2026

A local information disclosure vulnerability exists in the Ludashi driver before 5.1025 due to a lack of access control

File upload vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute code through the MSL eng

Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary

File upload vulnerability in Omnispace Agora Project before 25.10 allowing authenticated, or under certain conditions al

Directory traversal vulnerability in Omnispace Agora Project before 25.10 allowing unauthenticated attackers to read fil

GLPI is a free asset and IT management software package. Prior to 10.0.21 and 11.0.3, an unauthorized user can access GL

A local privilege escalation vulnerability exists during the installation of Epic Games Store via the Microsoft Store. A

Tagstoo 2.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious payloads th

ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP

Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that

Cyberfox Web Browser 52.9.1 contains a denial of service vulnerability that allows attackers to crash the application by

Cmder Console Emulator 1.3.18 contains a buffer overflow vulnerability that allows attackers to trigger a denial of serv

Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the 'eidValue' parameter of the login

Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl par

YouTube Video Grabber, now referred to as YouTube Downloader, 1.9.9.1 contains a buffer overflow vulnerability that allo

Kingdia CD Extractor 3.0.2 contains a buffer overflow vulnerability in the registration name field that allows attackers

Dynojet Power Core 2.3.0 contains an unquoted service path vulnerability in the DJ.UpdateService that allows local authe

10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functiona

RDP Manager 4.9.9.3 contains a denial of service vulnerability in connection input fields that allows local attackers to

Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, cu

ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows re

10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServ

Kmaleon 1.1.0.205 contains an authenticated SQL injection vulnerability in the 'tipocomb' parameter of kmaleonW.php that

AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by

AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by

Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inje

HTTPDebuggerPro 9.11 contains an unquoted service path vulnerability that allows local attackers to potentially execute

MilleGPG5 5.7.2 contains a local privilege escalation vulnerability that allows authenticated users to modify service ex

MTPutty 1.0.1.21 contains a sensitive information disclosure vulnerability that allows local attackers to view SSH conne

Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attac

Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup res

Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrar

Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settin

phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arb

AWebServer GhostBuilding 18 contains a denial of service vulnerability that allows remote attackers to overwhelm the ser

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML

A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogX

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the wanSpeed parameter of the sub_65B5C function. T

Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the cloneType parameter of the sub_65B5C function.

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files int

Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the

An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" para

An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a pro

Certain error messages returned by the application expose internal system details that should not be visible to end user

The application discloses all used components, versions and license information to unauthenticated actors, giving attack

Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft throu

Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through

The AffiliateX – Amazon Affiliate Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to

The Supreme Modules Lite plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and includin