2026

The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an authentication bypass. An unauthenticated re

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the applicatio

Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it

Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows

Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run

Cross Site Scripting vulnerability in Follet School Solutions Destiny before v22.0.1 AU1 allows a remote attacker to run

A stored cross-site scripting (XSS) vulnerability exists in the notification panel of CTI Transmute in versions prior to

This vulnerability in Veeam Service Provider Console allows for remote code execution.

A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-base

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulne

Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-

OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication

RELATE is a web-based courseware package. Prior to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb, RELATE LMS configure

Pi.Alert is a WIFI / LAN intruder detector with web service monitoring. From 2024-06-29 to before 2026-05-07, the web ap

Budibase is an open-source low-code platform. Prior to 3.35.3, the VectorDB configuration endpoint in Budibase accepts

Budibase is an open-source low-code platform. Prior to 3.39.0, the executeQuery automation step in Budibase accepts a qu

Cinny is a Matrix client. Prior to 4.10.3, A remote authenticated attacker who shares a room with a victim and has permi

When creating an export through the pretix API, API clients are returned an UUID value for their export job (a long, ra

Webmin before 2.640 does not safely construct a filename for saving of an attachment within the mailboxes component. Thi

Nocturne Memory is a lightweight, rollbackable, and visual Long-Term Memory Server for MCP Agents. Prior to 2.4.1, when

In Slican telephone exchanges it is possible to manage the control panel remotely. An unauthenticated attacker can conne

In Slican telephone exchanges secure key is generated in a predictable manner using properties of the telephone exchange

Slican telephone exchanges allow administrative protocol authentication bypass. An attacker can bypass the need to enter

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in the Publish Audit API endpoints

In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-ch

GitLab MCP Server lets an AI agent talk directly to GitLab. Prior to 0.6.0, the HTTP transport in src/transport.ts ships

Uncontrolled Resource Consumption vulnerability in oban-bg oban_web ('Elixir.Oban.Web.CronExpr' modules) allows memory e

Missing Authorization vulnerability in oban-bg oban_web ('Elixir.Oban.Web.Jobs.DetailComponent' modules) allows unauthor

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, user passwords are stored using unsalted MD5 hashes

MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, SSRF via work_flow_template Import. Authenticated u

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a broken access control vul

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forge

MaxKB is an open-source AI assistant for enterprise. Prior to 2.8.1, MaxKB v2.8.0 and prior are vulnerable to a server-s

Kavita is a cross platform reading server. Prior to 0.9.0.2, an Improper Token validation flaw permits a remote and unau

Kavita is a cross platform reading server. Prior to 0.9.0, the download, size-check, and chapter metadata endpoints do n

Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [All

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go use

Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protec

A vulnerability in the Google Cloud Apigee SetIntegrationRequest policy allowed remote attackers to perform Server-Side

IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable for a NULL pointer dereferencing, if a specially craf

A heap-based buffer overflow vulnerability exists in XML parser functionality in the HiDraw. An authenticated malicious

The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scri

For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will au

Kenik Camera management Panel is vulnerable to Path Traversal vulnerability. An unauthenticated attacker can send GET re

OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID par

This vulnerability exists in CP Plus Wi-Fi Camera due to improper protection of sensitive information in runtime memory.

An OS Command Injection vulnerability exists in Aterm. If a malicious third person gains administrator access to the pro

A cross-site scripting vulnerability exists in Aterm. Arbitrary scripts may be executed in the web browser of a user acc