2026

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows atta

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows au

PDFunite 0.41.0 contains a buffer overflow vulnerability that allows local attackers to crash the application by process

librsvg2-bin 2.40.13 contains a buffer overflow vulnerability that allows local attackers to cause a denial of service b

Merge PACS 7.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions

AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adj

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to bypass

A security flaw has been discovered in NousResearch hermes-agent 0.8.0. This affects the function _check_sensitive_path

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to befo

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.8.0 to befo

Dell/Alienware Purchased Apps, versions prior to 1.1.31.0, contain an Improper Link Resolution Before File Access ('Link

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.0.0 to befo

A vulnerability was identified in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality

A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is an unkn

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 1.0.0 to befo

A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. Affected is the function save_menu of the file

A vulnerability has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This impacts the function dele

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects the function save_supplier

An authorization flaw in the user management command could allow an authenticated user to make limited changes to authen

Computing the MD5 checksum of a malformed BSON object under specific conditions may cause loss of availability in MongoD

A post-authentication Stack-based Buffer Overflow vulnerabilities in SonicOS allows a remote attacker to crash a firewal

A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted ser

A weakness has been identified in EyouCMS up to 1.7.9. Impacted is the function editFile of the file application/admin/l

Helpy contains a stored cross-site scripting vulnerability in the knowledge base Doc rendering logic. An authenticated a

Helpy contains a stored cross-site scripting vulnerability in the post author display logic. Any registered user can per

Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component. This vulnerability allows aut

A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute

A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scri

A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or

A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers t

Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis DeviceLock D

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 666.v6060de32f87d and earlier does not restrict the redirect URL

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers wi

Jenkins Matrix Authorization Strategy Plugin 2.0-beta-1 through 3.2.9 (both inclusive) invokes parameterless constructor

A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overa

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrec

Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Or

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper BetterDocs bette

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Image Wi

Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Sec

Server-Side Request Forgery (SSRF) vulnerability in ILLID Share This Image share-this-image allows Server Side Request F

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions

Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control S

The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a

Insufficient verification of data authenticity in PackageManagerService prior to SMR Mar-2026 Release 1 allows local att

Dell Disk Library for Mainframe, version(s) DLm 8700/2700 contain(s) a Server-Side Request Forgery (SSRF) vulnerability.