2026

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and

File Thingie 2.5.7 is vulnerable to Directory Traversal. A malicious user can leverage the "create folder from url" func

File Thingie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "upload file" function

File Thinghie 2.5.7 is vulnerable to Cross Site Scripting (XSS). A malicious user can leverage the "dir" parameter of th

A vulnerability has been found in Tenda A18 Pro 02.03.02.28. Impacted is the function fromSetIpMacBind of the file /gofo

A flaw has been found in Tenda A18 Pro 02.03.02.28. This issue affects the function setSchedWifi of the file /goform/ope

DooTask v1.6.27 has a Cross-Site Scripting (XSS) vulnerability in the /manage/project/<id> page via the input field proj

A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator ac

A command injection vulnerability has been reported to affect QuNetSwitch. If a remote attacker gains a user account, th

A use of hard-coded credentials vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exp

A missing authentication for critical function vulnerability has been reported to affect QVR Pro. The remote attackers c

A command injection vulnerability has been reported to affect QuNetSwitch. The remote attackers can then exploit the vul

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains an admi

An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, th

An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a l

A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they c

An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora.

A buffer overflow vulnerability has been reported to affect Media Streaming Add-On. The remote attackers can then exploi

This vulnerability in AX53 v1, AX55 v4 and AX55 v4.6 results from insufficient input sanitization in the device’s probe

A command injection vulnerability on AX53 v1 occurs in mscd debug functionality due to insufficient input handling, allo

A vulnerability was detected in Tenda A18 Pro 02.03.02.28. This vulnerability affects the function form_fast_setting_wif

A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected is the function strcpy of the fil

Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authent

Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject

The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vuln

Bitcoin Core 0.13.0 through 29.x has an integer overflow.

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for cer

A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /gof

Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, t

Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unau

OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that al

Bitcoin Core through 29.0 allows a denial of service via a crafted transaction.

A vulnerability was found in D-Link DIR-513 1.10. This affects the function formEasySetPassword of the file /goform/form

A vulnerability has been found in itsourcecode College Management System 1.0. The impacted element is an unknown functio

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A cross-site request forgery (CSRF) vulnerability e

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. An XML External Entity (XXE) vulnerability exists i

An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability e

Zimbra Collaboration (ZCS) 10.0 and 10.1 contains an LDAP injection vulnerability in the Mailbox SOAP service within a F

Zimbra Collaboration Suite (ZCS) 10.0 and 10.1 contains a reflected cross-site scripting (XSS) vulnerability in the Clas

The error_description parameter is vulnerable to Reflected XSS. An attacker can bypass the domain's WAF using a Safari-s

An attacker can extract user email addresses (PII) exposed in base64 encoding via the state parameter in the OAuth callb

SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd.

Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-

WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS)

WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS)

WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vuln

WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL

ZITADEL is an open source identity management platform. Versions prior to 3.4.9 and 4.0.0 through 4.12.2 allowed users t

H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in t

Traefik is an HTTP reverse proxy and load balancer. Versions 2.11.40 and below, 3.0.0-beta1 through 3.6.11, and 3.7.0-ea