2026

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained b

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly

When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadver

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Est

When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the pu

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingH

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

A vulnerability was identified in code-projects Intern Membership Management System 1.0. Affected by this vulnerability

A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function

A vulnerability was found in code-projects Intern Membership Management System 1.0. This impacts an unknown function of

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data d

A vulnerability has been found in code-projects Intern Membership Management System 1.0. This affects an unknown functio

A flaw has been found in code-projects Intern Membership Management System 1.0. The impacted element is an unknown funct

The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which ma

A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of

The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and inclu

The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vul

The WP Cost Estimation plugin for WordPress is vulnerable to arbitrary file uploads and deletion due to missing file typ

Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a crit

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection

Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Op

The WP Cost Estimation plugin for WordPress is vulnerable to Upload Directory Traversal in versions before 9.660 via the

Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection

n8n is an open source workflow automation platform. In versions 0.121.2 and below, an authenticated attacker may be able

Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (R

ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#187 and below allow an attacker to perform Blind

llama.cpp is an inference of several LLM models in C/C++. In commits 55d4206c8 and prior, the n_discard parameter is par

Mailpit is an email testing tool and API for developers. Versions 1.28.0 and below have a Server-Side Request Forgery (S

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker t

Titra is open source project time tracking software. In versions 0.99.49 and below, an API has a Mass Assignment vulnera

Titra is open source project time tracking software. Versions 0.99.49 and below have Improper Access Control, allowing u

A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client

INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that ca

Smartliving SmartLAN/G/SI <=6.x contains an unauthenticated server-side request forgery vulnerability in the GetImage fu

SmartLiving SmartLAN <=6.x contains an authenticated remote command injection vulnerability in the web.cgi binary throug

V-SOL GPON/EPON OLT Platform v2.03 contains multiple reflected cross-site scripting vulnerabilities due to improper inpu

V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to manipu

Yahei-PHP Prober 0.4.7 contains a remote HTML injection vulnerability that allows attackers to execute arbitrary HTML co

FaceSentry Access Control System 6.4.8 contains a cleartext password storage vulnerability that allows attackers to acce

FaceSentry Access Control System 6.4.8 contains a cleartext transmission vulnerability that allows remote attackers to i

FaceSentry Access Control System 6.4.8 contains a cross-site scripting vulnerability in the 'msg' parameter of pluginIns

SOCA Access Control System 180612 contains a cross-site scripting vulnerability in the 'senddata' POST parameter of logg

NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking

Leica Geosystems GR10/GR25/GR30/GR50 GNSS 4.30.063 contains a cross-site request forgery vulnerability that allows attac

devolo dLAN Cockpit 4.3.1 contains an unquoted service path vulnerability in the 'DevoloNetworkService' that allows loca