2026

e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset p

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the applicati

Files or Directories Accessible to External Parties, Server-Side Request Forgery (SSRF) vulnerability in Apache Flink Ku

An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1. The flaw ex

A high-severity vulnerability in the deployment of Genetec RabbitMQ that allows a privilege escalation attack.

A security flaw has been discovered in Das Parking Management System 停车场管理系统 6.2.0. This vulnerability affects unknown c

A vulnerability was identified in Das Parking Management System 停车场管理系统 6.2.0. This affects the function xp_cmdshell of

A vulnerability was determined in Acrel Electrical EEMS Enterprise Power Operation and Maintenance Cloud Platform 1.3.0.

A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the comma

luci-app-https-dns-proxy through 2025.12.29-5 — an optional LuCI web UI add-on for the https-dns-proxy package, distribu

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that

Karakeep is a elf-hostable bookmark-everything app. A Server-Side Request Forgery (SSRF) protection bypass vulnerability

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitra

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to exe

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scriptin

libyang before 5.2.6 contains a heap use-after-free write vulnerability in lyd_parser_set_data_flags that incorrectly up

gix-submodule before 0.29.0 (gitoxide before 0.5.21, gix before 0.84.0) incorrectly validates the update field in .gitmo

FreeRDP before 3.26.0 contains a heap-buffer-overflow vulnerability in gdi_CacheToSurface that allows remote attackers t

A vulnerability was found in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 10. Affected by thi

A vulnerability has been found in Totolink N300RH 6.1c.1353_B20190305. Affected is the function setPasswordCfg of the fi

A weakness has been identified in CodeAstro Leave Management System 1.0. The affected element is an unknown function of

A security flaw has been discovered in Squirrel up to 3.2. Impacted is the function ReadObject of the file squirrel/sqob

A vulnerability was identified in vllm-project vllm 0.19.0. This issue affects some unknown processing of the component

IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially craf

Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF). This issue affects Zoho Mail wo

A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with ed

A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw. An authenticated malicious

When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access

A Check Point HTTP-based service can incorrectly handle malformed HTTP requests. The issue is related to HTTP request pa

When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific

When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to r

The Security Gateway does not correctly validate a length value in certain IKE packets when NAT-T is used (4500/UDP). As

The VPN service may mishandle an unexpected IKE fragment value received on the IKE port 500/UDP during the early stage o

An Allocation of Resources Without Limits or Throttling vulnerability in the OPC-UA Server used in PPT30 Operating Syst

This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in SpabRice Nyla allows Code

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mas

MediaArea MediaInfoLib ID3v2 parsing heap buffer overflow vulnerability

MediaArea MediaInfoLib LXF parsing heap-based buffer overflow vulnerability

Missing Authorization vulnerability in Webful Creations RepairBuddy allows Exploiting Incorrectly Configured Access Cont

Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Config

The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited

The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged

The affected product extracts installation files to a temporary directory with incorrect default permissions during admi

The affected product creates a directory with insecure default permissions during administrative installation. This allo

Missing Authorization vulnerability in TeconceTheme Mayosis Core allows Exploiting Incorrectly Configured Access Control

A flaw has been found in Totolink CA750-PoE 6.2c.510. This affects the function setWiFiWpsConfig of the file /cgi-bin/cs

A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The impacted element is the function recvUpgradeNewFw of th

A security vulnerability has been detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUploa