2026

The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending du

An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site

An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions thr

Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.

An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without

An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing

An attacker with limited permissions may still be able to write files to specific locations on the device, potentially l

Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead

Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authenticatio

Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover cre

The device is deployed with weak and publicly known default passwords for certain hidden user levels, increasing the ris

Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete inst

Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially comprom

An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system dat

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modificatio

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Chec

Server-Side Request Forgery (SSRF) vulnerability in Sonatype Nexus Repository 3 versions 3.0.0 and later allows authenti

A potential vulnerability was reported in the BIOS of L13 Gen 6, L13 Gen 6 2-in-1, L14 Gen 6, and L16 Gen 2 ThinkPads wh

A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized us

A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass T

A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user t

A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read

An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow a

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to bli

A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to exe

SumatraPDF is a multi-format reader for Windows. In 3.5.2 and earlier, there is a Untrusted Search Path vulnerability wh

SOME/IP-SD protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service

BLF file parser crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service

HTTP3 protocol dissector infinite loop in Wireshark 4.6.0 to 4.6.2 allows denial of service

IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.2 and 4.4.0 to 4.4.12 allows denial of service

Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C

Shopware is an open commerce platform. From 6.7.0.0 to before 6.7.6.1, a regression of CVE-2023-2017 leads to an array a

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In 2.44.0 and ear

Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, an incomplete SQL injectio

Rocket.Chat is an open-source, secure, fully customizable communications platform. In Rocket.Chat versions up to 6.12.0,

Undici is an HTTP/1.1 client for Node.js. Prior to 7.18.0 and 6.23.0, the number of links in the decompression chain is

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the admi

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the admi

Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Edit

NVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command injection. A successful

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Face

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bou

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_th

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a race in the serial channel IRP threa

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in th

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive