2026

Kenwood DNR1007XR JKGenService Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows loc

Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically pres

OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attacker

NoMachine getstat Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to e

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulne

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulne

Adminer multi_query Incorrect Check of Function Return Value Remote Code Execution Vulnerability. This vulnerability all

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This

Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability. This vulne

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This impacts the function sprintf of the file /cgi-bin/mbox-config?met

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affec

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0. The impacted elemen

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unkn

jsoup through 1.23.2, fixed in commit 862ba2f, contains an uncontrolled resource consumption vulnerability in XmlTreeBui

Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can

Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue

Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the

Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorizati

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. Thi

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. Thi

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. Thi

Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow

Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template inf

A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can coll

A security flaw has been discovered in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown fun

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown

A vulnerability was determined in GreyDGL PentestGPT up to 1.0.0. This vulnerability affects unknown code of the compone

A vulnerability was found in itsourcecode Hospital Management System 1.0. This affects an unknown part of the file /view

CVAT is an open source interactive video and image annotation tool for computer vision. From 2.68.0 until 2.70.0, the au

Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handleb

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching lan

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.start_tls in src/aiosmtplib

lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.def

EMQX is a scalable and reliable MQTT broker for AI, IoT, IIoT, and connected vehicles. Prior to versions 5.8.11, 5.9.3,

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-b

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-chec

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to achieve privilege escalation due to improp

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an impro

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper p

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a time-of-ch

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown func

@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary J

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administ

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows a

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authentica

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estonian Information Sys

ATutor is vulnerable to Reflected XSS via popup parameter in preview.php. An authenticated attacker can inject a double