2026

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool (demo/LINUXTCP/port/porttcp.c). Th

IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (

dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. I

ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (espho

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO

Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all subm

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stat

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constr

A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to

nanoMODBUS through v1.23.0 contains an out-of-bounds stack read leading to a wild-pointer write in nmbs_read_device_iden

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus server-side handle_read_file_record function (F

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxe_mmap

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoin

In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or

The wp-downloadmanager WordPress plugin, in version 1.68.11 (also affecting the 6.9.4 release line), allows an admin-pri

toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands,

Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download

Firefly III's webhook URL validator (IsValidWebhookUrl.php) filters most private/reserved IPv4 ranges but contains an ex

299Ko's public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, f

Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw P

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role t

Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it s

Paperless-ngx's MailAccountViewSet.test action, when called with an existing account's ID and a masked password field, r

The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, dest

Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership

Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are mi

DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or sta

DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template const

DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sa

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incomi

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-sid

Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPubl

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output

MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decod

Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across

In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D re

In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` rec

In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlug

A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An

NeuVector through 5.4.9 is can potentially leak information from manager /network/graph API due to missing authenticatio

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Sit

Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cau

The ZTE Smart Life app contains an SQL injection vulnerability that allows attackers to execute UNION SELECT statements

A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cl