2026

SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input valid

Spin is an open source developer tool for building and running serverless applications powered by WebAssembly. When Spin

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This

The Angular SSR is a server-rise rendering tool for Angular applications. Versions prior to 21.2.0-rc.1, 21.1.5, 20.3.17

The Angular SSR is a server-rise rendering tool for Angular applications. An Open Redirect vulnerability exists in the i

Improper Resource Shutdown or Release vulnerability in KrakenD, SLU KrakenD-CE (CircuitBreaker modules), KrakenD, SLU Kr

LiveCode is an open-source, client-side code playground. Prior to commit e151c64c2bd80d2d53ac1333f1df9429fe6a1a11, LiveC

An Insecure Temporary File vulnerability in openSUSE sdbootutil allows local users to pre-create a directory to achieve

Improper Control of Generation of Code ('Code Injection') vulnerability in OpenText™ Carbonite Safe Server Backup allows

The Print Service component of Fiserv Originate Loans Peripherals (formerly Velocity Services) in unsupported version 20

Aruba HiSpeed Cache (aruba-hispeed-cache) WordPress plugin versions prior to 3.0.5 contain a cross-site request forgery

Reflected Cross-Site Scripting (XSS) vulnerability in PideTuCita. This vulnerability allows an attacker to execute JavaS

Reflected Cross-Site Scripting vulnerability in SOTESHOP, version 8.3.4. THis vulnerability allows an attacker execute J

SQL injection vulnerability in Infoticketing. This vulnerability allows an unauthenticated attacker to retrieve, create

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/

Photobooth prior to 1.0.1 has a cross-site scripting (XSS) vulnerability in user input fields. Malicious users could inj

Predictable bucket naming in Vertex AI Experiments in Google Cloud Vertex AI from version 1.21.0 up to (but not includin

Certain Samsung MultiXpress Multifunction Printers may be vulnerable to information disclosure, potentially exposing add

HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and fa

The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax

An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs

An integer underflow vulnerability in Silicon Labs Secure NCP host implementation allows a buffer overread via a special

Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file mo

filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with APIs for building cryptographi

Buffer overflow in ovpn‑dco‑win version 2.8.0 allows local attackers to cause a system crash by sending too large packet

opa-envoy-plugun is a plugin to enforce OPA policies with Envoy. Versions prior to 1.13.2-envoy-2 have a vulnerability i

CediPay is a crypto-to-fiat app for the Ghanaian market. A vulnerability in CediPay prior to version 1.2.3 allows attack

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Delinea Cloud Suit

A SSRF and Arbitrary File Read vulnerability in AppSheet Core in Google AppSheet prior to 2025-11-23 allows an authentic

An authentication bypass vulnerability has been found in Thesamur's AutoGPT. This vulnerability allows an attacker to by

Reflected Cross-Site Scripting (XSS) vulnerability in '/index.php' in Lewe WebMeasure, which allows remote attackers to

Path traversal and content injection in JobRunnerBackground.aspx in DynamicWeb 8 (all) and 9 (<9.19.7 and <9.20.3) allow

OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw whic

Fileflows versions before 25.05.2 are affected by an authenticated SQL injection vulnerability in the library-file searc

Orthanc versions before 1.12.10 are affected by an authorisation logic flaw in the application's HTTP Basic Authenticati

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Delinea Inc. Cloud Suite and Pri

Improper Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Delinea Inc. Cloud Suite and Privile

Deserialization of Untrusted Data vulnerability in OpenText™ Directory Services allows Object Injection.  The vulnerabi

Path traversal vulnerability in the AMR Printer Management 1.01 Beta web service, which allows remote attackers to read

When hours are entered in time@work, version 7.0.5, it performs a query to display the projects assigned to the user. If

Cross-site scripting in REST Management Interface in Payara Server <4.1.2.191.54, <5.83.0, <6.34.0, <7.2026.1 allows an

Pega Platform versions 8.1.0 through 25.1.1 are affected by a Stored Cross-site Scripting vulnerability in a user interf

SQL injection vulnerability (SQLi) in Clicldeu SaaS, specifically in the generation of reports, which occurs when a prev

LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) d

The Micca KE700 system relies on a 6-bit portion of an identifier for authentication within rolling codes, providing onl

The Micca KE700 system contains flawed resynchronization logic and is vulnerable to replay attacks. This attack requires

The RF communication protocol in the Micca KE700 car alarm system does not encrypt its data frames. An attacker with a r

In the Linux kernel, the following vulnerability has been resolved: cgroup/dmem: fix NULL pointer dereference when sett

In the Linux kernel, the following vulnerability has been resolved: spi: tegra: Fix a memory leak in tegra_slink_probe(

In the Linux kernel, the following vulnerability has been resolved: btrfs: sync read disk super and set block size Whe