2026

A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/up

A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on L

An information disclosure vulnerability exists in the /srvs/membersrv/getCashiers endpoint of the Aptsys gemscms backend

An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backen

A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testin

A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to t

A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers

An OS command injection vulnerability in the com.sprd.engineermode component in Doogee Note59, Note59 Pro, and Note59 Pr

Incorrect access control in the selectDept function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily access

Incorrect access control in the update function of RuoYi v4.8.2 allows unauthorized attackers to arbitrarily modify data

Incorrect access control in the authRoutes function of SpringBlade v4.5.0 allows attackers with low-level privileges to

The All-in-One Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in

The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when seria

LavaLite CMS versions up to and including 10.1.0 contain a stored cross-site scripting vulnerability in the package crea

A reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary

Improper permissions in the handler for the Custom URL Scheme in ToDesktop Builder v0.33.0 allows attackers with rendere

An improper certificate validation vulnerability exists in ToDesktop Builder v0.32.1 This vulnerability allows an unauth

An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication

BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authe

MyBB Delete Account Plugin 1.4 contains a cross-site scripting vulnerability in the account deletion reason input field.

PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execut

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app con

YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read l

Epson USB Display 1.6.0.0 contains an unquoted service path vulnerability in the EMP_UDSA service running with LocalSyst

PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the address parameter of the change_params.p

PDF Complete Corporate Edition 4.1.45 contains an unquoted service path vulnerability in the pdfcDispatcher service that

Nsauditor 3.2.2.0 contains a denial of service vulnerability that allows attackers to crash the application by overwriti

Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the ap

AgataSoft PingMaster Pro 2.1 contains a denial of service vulnerability in the Trace Route feature that allows attackers

PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the 'Comments / Special Instructions' parame

Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network p

LogonExpert 8.1 contains an unquoted service path vulnerability in the LogonExpertSvc service running with LocalSystem p

Softros LAN Messenger 9.6.4 contains an unquoted service path vulnerability in the SoftrosSpellChecker service that allo

Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in u

dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to over

MyBB Trending Widget Plugin 1.2 contains a cross-site scripting vulnerability that allows attackers to inject malicious

MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scripting vulnerability in the custom text input field for threa

In the Linux kernel, the following vulnerability has been resolved: ublk: fix use-after-free in ublk_partition_scan_wor

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_

In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL ptr issue after soft reset

In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from mon_handle_a

In the Linux kernel, the following vulnerability has been resolved: libceph: make free_choose_arg_map() resilient to pa

In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply

In the Linux kernel, the following vulnerability has been resolved: nfsd: check that server is running in unlock_filesy

In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not chang

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_api: avoid dereferencing ERR_PTR in

In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix race condition for gdev->srcu If two

In the Linux kernel, the following vulnerability has been resolved: idpf: Fix RSS LUT NULL pointer crash on early ethto

In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in h