities in the index module's input fields. A

Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modul

Ultimate POS 4.4 contains a persistent cross-site scripting vulnerability in the product name parameter that allows remo

Multiple payment terminal versions contain non-persistent cross-site scripting vulnerabilities in billing and payment in

Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword

SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior contain a path traversal vulnerability in the log

The Popup Box plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.1

The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix NULL fb and crtc dereferences on USB d

In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_de

In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: allow partial RX URB allocation to

In the Linux kernel, the following vulnerability has been resolved: btrfs: release path before iget_failed() in btrfs_r

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Pass netdev to mlx5e_destroy_netdev inst