2026

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attribut

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Direct

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFr

A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-head

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint la

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /F

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface u

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session aft

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed th

A low privileged remote attacker can hijack an active administrative session without needing to know the administrator p

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/<filename>.php to ac

Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4

Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7

Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event"

An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execu

F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected

In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This a

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.

The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its a

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users wi

Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an at

The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoint

The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables,

The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route

The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includi

The Depicter — Popup & Slider Builder WordPress plugin before 4.8.0 does not validate the type of a file uploaded throug

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before

libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occur

In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, w

In binutils 2.46.1 and prior versions, a victim who opens a crafted PE file using binutils could execute arbitrary code

A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dial

A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the f

A vulnerability has been found in AeternaLabsHQ PullMD 3.2.0. This impacts an unknown function of the file /api of the c

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the functio

A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /pl

Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_pa

An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of th

A vulnerability was detected in code-projects Assessment Management 1.0. The affected element is an unknown function of

A flaw has been found in mruby 3.1.0. Affected is the function udiv of the file bigint.c. Executing a manipulation can l

Pcapng file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

X.509IF protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

H.245 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Bluetooth HFP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service