2026

aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system com

Cleartext Storage of Sensitive Information vulnerability in OpenText™ Vertica allows Retrieve Embedded Sensitive Data.  

A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of

A security vulnerability has been detected in itsourcecode School Management System 1.0. This issue affects some unknown

Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigge

A weakness has been identified in projectworlds House Rental and Property Listing 1.0. This vulnerability affects unknow

A vulnerability has been found in bolo-solo up to 2.6.4. This impacts the function importMarkdownsSync of the file src/m

A flaw has been found in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. This affects the function system of the file /b

A vulnerability was detected in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. The impacted element is the function che

Atomic Alarm Clock 6.3 contains a local privilege escalation vulnerability in its service configuration that allows atta

Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentia

Andrea ST Filters Service 1.0.64.7 contains an unquoted service path vulnerability in its Windows service configuration.

Outline Service 1.3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arb

OpenZ ERP 3.6.60 contains a persistent cross-site scripting vulnerability in the Employee module's name and description

Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicio

Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote at

Sellacious eCommerce 4.6 contains a persistent cross-site scripting vulnerability in the Manage Your Addresses module th

Forma.lms The E-Learning Suite 2.3.0.2 contains a persistent cross-site scripting vulnerability in multiple course and p

PHPFusion 9.03.50 contains a persistent cross-site scripting vulnerability in the print.php page that fails to properly

Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows at

fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based li

Vendure is an open-source headless commerce platform. Prior to version 3.5.3, the `NativeAuthenticationStrategy.authenti

ChurchCRM is an open-source church management system. Versions prior to 6.7.2 have a Stored Cross-Site Scripting (XSS) v

ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in endpoint `/PaddleNumEditor

A security vulnerability has been detected in itsourcecode Directory Management System 1.0. The affected element is an u

A weakness has been identified in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. Impacted is an unknown function of the

A security flaw has been discovered in Totolink A3600R 5.9c.4959. This issue affects the function setAppEasyWizardConfig

After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigb

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer

A vulnerability was identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_40AC74 of the comp

A vulnerability was found in Free5GC SMF up to 4.1.0. Affected by this issue is the function HandleReports of the file /

A flaw was found in Undertow. Servlets using a method that calls HttpServletRequestImpl.getParameterNames() can cause an

A vulnerability has been found in Free5GC SMF up to 4.1.0. Affected by this vulnerability is the function HandlePfcpSess

A flaw has been found in Free5GC SMF up to 4.1.0. Affected is the function HandlePfcpAssociationReleaseRequest of the fi

Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-s

Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access con

An LDAP Injection vulnerability in WatchGuard Fireware OS may allow a remote unauthenticated attacker to retrieve sensit

Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL.

Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can

Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files.

Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file r

Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can

Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input valida

Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Com

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull_request_tar

Dell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command

Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command

Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technolog

Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.

In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no