2026

Improper access control in the WCF endpoint in Edgemo (now owned by Danoffice IT) Local Admin Service 1.2.7.23180 on Win

An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote

An input neutralization vulnerability in the Backup Configuration component of Crafty Controller allows a remote, authen

A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Re

An unrestricted upload of file with dangerous type vulnerability in the file upload function of Interinfo DreamMaker ver

A missing authentication for critical function vulnerability in the /servlet/baServer3 endpoint of Interinfo DreamMaker

Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telne

Tanium addressed an improper access controls vulnerability in Tanium Server.

A security flaw has been discovered in Tenda AC21 1.1.1.1/1.dmzip/16.03.08.16. The impacted element is the function mDMZ

A command injection vulnerability exists in nvm (Node Version Manager) versions 0.40.3 and below. The nvm_download() fun

A vulnerability was identified in Tenda AC21 16.03.08.16. The affected element is the function fromAdvSetMacMtuWan of th

PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route (`POST /api/

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6

Runtipi is a personal homeserver orchestrator. Starting in version 4.5.0 and prior to version 4.7.2, an unauthenticated

gradle-completion provides Bash and Zsh completion support for Gradle. A command injection vulnerability was found in gr

tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame

deepHas provides a test for the existence of a nested object key and optionally returns that key. A prototype pollution

Kimi Agent SDK is a set of libraries that expose the Kimi Code (Kimi CLI) agent runtime in applications. The vsix-publis

Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions up to and includin

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Li

TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In `tls_listener.rs`,

TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 1.8

malcontent discovers supply-chain compromises through. context, differential analysis, and YARA. Starting in version 0.1

A vulnerability was detected in D-Link DWR-M961 1.1.47. The impacted element is the function sub_4250E0 of the file /boa

A security vulnerability has been detected in D-Link DWR-M961 1.1.47. The affected element is an unknown function of the

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.

A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin

Tanium addressed an improper access controls vulnerability in Interact.

alsa-lib versions 1.2.2 up to and including 1.2.15.2, prior to commit 5f7fe33, contain a heap-based buffer overflow in t

Umbraco Forms is a form builder that integrates with the Umbraco content management system. It's possible for an authent

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prio

An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the passw

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to in

A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactica

A stack overflow in the mk_http_index_lookup function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to

An out-of-bounds read in the mk_mimetype_find function (mk_server/mk_mimetype.c) of monkey commit f37e984 allows attacke

An out-of-bounds read in the header_cmp function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows attackers

A NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984 allows att

An out-of-bounds read in the mk_vhost_fdt_close function (mk_server/mk_vhost.c) of monkey commit f37e984 allows attacker

A use-after-free in the mk_http_request_end function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to

A use-after-free in the mk_string_char_search function (mk_core/mk_string.c) of monkey commit f37e984 allows attackers t

An out-of-bounds read in the mk_ptr_to_buf in mk_core function (mk_memory.c) of monkey commit f37e984 allows attackers t

An out-of-bounds read in the http_parser_transfer_encoding_chunked function (mk_server/mk_http_parser.c) of monkey commi

birkir prime <= 0.4.0.beta.0 contains a cross-site request forgery vulnerability in its GraphQL endpoint that allows att

FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload S

A vulnerability was found in Tenda AX12 Pro V2 16.03.49.24_cn. Affected by this issue is some unknown functionality of t

A weakness has been identified in Totolink A7000R 4.1cu.4154. The impacted element is the function setUploadUserData of

An authenticated buffer handling flaw in TP-Link VIGI C385 V1 Web API lacking input sanitization, may allow memory corru