2026

SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution.

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit

fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parse

A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_

A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the fil

A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function o

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. This issue affects

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unkn

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victi

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attac

4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remot

A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System

A weakness has been identified in ractivejs ractive up to 1.4.4. Impacted is the function Ractive#set of the component K

A security flaw has been discovered in alibaba-fusion next up to 1.27.34. This issue affects the function ConfigProvider

The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an impl

A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.exte

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unkn

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formCo

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output.

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate

exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, tot

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers t

A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/

A vulnerability was detected in Open5GS 2.8.0. This affects the function pcrf_rx_aar_cb of the file src/pcrf/pcrf-rx-pat

A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air

A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of th

A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknow

A vulnerability has been found in Tenda CH22 1.0.0.1. This affects the function formexeCommand of the file /goform/exeCo

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During Ju

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkificatio

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 1

Brave Popup Builder (brave-popup-builder) up to version 0.8.5 reflects UTM query parameters into popup form HTML without

A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formeditFileName of the

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of t

chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/ken

The Security Hardener plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including,

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS en

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but no

In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock regm

In the Linux kernel, the following vulnerability has been resolved: sched_ext: Skip sub-disable teardown for never-link

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primary_is_promisc under RTN

In the Linux kernel, the following vulnerability has been resolved: enic: fix tx_hang_reset use-after-free on device re

In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ip_vs_nat_icmp

In the Linux kernel, the following vulnerability has been resolved: accel/amxdna: Fix page-insertion errors in amdxdna_

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fw_tracer, return NULL on create error T

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfu

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf_iter_tcp_establ