2026

A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Pr

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functiona

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository web

A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows

An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backu

An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Ba

A remote attacker with user privileges can exploit a stack buffer overflow in gdv-serverconfig to gain full system acces

A remote attacker with user privileges can exploit a stack buffer overflow in dali-devconfig to gain full system access

A remote attacker with user privileges can exploit a stack buffer overflow to gain full system access as root.

The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient

The ugw-logstop method allows a remote attacker with user privileges to terminate arbitrary processes due to insufficien

The ugw-restoreinfo method allows a remote attacker with user privileges to delete arbitrary local files due to insuffic

The ugw-restore method allows a remote attacker with user privileges to delete arbitrary local files due to insufficient

The ugw-logstop method allows a remote attacker with user privileges to delete arbitrary local files due to insufficien

The ugw-delete-file method allows a remote attacker with user privileges to delete arbitrary local files due to insuffi

The bac-scanresult method allows a remote attacker with user privileges to delete arbitrary local files due to insuffici

An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full a

A vulnerability has been found in cilium ebpf up to 0.21.0. This affects the function loadRawSpec of the file btf/btf.go

SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivilege

ZDRES-232: resolveProxyClass Not Overridden - acceptMatchers Filter Bypass via java.lang.reflect.Proxy Assessment: Ful

It is possible for an unauthenticated adjacent attacker to download log files of the controller, which may disclose some

Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affe

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Ma

Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. T

Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24

Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gatew

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague

Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization reque

In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to l

ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Manag

A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/datafram

A vulnerability was detected in SourceCodester Pizzafy E-Commerce System 1.0. Affected by this vulnerability is the func

A security vulnerability has been detected in EIPStackGroup OpENer up to 2.3.0. Affected is the function CreateMessageRo

Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter

Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref i

A vulnerability was detected in SourceCodester Online Food Ordering System 2.0. Affected by this issue is the function i

A security vulnerability has been detected in SourceCodester Online Boat Reservation System 1.0. Affected by this vulner

The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross-Site Request Forger

The Passeum Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and inclu

A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_patte

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function o

A vulnerability was identified in wonderwhy-er DesktopCommanderMCP 0.2.37. This affects the function readFileFromUrl of

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a sha

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users

When returning errors, functions in the net/textproto package would include its input as part of the error. This might a

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to versio

GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, a technician can store an XS