2026

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, a Stored Cross-Site Scripting (XSS) vulnerability wa

WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an authenticated SQL Injection vulnerability was ide

WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability

SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scri

Pepr is a type safe K8s middleware. Prior to 1.0.5 , Pepr defaults to a cluster-admin RBAC configuration and does not ex

An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user i

Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload

wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could wri

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to mem

In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a

In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted

Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV expor

In cpm_fwtp_msg_handler of cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, there is a possible memory overwrite due to imprope

Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof

Disk Sorter Server 13.6.12 contains an unquoted service path vulnerability in its binary path configuration that allows

Spy Emergency 25.0.650 contains an unquoted service path vulnerability in its Windows service configurations that allows

Xmind 2020 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into mind ma

StudyMD 0.3.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts

SnipCommand 0.1.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into

Moeditor 0.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payload

Marky 0.0.1 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts i

Markright 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to embed malicious payloads

Markdownify 1.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payl

Markdown Explorer 0.1.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious code thr

Freeter 1.2.1 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads

Schlix CMS 2.2.6-6 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject ma

WifiHotSpot 1.0.0.0 contains an unquoted service path vulnerability in its WifiHotSpotService.exe that allows local atta

Sandboxie 5.49.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowin

DHCP Broadband 4.1.0.1503 contains an unquoted service path vulnerability in its service configuration that allows local

BOOTP Turbo 2.0.0.1253 contains an unquoted service path vulnerability in its Windows service configuration. Attackers c

WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash t

Acer Backup Manager 3.0.0.99 contains an unquoted service path vulnerability in the NTI IScheduleSvc service that allows

Acer Updater Service 1.2.3500.0 contains an unquoted service path vulnerability that allows local users to execute code

iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowin

Acer ePowerSvc 6.0.3008.0 contains an unquoted service path vulnerability that allows local users to potentially execute

DiskBoss Service 12.2.18 contains an unquoted service path vulnerability in its binary path configuration that allows lo

RarmaRadio 2.72.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowi

Ubee EVW327 contains a cross-site request forgery vulnerability that allows attackers to enable remote access without us

DupTerminator 1.4.5639.37199 contains a denial of service vulnerability that allows attackers to crash the application b

Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers

Authentication bypass in the password recovery feature of the local web interface across multiple VIGI camera models all

mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01

In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user

A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able

In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web

A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to

In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as a

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app