2026

An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive infor

An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext password

An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server wi

An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write a

Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code throug

A vulnerability has been identified in Heliox Flex 180 kW EV Charging Station (All versions < F4.11.1), Heliox Mobile DC

CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code exec

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that co

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine

CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administr

The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.

Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/events_function.php, the event par

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-a

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.20, OneUptime Synthetic Monitors allo

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback t

facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , stored XSS (also known as

facileManager is a modular suite of web apps built with the sysadmin in mind. Prior to 6.0.4 , a reflected XSS occurs wh

Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to 2.1.1, a stored XSS can be i

Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their ni

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members

WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns al

PowerSync Service is the server-side component of the PowerSync sync engine. In version 1.20.0, when using new sync stre

SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoin

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulne

If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low pr

Kubewarden is a policy engine for Kubernetes. Kubewarden cluster operators can grant permissions to users to deploy name

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, th

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. From 2.0.0 to befo

InstantCMS is a free and open source content management system. Prior to 2.18.1, InstantCMS does not validate CSRF token

Multiple i-フィルター products are configured with improper file access permission settings. Files may be created or overwrit

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular us

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user p

Due to missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal, a user with high privileges cou

Due to a Missing Authorization Check in SAP Business Warehouse (Service API), an authenticated attacker could perform un

SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content

SAP NetWeaver Feedback Notifications Service contains a SQL injection vulnerability that allows an authenticated attacke

SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated

SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP reques

SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks f

The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational d

Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute

Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute

The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthoriz

The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthoriz

The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which coul

The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.

Due to insufficient validation of user-controlled input in the URLs query parameter. SAP Business One Job Service could

Affected Product(s)Version(s)InfoSphere Data Architect9.2.1

IBM Planning Analytics Advanced Certified Containers 3.1.0 through 3.1.4 could allow a local privileged user to obtain s

Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Seri