2026

Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to exe

A vulnerability was detected in NewType WebEIP up to 3.0. This affects an unknown part of the file /EIP_Com_FileList.asp

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, etc. WN529, WN53

A weakness has been identified in Razer RzUpdateService 1.10.14.0. Affected by this vulnerability is an unknown function

A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library A

A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android. This impacts the function D

A vulnerability was determined in GL.iNet GL-MT3000 up to 4.4.5. Affected is the function ovpn-client.get_recommend_conf

A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local a

Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may allow unauthenticat

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind cr

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when ev

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confin

@fastify/aws-lambda version 6.4.0 decorates each Fastify request with request.awsLambda.event and request.awsLambda.cont

Improper access control in the IRP_MJ_WRITE command interface in Wellbia XIGNCODE3 xhunter2.sys, version 2026.6.1.192,

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalatio

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm,

XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Si

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitra

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_fu

Admidio before 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs pe

Admidio versions before 5.0.11 contain a reflected cross-site scripting vulnerability in the SSO/SAML endpoint that echo

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only

Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role adm

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint

The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, th

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints,

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-s

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHea

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints

SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that r

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning end

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injecti

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication byp

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock

A vulnerability was found in GL.iNet GL-MT3000 up to 4.4.5. This impacts the function ovpn-client.check_config of the fi

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.s

Net::SAML2 versions before 0.86 for Perl allow authentication bypass because _verify_encrypted_assertion accepts an Encr

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xm

Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-em

HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using

HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular acce

Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integ

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the f

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_l

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Se