2026

A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function CommandHan

A vulnerability has been found in osuuu LightPicture up to 1.2.2. This issue affects some unknown processing of the file

A vulnerability was detected in PHPEMS 11.0. This affects the function temppage of the file /app/exam/controller/exams.m

A security vulnerability has been detected in Collabora KodExplorer up to 4.52. Affected by this issue is some unknown f

A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGr

A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file

A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/co

A vulnerability was determined in kodcloud KodExplorer up to 4.52. This affects the function share.class.php::initShareO

A vulnerability was found in EMQ EMQX Enterprise up to 6.1.0. The impacted element is an unknown function of the compone

A vulnerability has been found in H3C Magic B1 up to 100R004. The affected element is the function SetAPWifiorLedInfoByI

A flaw has been found in dameng100 muucmf 1.9.5.20260309. Impacted is the function getListByPage of the file /index/Sear

A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function edit_adminlogo of the file applicat

A security vulnerability has been detected in H3C Magic B0 up to 100R002. This vulnerability affects the function Edit_B

A weakness has been identified in Wavlink WL-WN579A3 220323. This affects the function sub_401F80 of the file /cgi-bin/l

The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi

protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers

The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `s

The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes

The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including

The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin

Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed

Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by th

UI / API User with asset materialize permission could trigger dags they had no access to. Users are advised to migrate t

In case of SQL errors, exception/stack trace of errors was exposed in API even if "api/expose_stack_traces" was set to f

An example of BashOperator in Airflow documentation suggested a way of passing dag_run.conf in the way that could cause

Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing t

In iTerm2 through 3.6.9, displaying a .txt file can cause code execution via DCS 2000p and OSC 135 data, if the working

The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to arbitrary file upload an

The Flipbox Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Flipbox widget

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via exter

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. P

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. P

SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. P

gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a Path Traversal attack

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

editorconfig-core-c is an EditorConfig core library for use by plugins supporting EditorConfig parsing. Versions up to

Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authen

Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand() is vulnerable

The Hostel plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode_id' parameter in all

The Youzify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkin_place_id' parameter in al

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 15 (Memo

Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenti

NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly. In versions prior to 0.24, Syscall 12 (Jump

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the Se

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the User Editor (UserEditor.php) rende

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the /api/public/user/login endpoint va

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (S

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the public API login endpoint (/api/pu

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the database backup restore functional

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the Pledge Editor renders donation com