2026

HTML injection vulnerability in Intermark IT's WebControl CMS v3.5. This vulnerability allows an attacker to send an ema

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time comple

Raytha CMS is vulnerable to SQL Injection within the OData filter parsing pipeline.  The vulnerability allows a remote,

PROMOD V is using insecure HTTP communication instead of HTTPS. The vulnerability is due to the lack of HTTPS support fr

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' produci

The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitr

Delta Electronics DVP12SE PLC exposes a Modbus TCP service over a specified port without authentication or access contro

Delta Electronics DVP12SE PLCs are susceptible to a resource allocation vulnerability without limits or throttling (CWE-

Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in leandrocp mdex allows cross-site scri

Uncontrolled Recursion vulnerability in leandrocp mdex allows denial of service via deeply nested Markdown input. mdex

Missing Release of Memory after Effective Lifetime vulnerability in leandrocp mdex and mdex_native allows an attacker wh

Allocation of Resources Without Limits or Throttling vulnerability in leandrocp MDEx allows Excessive Allocation. MDEx.

Memory Allocation with Excessive Size Value vulnerability in leandrocp mdex allows an unauthenticated attacker to cause

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx all

Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an improper digital signature verifica

SzafirHost verifies the downloaded native library archive with one JarFile parser (reading the Central Directory) but ex

The /v1/upload/sbom endpoint extracts the iss claim from the attacker-supplied JWT with signature verification disabled,

Eclipse tinydtls before commit b3efd41ad111a4920f599f51ffa4f5e9f1e72221 contains an out-of-bounds read vulnerability in

Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.9, Dragonfly has a RESP Proto

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the ac

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agent

An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against th

An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against th

HTMLy 3.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the RSS feed import functionality. The functi

A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911)

A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can exe

An access control deficiency vulnerability exists in ExpressUpdate Agent for Windows. If a malicious user gains access t

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patch

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a spec

SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptogra

Horner Automation Cscape versions prior to 10.2 SP3 are vulnerable to an Out-of-Bounds Read vulnerability through parsin

ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI

Outline is a service that allows for collaborative documentation. Prior to 1.8.0, the AuthenticationHelper.canAccess fun

Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't b

Missing authentication for critical function vulnerability in HYPR Passwordless on Windows allows Credentials Intercepti

Improper bounds validation in EmberZNet SDK versions 9.0.2 and earlier may result in crashes or dynamic memory leakage.

Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a success

Content injected to PDF rendering contexts could, in many places, include HTML content including <img> tags. If the src

Malicious HTML content could be injected into the content of a page in the pretix-pages plugin.

Malicious HTML content could be injected into the page pretix shows when redirection to an untrusted page occurs. Since

Malicious HTML content contained in the layout specification of a PDF ticket or badge layout was executed when the PDF

Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.

Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization o

Our payment integration with Computop-based payment methods did not properly validate payment status responses. An atta

Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacke

Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys