2026

A local attacker on a multi-user host can pre-create the deterministic cache path and plant a malicious ONNX model file.

Analyzing a PDF with a deeply nested or cyclic table of contents can cause a StackOverflowError in the ingestion thread.

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown functio

A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter

The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is

disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control. The config-fet

Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.

Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().

The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerab

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable t

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable t

HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of se

HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow

HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allo

A flaw has been found in itsourcecode Payroll System 1.0. The impacted element is the function create/read/update/delete

SeaweedFS is a distributed storage system for files and blobs. In versions prior to 4.40, an authenticated S3 principal

SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler

SeaweedFS is a distributed storage system for files and blobs. In versions from 3.88 through 4.39, the SFTP server evalu

SeaweedFS is a distributed storage system for files and blobs. In versions 4.39 and earlier, the S3 API accepts an exter

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new F

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints i

The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanis

In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitra

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacemen

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as r

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticate

A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.

A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13

A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnera

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerabil

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity w

HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when i

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation wor

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid f

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which l

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize th

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/web