2026

A security vulnerability has been detected in mingSoft MCMS up to 5.5.0. Impacted is the function list of the file net/m

A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchImage of the file net/

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs aga

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the AI plugin's `save.json.php` endp

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_corre

WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in t

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.ph

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that h

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.158, 25.0.92, a

The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5,

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. P

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.42, 3.6.11, and 3.7.0-ea.3, when `headerField

GlobaLeaks is free and open-source whistleblowing software. Prior to version 5.0.89, the /api/support endpoint of GlobaL

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Prior to version 9.

In Blog.Core through bcb4d17, the getinfobytoken API interface contains improper access control that leads to sensitive

Server-Side Request Forgery (SSRF) vulnerability exists in the AnnounContent of the /admin/read.php in OTCMS V7.66 and b

In its design for automatic terminal command execution, AI Code offers two options: Execute safe commands and execute al

The command auto-approval module in Axon Code contains an OS Command Injection vulnerability, rendering its whitelist se

A path traversal vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251

A testdata data-source can be used to trigger out-of-memory crashes in Grafana.

The OpenFeature feature toggle evaluation endpoint reads unbounded values into memory, which can cause out-of-memory cra

A resample query can be used to trigger out-of-memory crashes in Grafana.

When using public dashboards and direct data-sources, all direct data-sources' passwords are exposed despite not being u

A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impac

Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that

BS Producten Petcam 33.1.0.0818 is vulnerable to Incorrect Access Control. An unauthenticated attacker in physical proxi

A buffer overflow vulnerability exists in the ONVIF GetStreamUri function of LSC Indoor Camera V7.6.32. The application

A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover

Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Exte

ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 3.6.11 and 3.7.0-ea.2, Traefik's Knative provider

Cache misconfiguration vulnerability in OpenText Identity Manager on Windows, Linux allows remote authenticated users to

A user with permission "update world" in any Venueless world is able to exfiltrate chat messages from direct messages or

OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS command

Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network.

OS Command Injection vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to execute arbitrary OS command

Path Traversal vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to wtite over any file via network.

Missing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get a specific device infor

Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same aft

Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker w

Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension wi

Stack-based buffer overflow vulnerability in Softing Industrial Automation GmbH gateways allows overflow buffers. This i

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thales Sent

If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This l

A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably forma

Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount

Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands wi

Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can u