2026

A flaw has been found in code-projects Online Music Site 1.0. This affects an unknown part of the file /Administrator/PH

A vulnerability was detected in AgiFlow scaffold-mcp up to 1.0.27. Affected by this issue is some unknown functionality

A security vulnerability has been detected in ErlichLiu claude-agent-sdk-master up to b185aa7ff0d864581257008077b4010fca

The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 Th

The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 T

In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments so that they can be passed to a

KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of th

In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histo

Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server co

Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate i

Penetration Testing engineers at Amazon have discovered a flaw where the camera system fails to properly handle data sup

A weakness has been identified in BrowserOperator browser-operator-core up to 0.6.0. Affected is the function startsWith

A vulnerability was determined in Artifex MuPDF up to 1.28.0. The impacted element is the function fz_subset_cff_for_gid

A vulnerability was found in SourceCodester Safety Anger Pad 1.0. The affected element is an unknown function. The manip

A vulnerability was found in code-projects Coaching Management System 1.0. This affects an unknown function of the file

The Check & Log Email WordPress plugin before 2.0.13 does not properly handle email replacement, which could allow unau

In Spring AI, various FilterExpressionConverter implementations accept a filter expression object and translate them to

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an applica

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function get_cart_coun

A vulnerability was detected in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function Login of the file

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. This issue affects the functi

A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function d

A security flaw has been discovered in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function delete_car

The Social Post Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Threads embed handler in

The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text'

The Timeline Blocks for Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'titleTag' a

OpenStack Ironic before 35.0.1 allows ipmitool execution in a non-default configuration that has a console interface.

In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_c

A vulnerability was identified in BigSweetPotatoStudio HyperChat up to 2.0.0-alpha.63. Affected by this issue is the fun

A vulnerability was determined in code-projects Coaching Management System 1.0. Affected by this vulnerability is an unk

A vulnerability was found in TencentCloudBase CloudBase-MCP up to 2.17.0. Affected is the function openUrl of the file m

A vulnerability has been found in jackwrichards FastlyMCP up to 6f3d0b0e654fc51076badc7fa16c03c461f95620. This impacts a

A flaw has been found in Totolink N300RT 3.4.0-B20250430. This affects an unknown function of the file /boafrm/formIpQoS

A vulnerability was detected in Totolink N300RT 3.4.0-B20250430. The impacted element is the function is_cmd_string_vali

A security vulnerability has been detected in Deepractice PromptX up to 2.4.0. The affected element is the function read

A weakness has been identified in donchelo processing-claude-mcp-bridge up to e017b20a4b592a45531a6392f494007f04e661bd.

A security flaw has been discovered in egtai gmx-vmd-mcp up to 0.1.0. This issue affects the function launch_vmd_gui_too

A post-authentication command injection vulnerability in the “DomainName” parameter of the DHCP configuration file in Zy

A post-authentication command injection vulnerability in the EasyMesh-related APIs of Zyxel DX3300-T0 firmware versions

A vulnerability was identified in eghuzefa engineer-your-data up to 0.1.3. This vulnerability affects the function read_

A vulnerability was detected in ef10007 MLOps_MCP 1.0.0. This impacts an unknown function of the file fastmcp_server.py

A security vulnerability has been detected in edvardlindelof notes-mcp up to 0.1.4. This affects an unknown function of

A weakness has been identified in dvladimirov MCP up to 0.1.0. The impacted element is the function GitSearchRequest of

A security flaw has been discovered in dubydu sqlite-mcp up to 0.1.0. The affected element is the function extract_to_js

A vulnerability was identified in duartium papers-mcp-server 9ceb3812a6458ba7922ca24a7406f8807bc55598. Impacted is the f

A vulnerability was determined in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setPptpServerCfg

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterR

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the

A command injection vulnerability exists in the web server of specific firmware versions of Milesight cameras.

Specific firmware versions of Milesight AIOT cameras use SSL certificates with default private keys.