2026

Kingdia CD Extractor 3.0.2 contains a buffer overflow vulnerability in the registration name field that allows attackers

10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functiona

phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arb

File upload vulnerability in InvoicePlane through 1.6.3 allows authenticated attackers to upload arbitrary PHP files int

Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially comprom

An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system dat

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bou

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap use-after-free occurs in irp_th

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in th

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap-buffer-overflow occurs in drive

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not per

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a malicious RDP server can trigger a h

Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode wi

FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE().

A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-fa

The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remot

The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated rem

The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated rem

In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against

Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This

The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and

The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, an

Enclave is a secure JavaScript sandbox designed for safe AI agent code execution. Prior to 2.7.0, there is a critical sa

Webgrind 1.1 contains a remote command execution vulnerability that allows unauthenticated attackers to inject OS comman

Sysax Multi Server 6.95 contains a denial of service vulnerability in the administrative password field that allows atta

eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by ma

Explorer32++ 1.3.5.531 contains a buffer overflow vulnerability in Structured Exception Handler (SEH) records that allow

Inbit Messenger versions 4.6.0 to 4.9.0 contain a remote stack-based buffer overflow vulnerability that allows unauthent

Inbit Messenger 4.6.0 - 4.9.0 contains a remote command execution vulnerability that allows unauthenticated attackers to

Flame II HSPA USB Modem contains an unquoted service path vulnerability in its Windows service configuration. Attackers

WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipula

Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard

Audio Conversion Wizard v2.01 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code b

Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers

ImpressCMS 1.4.4 contains a file upload vulnerability with weak extension sanitization that allows attackers to upload p

Beehive Forum 1.5.2 contains a host header injection vulnerability in the forgot password functionality that allows atta

e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulner

Aero CMS 0.0.1 contains a SQL injection vulnerability in the author parameter that allows attackers to manipulate databa

VIAVIWEB Wallpaper Admin 1.0 contains an unauthenticated remote code execution vulnerability in the image upload functio

Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JW

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exis

Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allow

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet

An exposure of sensitive information to an unauthorized actor [CWE-200] vulnerability in Fortinet FortiFone 7.0.0 throug

Intermediate register values of secure workloads can be exfiltrated in workloads scheduled from applications running in

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix the crash issue for zero copy XDP_