2026

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HT

The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management inte

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access

The affected Ebyte device web management interface does not restrict the interface from being rendered within an extern

go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability. The NewAuthorizer() function in app/admin/s

A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An at

A SQL injection vulnerability was found in YzmCMS 7.5. The issue occurs in the get_arrchildid() function within applicat

The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload

The static resource interface /api/static/{deployKey}/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The us

Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the r

A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web manag

Ebyte device web management interface does not consistently enforce authentication before granting access to administra

Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control.

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacke

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level atta

Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker to deliver a payload that

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, th

Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to s

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. I

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. T

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2

Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2

An integer overflow in the target_sws_fuzzer() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows atta

An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attacke

An integer overflow in the libswscale/utils.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denia

A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allo

An integer overflow in the yuv2planeX_8_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attacke

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd

A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allo

An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a D

PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on th

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker

In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2

Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-d

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 al

A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an e

A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 thr

A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminal

A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description

Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers with

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() in htdocs

Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with

A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management