2026

An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module u

pandas-ai v3.0.0 was discovered to contain a SQL injection vulnerability via the pandasai.agent.base._execute_sql_query

An unauthenticated remote code execution (RCE) vulnerability exists in applications that use the Replicator node package

A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an authenticated, remote at

A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) could allow a

A vulnerability in the web interface of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an authenticated,

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with ad

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with ad

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with ad

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with re

A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unau

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with ad

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with ad

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with ad

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with ad

A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to co

A vulnerability in the configuration backup feature of Cisco Nexus Dashboard could allow an attacker who has the encrypt

A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthenticated, remote attac

A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to exe

There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows a

Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenti

Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticate

Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privi

Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administra

Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier all

Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an

Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote att

Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condition with resultant local privilege escalation to SYSTEM. Th

OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media loaders that accepts remote-host file

TOTOlink A3600R v5.9c.4959 contains a buffer overflow vulnerability in the setAppEasyWizardConfig interface of /lib/cste

The login mechanism of Sage DPW 2025_06_004 displays distinct responses for valid and invalid usernames, allowing enumer

The login mechanism of Sage DPW 2021_06_004 displays distinct responses for valid and invalid usernames, allowing enumer

A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Dat

A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0. The vulnerability is loc

A Reflected Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerabil

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to the lack of proper input vali

An arbitrary file overwrite vulnerability in Docudepot PDF Reader: PDF Viewer APP v1.0.34 allows attackers to overwrite

An arbitrary file overwrite vulnerability in Ora Tools PDF Reader ' Reader & Editor APPv4.3.5 allows attackers to overwr

Multiple stored cross-site scripting (XSS) vulnerabilities in the submit_add_user.asp endpoint of DDSN Interactive Acora

The King Addons for Elementor plugin for WordPress is vulnerable to multiple Contributor+ DOM-Based Stored Cross-Site Sc

pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current

A reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality of the VertiGIS FM solution a

A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can expl

A flaw was found in libinput. A local attacker who can place a specially crafted Lua bytecode file in certain system or

A flaw was found in Corosync. An integer overflow vulnerability in Corosync's join message sanity validation allows a re

A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Co

OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that al

ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that al

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validati