2026

A weakness has been identified in Dolibarr up to 23.0.4. This affects an unknown part of the file htdocs/user/card.php o

A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the fil

SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing aut

Using untrusted, non-normalized input as-is for metrics data (such as metric names, tag keys, or tag values) is a danger

Improper authentication in the agent receiver of Checkmk <2.5.0p10 allows an unauthenticated remote attacker to bypass m

Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86

A denial-of-service vulnerability was identified in misp-stix when processing attacker-controlled STIX 1 or STIX 2 docum

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-ST

A vulnerability was identified in CodeAstro Online Job Portal 1.0. Affected by this vulnerability is an unknown function

An application using Micrometer Tracing with W3C baggage propagation in the Brave bridge is vulnerable to denial of serv

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vu

Command Injection in BOSH CLI tool on windows in Cloud Foundry allows a remote attacker to execute arbitrary shell comma

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoofing, XML Injection. This vu

Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows Content Spoof

A vulnerability in misp-stix could allow a crafted STIX document to influence security-sensitive MISP attribute metadata

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only o

Certificate validation failures in SAML authentication in Apache CloudStack 4.20.3.0 and 4.22.1.0 on all platforms allow

Improper access control in CloudStack's annotation functionality allows unauthorized comment creation and disclosure.

Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack

Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by def

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Webhook module while lis

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent

Improper Access Control vulnerability in Apache CloudStack's Kubernetes Service (CKS) plugin, allowing cross-tenant mani

Authenticated pre-validation SSRF vulnerability in Apache CloudStack's template and ISO registration functionality. Whe

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache CloudStack's

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Lock User Functionality. Th

Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password func

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth2 authentication pl

Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of t

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's LDAP authentication plug

Cleartext Storage of Sensitive Information vulnerability in Apache CloudStack with AsyncJob storage in the database. Th

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plu

Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's U

SSRF via Metalink Mirror URL Resolution: An authenticated tenant can register a template pointing to an attacker-contro

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Cloud

The Automation Web Platform – Notifications and OTP for WooCommerce, Advanced Country Code plugin for WordPress is vulne

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary scrip

Missing authentication for critical function vulnerability in IKAS Technology Inc. Rush allows Fake the Source of Data.

Execution after redirect (EAR) vulnerability in FuyaWeb Internet and Informatics Services ArchitectPanel Web Admin Panel

The AI Engine WordPress plugin before 3.6.1 does not verify that the requesting user is authorized to act on the target

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allo

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplic

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not validate the final na

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its p

The Media Library Assistant WordPress plugin before 3.40 does not validate a search parameter before concatenating it in

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a c

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly ch

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not restrict acc

The Link Whisper Free WordPress plugin before 0.9.7 does not properly sanitize and escape a parameter before using it in