2026

SQL injection in the ‘two_steps_auth_code’ parameter processed by the ‘twoStepsAuthVerification’ function within the ‘/u

bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError

Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based

Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sa

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potentia

A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutra

phpMyFAQ is an open source FAQ web application. Prior to version 4.1.4, attachment passwords are hashed using SHA-1, a c

Routinator exits on any error when accepting incoming HTTP or RTR connections, including ones it can recover from such a

This vulnerability exists in Bagisto due to improper validation of user-supplied input in the ImageCacheController compo

An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper han

An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled

A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficie

A stack‑based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device

On Tapo C520WS v2, restricted accounts (for example, hub users) are intended to execute only a limited set of low‑sensit

A path traversal vulnerability exists in the Projects Service download endpoint shared by Altium Enterprise Server and A

Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file upl

A server-side request forgery (SSRF) vulnerability exists in a GraphQL service component shared by Altium Enterprise Ser

A path traversal vulnerability exists in the Altium Enterprise Server Collaboration Service due to improper handling of

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Versions prior to 26.0.0 suffer from an improper se

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 11.0.6 and prior to version 25.

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 25.0.0 and prior to version 26.

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability e

HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0

HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability e

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, the `hmacBase64()` functio

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vu

HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF)

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0

The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization chec

A Server-Side Request Forgery (SSRF) vulnerability in the custom process creation feature of linqi allows an authenticat

An Improper Authentication vulnerability in the /api/Cdn/GetFile endpoint of linqi allows unauthenticated, remote attack

In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 throug

The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a

OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site s

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior

The netty incubator codec.bhttp is a java language binary http parser. Prior to version 0.0.22.FInal, the codec-ohttp im

Froxlor is open source server administration software. In version 2.3.6 and earlier, the LOC record regex uses `\s+` whi

Froxlor is open source server administration software. Version 2.3.6 lets administrators configure `system.available_she

tarfile.data_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names,

A mass assignment vulnerability exists in the MISP user edit functionality due to insufficient filtering of user-supplie

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 are vulnerable t

This vulnerability exists in GX Earth 2022 ONT models due to the presence of hardcoded RSA private key within the device

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the password reset conf

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.1, a path traversal

This vulnerability exists in GX Earth ONT models due to the transmission of user credentials in plaintext over HTTP in i

This vulnerability exists in GX Earth ONT models due to improper handling of user-supplied input in multiple diagnostic

FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the Redirect module doe