2026

Vvveb CMS v1.0.8.2 contains a remote code execution vulnerability in its media management functionality where a missing

Vvveb CMS 1.0.8.2 contains a remote code execution vulnerability in its media upload handler that allows authenticated a

The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read and Deletion in all versions up to, and incl

Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and veri

NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Versions prior to 0.24.11 have a remotely triggera

NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related f

NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV)

The wpForo Forum plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to and including 3.0.5. Th

A vulnerability in the SQL Box in the admin interface of OTRS leads to an uncontrolled resource consumption leading to a

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing

Cross Site Scripting vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the ema

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 in the con

SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the

A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field that allows

GFI HelpDesk before 4.99.10 contains a stored cross-site scripting vulnerability in the Reports module where the title p

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the Troubleshooter module where the s

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editi

A vulnerability was found in ericc-ch copilot-api up to 0.7.0. The impacted element is the function cors of the file src

KissFFT before commit 8a8e66e contains an integer overflow vulnerability in the kiss_fftndr_alloc() function in kiss_fft

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release vers

Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a

Insecure Permissions vulnerability in DeepCool DeepCreative v.1.2.12 and before allows a local attacker to execute arbit

python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2,

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of Special Elements used i

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Commun

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation vulnerability. A high privi

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain a command injection vulnerability. A high privileged att

A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to

A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/mod

A security flaw has been discovered in erponline.xyz ERP Online up to 4.0.0. This vulnerability affects unknown code of

A vulnerability was identified in Z-BlogPHP 1.7.5. This affects the function App::UnPack of the file /zb_users/plugin/Ap

ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automa

Junrar is an open source java RAR archive library. Prior to version 7.5.10, a path traversal vulnerability in `LocalFold

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas`

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP f

Vvveb prior to 1.0.8.1 contains a code injection vulnerability in the installation endpoint where the subdir POST parame

Vvveb prior to 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media u

Vvveb prior to 1.0.8.1 contains a server-side request forgery vulnerability in the oEmbedProxy action of the editor/edit

Vvveb prior to 1.0.8.1 contains a privilege escalation vulnerability in the admin user profile save endpoint that allows

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 r