CVEs published September 28, 2026

A flaw has been found in Netcore NR289-GE 1.4.5102.

A vulnerability was detected in Netcore NR289-GE 1.4.5102.

A security vulnerability has been detected in Netcore NR289-GE 1.4.5102.

A vulnerability was identified in Netcore NR289-GE 1.4.5102.

A vulnerability was identified in FAST FAC1900R 20190827_2.0.2.

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246.

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928.

Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client that can create instances or…

Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the…

Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs, because…

A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2.

A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2.

A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246.

A weakness has been identified in TOTOLINK N150RT 3.4.0-B20201030.

Authlib (v1.7.2 and below) contains a signature verification bypass vulnerability.

Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd.

Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled bytes, because the XML-RPC endpoint accepts vendor…

The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all.

A weakness has been identified in Netcore NR289-GE 1.4.5102.

An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Rancher UI, in SUSE Rancher 2.15 before 2.15.2, 2.14 before 2.14.6,…

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in…

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content.

A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with…

An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to…

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality.

An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with network access to the AP to obtain a valid API session.

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parameters at three separate…

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing…

Dayforce ESS Excelity is vulnerable to Path Traversal  in file download functionality.

Bluehood monitors local bluetooth activity.

Is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader.

The decompress package for Node.js extracts archives.

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0.

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0.

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0.

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0.

A security flaw has been discovered in D-Link DI-8400 16.07.

A vulnerability was found in aaPanel BaoTa up to 11.8.0.

Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an outstanding request token for a configured site-wide consumer…

Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows).

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd.

A vulnerability has been identified within Rancher Manager where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the…

The ConvertPlus plugin for WordPress is vulnerable to Deserialization of Untrusted Data in all versions up to, and including, 3.6.3 via the style parameter of the cp_display_preview_modal AJAX action.

An out-of-bounds write issue was addressed with improved bounds checking.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc.

Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc.

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair…

Authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands.

A critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the…

A critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server.

A critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading directly to remote code execution (RCE).

Users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings.

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow.

ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution.

WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-862) in the built-in server-side file functions pg_file_write(text,text,bool),…

Agg_agg forwards the compacted message stream from its inner proofs into a public messages: [Field; 1000] array, but it never checks that the unused tail of the outer array is zero.

An authorization guard to Users::change_password(), was added to address a previous authorization flaw that allowed a secondary administrator (user_type=1, user_id != 1) to directly change the password of…

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.

Joomla Extension - regularlabs.com - LFI / SSRF in Modules Anywhere 1.5.0 - 9.0.5 for Joomla - Modules Anywhere Pro lets additional attributes on a module tag replace arbitrary parameters of the selected…

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients.

A vulnerability was determined in aaPanel BaoTa up to 11.8.0.

A vulnerability has been found in aaPanel BaoTa up to 11.8.0.

A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and…

ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution.

A security vulnerability has been detected in Netcore POWER13 2.0.240730.162638.

A security flaw has been discovered in Netcore NR289-GE 1.4.5102.

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service.

Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global configuration value (the frontpage weblog selection) on any…

The GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments about it was mis-structured in terms of mixing code running with higher privileges (single-use token…

Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames.

The RFC 2397 regular expression allows slash characters on both sides of the media-type separator.

Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse.

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy().

LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to authenticate as any existing user by exploiting an email-based…

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path where the…

Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out.

Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under the victim's authority, because the CSRF validation…

Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc.

Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC.

The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver…

The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver…

The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) validated the RTIO object handle and the sqes input array, but not the…

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem.

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to…

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor.

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller process and reach internal network addresses by importing a…

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the…

Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server to parse an attacker-influenced trackback response with…

Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog…

An unrestricted Server-Side Request Forgery (SSRF) vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services,…

The Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value.

Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products.

WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases before v2025.08.18.00) failed to unregister read callbacks for streams that were no longer open before destroying them.

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without…

XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference.

MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidates the handle under proxygen's WebTransport API.

A single message with a deeply nested object in its pattern can terminate a NestJS microservice using the TCP or RabbitMQ transport.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

A vulnerability has been found in Eyeplus 57.0.0.0308.

Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions (Pro) 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a…

Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP requests to attacker-chosen destinations through legacy…

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account.

PyJWT HMACAlgorithm.prepare_key is affected because HMAC key guard only recognizes top-level public JWK forms and misses container representations.

HMACAlgorithm.prepare_key in jwt/algorithms.py is affected because raw-JWK detector does not normalize accepted Unicode byte-order marks before checking for JSON.

PyJWT HMACAlgorithm.prepare_key is affected because asymmetric-key guard relies on textual markers that are absent from DER encoding.

PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary.

HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation.

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.

LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and…

QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSessionBase::closeSession method.

A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1.

A vulnerability was determined in dbgate up to 7.3.1.

A vulnerability was determined in Thinkware U3000 up to 1.02.04.

A security vulnerability has been detected in refly-ai refly up to 1.1.0.

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2.

A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2.

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.

A vulnerability was detected in October CMS up to 4.3.4.

A vulnerability was found in OctoberCMS up to 4.1.19/4.2.25/4.3.4.

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1.

A vulnerability was determined in Privoce VoceChat Server up to 0.5.36.

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2.

A vulnerability was detected in Trusted Domain Project OpenDKIM up to 2.11.0.

A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0.

BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally.

An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api.

The FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service.

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.

A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment…

An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd.

A flaw was found in kube-compare.

The send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message.

The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication.

Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives.

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db.

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers.

A flaw was found in GCC.

The fetch adapter bypasses the maxRedirects: 0 redirect policy.

Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy.

Users::form() performs no object-level authorization check on user_id = 1.

Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209…

mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware.

The Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48.

The fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions.

The dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration.

Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype.

ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers.

The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform…

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers.

A flaw was found in the StreamsHub Console for Apache Kafka.

An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.

A privilege mismatch was found in Fleet.

A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet…

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc.

Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application classpath, including Roller configuration files containing…

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows.

ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP cameras or intercepting attackers to overflow fixed-size buffers by…

PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived from d with x.

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.

A weakness has been identified in dbgate up to 7.3.1.

A security flaw has been discovered in dbgate up to 7.3.1.

A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813.

A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2.

A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2.

A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007.

The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any authenticated user to perform SQL injection attacks.

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication.

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600).

RFC 9112 section 6.3 applies chunked framing only when chunked is the final coding, and otherwise reads the body until the server closes the connection.

Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject,…

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse…

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation.

ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame_buf_pool, sized IEEE802154_MTU).

The Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range.

The isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family.

The Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics.

A vulnerability was determined in FastStone Image Viewer up to 8.3.

A vulnerability was found in FastStone Image Viewer up to 8.3.

A vulnerability has been found in FastStone Image Viewer up to 8.3.

A flaw has been found in FastStone Image Viewer up to 8.3.

A vulnerability was determined in Eleveo Call Recording Software 9.7.0.

A vulnerability has been found in Eleveo Quality Management 9.7.0.

A vulnerability was determined in code-projects Matrimonial System 1.0.

A vulnerability was found in deepseek-ai deepseek-harness up to 0.1.0-rc.7.

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2.

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814.

A flaw has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1.

A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1.

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be.

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95.

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that…

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co.

Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute script in the session of a weblog moderator or global…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting against a visitor to a weblog…

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface.

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint.

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site/views/view_book/tmpl/default.php, echoes the raw title request…

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP.

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption.

PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py.

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access…

An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash an attached X client.

Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability.

Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the IPNET subsystem failing to properly release allocated kernel memory and system file descriptors before terminating the…

A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounded CPU usage and memory exhaustion.

An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.

Specific system call arguments can result in the process management subsystem failing to properly release allocated kernel memory before terminating the calling application.

Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific service routines, causing the system to terminate operations before…

A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1.

A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f.

A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service).

The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to…

An attacker who can prepend a directory to PATH or write a malicious binary to an attacker-controlled or writable directory appearing in PATH can hijack the execution pathway.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the…

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written…

A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07.

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to delete user groups without token verification.

The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does not check order ownership, allowing unauthenticated users to mark…

The HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiStream APIs could return stream handles that the stream handler had already freed.

The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied to, allowing unauthenticated users to mark an arbitrary pending…

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well…

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to…

mH-DEVELOPER smart home module does not load any firewall rules at startup.

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients.

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests.

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authenticated request.

The brace-expansion library generates arbitrary strings containing a common prefix and suffix.

PyJWS._load in jwt/api_jws.py is affected because parser catches ValueError but not RecursionError.

PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError.

PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval.

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8 - The public vehicle-detail page (task=view) echoes the title request parameter directly into a…

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish readers to retrieve image asset paths from unauthorized databases.

A security vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x.

A weakness has been identified in PMWeb 7.x/8.x/2025.x.

A security vulnerability has been detected in dbgate up to 7.3.1.

A security flaw has been discovered in Thinkware U3000 up to 1.02.04.

A vulnerability was identified in Thinkware U3000 up to 1.02.04.

A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1.

A flaw has been found in aligungr UERANSIM up to 3.3.0.

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10.

A weakness has been identified in Cesanta Mongoose up to 7.21.

A flaw has been found in Eyeplus 57.0.0.0308.

A vulnerability was detected in Eyeplus 57.0.0.0308.

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1.

A security flaw has been discovered in Trusted Domain Project OpenARC up to 1.0.0.Beta1.

A vulnerability was found in aligungr UERANSIM up to 3.3.0.

A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2.

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9 - The public property-detail page’s “leave a review” form repopulates its title field directly from…

An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clients.

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers.

Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM600).

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7172: parameter 'Nombre Completo' in the endpoint…

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7171: parameter 'Apellido 1' in the endpoint…

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7170: parameter 'vendor_store_name' in the endpoint…

PyJWT signature segment is affected because signature segment decoding accepts characters outside the canonical Base64URL representation.

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2.

A vulnerability was determined in dayrui XunruiCMS up to 4.7.2.

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0.

A vulnerability was identified in aaPanel BaoTa up to 11.8.0.

The isDangerousUrl() method is responsible for rejecting dangerous URL values in the href and xlink:href attributes.

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one…

PyJWT is_pem_format is affected because lazy PEM regular expression backtracks extensively.

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium…

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint.

A security flaw has been discovered in Eleveo Quality Management 9.7.0.

A vulnerability was identified in Eleveo Call Recording Software 9.7.0.

A vulnerability was found in Eleveo Quality Management 9.7.0.

A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07.

A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23.

A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23.

A flaw has been found in Frappe HR up to 16.15.0.

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle…

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational Technologies Inc.

Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval() vulnerability in schema.py that allows authenticated attackers to achieve code execution by placing a Python object with a…

Flatpak creates temporary child repository directories under the user cache with world-writable permissions (0777).

The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.

The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option.

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.

A flaw was found in the Micrometer user-event metrics listener of Keycloak, a solution for integrated identity and access management.

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry (.desktop) and D-Bus Service (.service) files, instead of validating against an allowlist.

A flaw has been found in Eleveo Call Recording Software 9.7.0.

A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95.

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.5-rc.3.

Flatpak writes the OCI repository authentication token with world-readable permissions (0644) in the system-helper's cache directory, allowing other local users on a multi-user system to read the token and…

Laravel exception debug pages with APP_DEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the…

A security flaw has been discovered in DeepSeek deepseek-harness up to 0.1.7-rc.2.

A vulnerability was found in agentverus agentverus-scanner up to 0.8.1.

A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4.