2026

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval b

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior implement an authentication token (X

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior ship with default credentials that a

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requirin

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker could exploit

Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Client-Side Enforcement of Server-Side Security vulnera

Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Improper Neutralization of Input During Web Page Gener

Dell Wyse Management Suite, versions prior to WMS 5.5, contain an Unrestricted Upload of File with Dangerous Type vulner

Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability. A low privileged a

A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to acc

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could

Local privilege escalation in Genetec Update Service. An authenticated, low-privileged, Windows user could exploit this

Local admin could to leak information from the Genetec Update Service configuration web page. An authenticated, admin pr

Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval b

NiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side

Altec DocLink (now maintained by Beyond Limits Inc.) version 4.0.336.0 exposes insecure .NET Remoting endpoints over TCP

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Linksys MR9600, Linksys

Piwigo is an open source photo gallery application for the web. In version 15.5.0 and likely earlier 15.x releases, the

A vulnerability identified in the HX Agent driver file fekern.sys allowed a threat actor with local user access the abil

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's FastCGI path splitting

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the local caddy admin API (def

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request ma

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `path` request ma

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `Clien

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, the path sanitization routine

NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. The WebSockets handling

Multiple Finka programs use hard-coded Firebird database credentials (shared across all instances of this software). A m

Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the sec

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior do not implement rate limiting or accoun

Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side c

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior use RC4 with a hard-coded key embedded i

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior lack CSRF protections for state-changing

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior reflect unsanitized user input in the we

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior expose user passwords in plaintext withi

Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 generate predictable numeric session ide

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain hard-coded administrative creden

Binardat 10G08-0800GSM network switch firmware version V300SP10260209 and prior contain a command injection vulnerabilit

FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnera

Privilege escalation and improper access control in GCOM EPON 1GE C00R371V00B01 allows remote authenticated users to mod

Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software

A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the fil

A vulnerability was found in Intelbras TIP 635G 1.12.3.5. This vulnerability affects unknown code of the component Ping

WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a

Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualB

WWBN AVideo is an open source video platform. Prior to version 21.0, AVideo allows Markdown in video comments and uses P

Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SS

MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.9.1.1, there is a p

bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involvi