2026

An arbitrary file-write vulnerability in Pega Browser Extension (PBE) affects Pega Robot Studio developers who are autom

A Denial-of-Service (DoS) vulnerability in the httpd component of TP-Link's TD-W8961N v4.0 due to improper input sanitiz

A vulnerability has been found in erupts erupt up to 1.13.3. Affected by this issue is the function geneEruptHqlOrderBy

A hardcoded cryptographic key within the configuration mechanism on TP-Link Archer NX200, NX210, NX500 and NX600 enables

Improper input handling in a modem-management administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600

Improper input handling in a wireless-control administrative CLI command on TP-Link Archer NX200, NX210, NX500 and NX600

A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoin

A flaw has been found in erupts erupt bis 1.13.3. Affected by this vulnerability is the function EruptDataQuery of the f

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php`

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side reque

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint `plugin/Permissions/Vie

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the fix for CVE-2026-27568 (GHSA-rcq

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `view/forbiddenPage.php` and `vi

XnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file

XnSoft NConvert 7.230 is vulnerable to Stack Buffer Overrun via a crafted .tiff file.

A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows atta

A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allo

A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2. The troubleshooting actioner compo

A security vulnerability has been detected in kalcaddle kodbox 1.64. This impacts the function loginAfter/tfaVerify of t

A weakness has been identified in kalcaddle kodbox 1.64. This affects the function checkBin of the file /workspace/sourc

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/import.json.php` endpoi

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo's `_session_start()` function

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `createKeys()` function in the L

cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating

A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Recor

A stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Man

Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Recor

A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Manag

A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Manag

A security flaw has been discovered in kalcaddle kodbox 1.64. The impacted element is an unknown function of the file /w

Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP `on_publish` callback at `p

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `aVideoEncoderChunk.json.php` en

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `sanitizeFFmpegCommand()` functi

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AV

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Gallery plugin's `saveSort.json.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in AVideo's

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `POST /objects/aVideoEncoder.json.ph

A flaw was found in the GNU Binutils BFD library, a widely used component for handling binary files such as object files

A vulnerability was identified in kalcaddle kodbox 1.64. The affected element is the function PathDriverUrl of the file

Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1'

WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability exis

WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability

WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the Customiz

SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete d

Blob Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by prov

Liquid Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by pr

Luminance Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by

Paint Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by pro

Pixel Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by pro