2026

Vulnerability in Spotfire Spotfire Enterprise (Spotfire Server modules), Spotfire Spotfire Enterprise with External Cons

Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule

A security issue exists within FactoryTalk® Services Platform (FTSP), allowing an attacker to bypass JWT signature valid

A denial-of-service security issue exists in 1734 POINT I/O™ module. The security issue stems from improper handling of

A denial-of-service issue exists in 5380/5480/5580 controllers. This vulnerability could potentially allow a malicious u

A denial-of-service issue exists in  5370/5570 controllers. This vulnerability could potentially allow a remote user to 

Out-of-bounds read vulnerability in Citrix Citrix Secure Access Client for Windows. This issue affects Citrix Secure Ac

Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowed

An attacker with access to an HX 10.0.0  and previous versions, may send specially-crafted data to the HX console. The m

A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible deb

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time

Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (

Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory

Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory o

Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in SUSE Virtual Machine Driver Pa

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user

HedgeDoc is an open source, real-time collaborative markdown notes application. Prior to 1.11.0, the GitHub Gist export

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attac

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, due to unsafe

ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (XSS) vulnerabilities

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This v

Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validat

Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload fu

Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located

Stored Cross-Site Scripting (XSS) vulnerability in the RD Station Conversas chat. The vulnerability resides in the ‘name

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Co

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.

A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint acce

The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitra

The charging station does not require authentication for Bluetooth commands to perform actions. The functionality expose

Various sensitive information such as passwords and charging card UIDs are written to log files.

The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the

The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such a

The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.

The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided b

In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by i

A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute

A Server-Side Request Forgery (SSRF) protection bypass existed in the html_to_markdown expansion module of misp-modules.

Parse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prior to 2.2.5, the GET

Frappe is a full-stack web application framework. Prior to 16.16.0 and 15.106.0, user enumeration could be performed via

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.15.0, every Phalcon MVC application built with a def

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.20.8 through 0.37.3, the Tilt HUD HTTP

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.24.0 through 0.37.3, the Tilt HUD WebS

Tilt defines dev environments as code for microservice apps on Kubernetes. From 0.19.5 through 0.37.3, the Tilt HUD serv

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Imp

Phalcon is a high-performance, full-stack PHP framework. Prior to 5.14.1, Phalcon\Encryption\Crypt::decrypt compares the