2026

An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept

A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary

A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Autho

An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, crea

A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control

An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execut

A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and down

A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker t

A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to injec

A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated remote attacker to d

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated rem

A server-side request forgery (SSRF) vulnerability in automatisch through commit 41f3c56 allows a low-privileged authent

A SQL injection vulnerability in Tencent APIJSON through 8.1.8 allows unauthenticated remote attackers to bypass per-tab

An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to aut

GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to a

GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function compute

GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. Whe

GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index b

Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP

GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When list

GNU cpio is vulnerable to an uncontrolled memory allocation in the make_path function at src/makepath.c. The function us

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar arch

UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.  Note:  UnixAuth is NOT a recommended option f

Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0,

TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to v

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets v

A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote

Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgra

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. U

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to v

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. Thi

Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute ar

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to caus

A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operati

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unaut

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or alt

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password ma

The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affec

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket privat

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle at

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to th

DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activi

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log informatio

Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information

Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.

Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.