2026

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /c

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally s

An issue in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the content parameter is directly concaten

A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries admin

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker

An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker

An issue was discovered in openRISC OR1200 commit 83ac6b. A mismatch between the RTL and netlist can lead to unexpected

An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR c

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerabilit

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privil

A heap-based buffer overflow vulnerability exists in the Dia diagram editor WPG file format importer. In plug-ins/wpg/w

Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instan

The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution. The sqlResource.sql para

In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arb

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability. An unauthe

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerab

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability. An unauthentica

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS

The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection. The size parameter is directl

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerabi

Frappe is a full-stack web application framework written in Python and JavaScript. Prior to version 15.115.0, an access

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler

Fleet is an open-source device management platform built on osquery. In versions prior to 4.86.2, the Okta conditional a

Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used i

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. In order for

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrect

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as th

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple M

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through

In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null poi

Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection,

Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same

Stomper 5e2741e is vulnerable to Denial of Service. When a broker sends data to a client whose TCP connection was alread

stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP co