exploit

CVE-2026-25111 is an OS command injection vulnerability found in Copeland XWEB Pro versions up to 1.12.1 . The issue resides

CVE-2025-59903 is a Stored Cross-Site Scripting (XSS) vulnerability found in Kubysoft, a cloud-based ERP platform . The vulnerability resides in

From version 5.101.6 to 6.19.2, the Ghost CMS suffered from incomplete CSRF protections on the `/session/verify` endpoint. This endpoint handles

The vulnerability exists in the TimescaleDB export module of Glances, a cross-platform system monitoring tool. The module constructs SQL INSERT

The vulnerability CVE-2026-23808 resides in the standardized wireless roaming protocol implementation used by HPE Aruba Networking Operating System (AOS) .

The SSRF protection fix for GHSA-qh4c-xf7m-gxfc can be bypassed in the `load_from_url_async` method due to inconsistent URL parsing behavior between

OpenClaw’s `system.run` function includes a security feature for “allowlist” mode, which is designed to require explicit approval before executing certain

The vulnerability resides in how the macOS Dashboard flow of OpenClaw handles Gateway authentication material. Before the fix, when a

A critical vulnerability exists in Copeland XWEB Pro versions 1.12.1 and prior, stemming from improper handling of unexpected return values

A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. This vulnerability,

CVE-2026-24663 is a critical OS command injection vulnerability in Copeland XWEB Pro versions up to 1.12.1. The flaw exists in

The vulnerability, identified as CVE-2026-30854, resides in Parse Server’s GraphQL implementation. When the security setting `graphQLPublicIntrospection` is explicitly disabled to

The SmartRemote module, developed by Vivo for its mobile devices, contains a vulnerability identified as CVE-2025-15509. The issue stems from

The vulnerability CVE-2026-3746 exists in SourceCodester Simple Responsive Tourism Website 1.0 due to improper neutralization of special elements used in

The vulnerability arises from insufficient sanitization of the “Info” parameter within the `/admin/adminHome.php` script of projectworlds Online Art Gallery Shop

The vulnerability, identified as CVE-2026-29195, exists in the user update handler of Netmaker, a tool for creating virtual networks with

The vulnerability stems from a flaw in the `Authorize` middleware used by Netmaker, a tool for creating virtual overlay networks.

CVE-2026-22760 is a low-severity vulnerability in Dell Device Management Agent (DDMA) versions prior to 26.02. The flaw stems from an

The vulnerability, identified as CVE-2026-3759, is an unauthenticated SQL injection flaw found in the `reach_nm` parameter within the `/admin/adminHome.php` file

The Google, Apple, and Facebook authentication adapters in Parse Server handle identity token validation using JWT. For a secure JWT

The vulnerability, identified as CVE-2026-3695, resides in the file deletion mechanism of the SourceCodester Modern Image Gallery App version 1.0.

CVE-2026-3404 is an XML External Entity (XXE) vulnerability found in thinkgem JeeSite up to version 5.15.1. The flaw resides in

The vulnerability CVE-2026-3757 resides in the projectworlds Online Art Gallery Shop version 1.0, specifically within an unknown functionality of the

CVE-2026-1603 is an authentication bypass vulnerability in Ivanti Endpoint Manager (EPM) before version 2024 SU5 . The vulnerability, classified under

CVE-2026-28464 is a medium-severity vulnerability in OpenClaw, an AI agent framework, affecting versions prior to 2026.2.12 . The core issue

The vulnerability CVE-2025-26399 is a critical unauthenticated remote code execution (RCE) flaw in SolarWinds Web Help Desk, specifically within the

The vulnerability CVE-2024-55964 exists in how an application, such as Appsmith, constructs a shell command to interact with a PostgreSQL

A vulnerability exists in SourceCodester Pet Grooming Management Software 1.0 within the User Creation Handler component, specifically in the `add_user.php`

The vulnerability resides in the file metadata endpoint (GET /files/:appId/metadata/:filename). In affected versions of Parse Server, this endpoint does not

The vulnerability in Pocket ID (CVE-2024-XXXX) arises from a logical error in the OIDC token endpoint’s authorization code validation. In

The vulnerability exists in the PagesRouter static file serving route of Parse Server. The boundary check to prevent directory traversal

This vulnerability, identified as CVE-2026-29196, is an Incorrect Authorization issue in Netmaker, a platform for creating virtual networks with WireGuard.

The vulnerability is a pre-authentication Server-Side Request Forgery (SSRF) found in the `BlobHandler.ashx` endpoint of the VMware Workspace ONE UEM

The vulnerability in Kubewarden allows attackers with privileged AdmissionPolicy create permissions to exploit three deprecated host-callback APIs: kubernetes/ingresses, kubernetes/namespaces, and

The vulnerability, identified as CVE-2026-30920, resides in OneUptime’s GitHub App installation flow. The core issue is the application’s failure to

The CGM CLININET system implements smart card authentication to control access, but a critical flaw exists in how this verification

A vulnerability classified as medium severity exists in SourceCodester Employee Task Management System version 1.0. The issue resides in the

The vulnerability, identified as CVE-2026-3734, resides in the SourceCodester Client Database Management System version 1.0. It specifically affects the endpoint

The CVE-2026-3752 vulnerability is a SQL Injection flaw found in the SourceCodester Employee Task Management System, specifically affecting versions up

The vulnerability exists in the backup restoration process of the TP-Link Archer RE605X. The function responsible for parsing backup configuration

The vulnerability in Pocket ID arises from a flaw in how the application validates callback URLs (redirect_uri) during the OAuth

CVE-2026-3729 details a critical vulnerability in the Tenda F453 router’s web management interface, specifically within the `fromPptpUserAdd` function handled by

A vulnerability classified as CVE-2026-3754 exists in the SourceCodester Sales and Inventory System version 1.0, specifically within the `/add_stock.php` file.

The CGM CLININET application fails to implement clickjacking protections, lacking both HTTP security headers like X-Frame-Options or Content-Security-Policy and HTML-based

The vulnerability, identified as CVE-2026-3756, is an SQL Injection flaw found in the SourceCodester Sales and Inventory System, specifically affecting

The vulnerability CVE-2026-3802 resides in the `formexeCommand` function within the `/goform/exeCommand` file of the Tenda i3 router firmware version 1.0.0.6(2204).

The vulnerability, identified as CVE-2026-3760, exists in version 1.0 of the itsourcecode University Management System. It specifically targets the `/view_result.php`

A vulnerability exists in the Tenda F453 router firmware version 1.0.0.3 within the `fromwebExcptypemanFilter` function, which is accessible via the

CVE-2026-3730 is a SQL injection vulnerability discovered in itsourcecode Free Hotel Reservation System version 1.0. The flaw exists within an

The vulnerability, identified as CVE-2026-3765, resides in the itsourcecode University Management System version 1.0, specifically within the file `/att_single_view.php` .

A critical stack-based buffer overflow vulnerability, identified as CVE-2026-3727, exists in the Tenda F453 router running firmware version 1.0.0.3 .

The vulnerability CVE-2026-3753 resides in the SourceCodester Sales and Inventory System, specifically within the file /add_sales_print.php. The issue stems from

The vulnerability CVE-2025-14208 is a command injection flaw found in the D-Link DIR-823X router firmware versions up to 20250416. It

The vulnerability CVE-2026-3755 is an SQL injection flaw found in the SourceCodester Sales and Inventory System version 1.0. It specifically

A critical stack-based buffer overflow vulnerability, identified as CVE-2026-3768, exists in the Tenda F453 router running firmware version 1.0.0.3. The

A critical stack-based buffer overflow vulnerability, identified as CVE-2026-3728, exists in the Tenda F453 router running firmware version 1.0.0.3/1.If. The

CVE-2026-3732 is a high-severity vulnerability discovered in the Tenda F453 router’s firmware, specifically version 1.0.0.3. The issue resides within the

CVE-2025-58406 describes a configuration vulnerability in the CGM CLININET application where the web server fails to include critical security headers

The vulnerability, identified as CVE-2026-3747, resides in the `add_result.php` file of itsourcecode University Management System version 1.0 . The core

CVE-2026-1469 is a Stored Cross-Site Scripting (XSS) vulnerability found in RLE NOVA’s PlanManager application . The vulnerability allows an attacker

The vulnerability, CVE-2026-24400, is an XML External Entity (XXE) injection flaw found in AssertJ Core, a popular Java library for

axios4go versions prior to 0.6.4 contain a race condition in their shared HTTP client configuration handling. The library maintains a

CVE-2026-3000 is a critical vulnerability in the IDExpert Windows Logon Agent developed by Changing Technologies . The flaw resides in

The vulnerability arises because the StreamVault application, prior to version 251126, allows authenticated administrators to configure arguments for the `yt-dlp`

CVE-2026-21883 is a vulnerability in the Bokeh interactive visualization library for Python, specifically affecting versions 3.8.1 and below . The

CVE-2025-69261 is a medium-severity vulnerability in the WasmEdge WebAssembly runtime, stemming from an integer wrap vulnerability in a memory bounds

The vulnerability CVE-2026-3422 resides in the U-Office Force software developed by e-Excellence. It is an Insecure Deserialization flaw, specifically mapped

CVE-2025-7014 is a Session Fixation vulnerability found in the Menu Panel of QR Menu Pro Smart Menu Systems. The vulnerability

How CVE-2026-2999 Works: This critical vulnerability resides in the IDExpert Windows Logon Agent developed by Changing Technology . It is

CVE-2025-7016 is an improper access control vulnerability (CWE-284) found in Akın Software’s QR Menu product, a digital menu solution used

The command injection vulnerability, identified as CVE-2025-14756, resides in the administrative web interface of the TP-Link Archer MR600 v5 router

The vulnerability CVE-2025-7015 is a Session Fixation flaw found in Akın Software’s QR Menu product . It stems from the

CVE-2026-22034 is a critical vulnerability in the Snuffleupagus PHP security module . The flaw exists in versions prior to 0.13.0

CVE-2025-7013 is an authorization bypass vulnerability found in the Menu Panel of QR Menu Pro Smart Menu Systems, affecting all

A vulnerability, identified as CVE-2025-15448, exists in the JavaMall project by cld378632668 up to commit 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. The flaw is located

A vulnerability classified as CVE-2026-1061 exists in xiweicheng TMS up to version 2.28.0. The issue resides in the `Upload` function

The vulnerability CVE-2025-15449 exists in the `delete` function within the `MinioController.java` file of the `cld378632668/JavaMall` project up to commit 994f1e2b.

The vulnerability, CVE-2026-1062, is a Server-Side Request Forgery (SSRF) found in xiweicheng TMS versions up to 2.28.0. The issue resides

The vulnerability stems from how the `hermes` command-line tool, used for automating software publication, handles the `-O` argument. In versions

The vulnerability, CVE-2025-15127, is an SQL Injection flaw found in the FantasticLBP Hotels_Server application, specifically within the `/controller/api/Room.php` file. The

The CVE-2025-14659 vulnerability is a command injection flaw found in the DHCP daemon (udhcpd) of D-Link DIR-860LB1 and DIR-868LB1 routers

The vulnerability CVE-2025-14801 is a Cross-Site Scripting (XSS) issue found in the xiweicheng Team Management System (TMS) up to version

The vulnerability is an Insecure Direct Object Reference (IDOR) found in the `/objects/playlistsFromUser.json.php` endpoint of the AVideo platform. The script

The vulnerability in OneUptime stems from the insecure use of Node.js’s `vm` module to execute untrusted JavaScript code in Synthetic

The vulnerability arises when Shescape is configured to use a shell whose path is a symbolic link pointing to another

The vulnerability in Soroban host arises from a flag management issue during Val to ScVal conversion for storage keys. Soroban

A security vulnerability exists in outdated versions of the x402 SDK, specifically within the facilitator component that validates Solana-based payments.

FUXA versions prior to 1.2.10 contained a critical insecure default vulnerability where a static fallback JWT signing secret (frangoteam751) was

In PowerSync version 1.20.0, a vulnerability exists in the new sync streams feature when config.edition is set to 3. The

OneUptime versions below 10.0.5 contain a critical Remote Code Execution vulnerability in the Synthetic Monitors feature. Low-privileged project users can

The vulnerability in Black’s GitHub Action arises from its support for the `use_pyproject: true` option, which reads the Black version

The vulnerability arises when the HTTP server is enabled with MCP_HTTP_ENABLED=true, and the default CORS configuration in `config.py` sets CORS_ORIGINS

The vulnerability is caused by improper handling of user-supplied paths in the `/export` endpoint. The code in `session.go` grants administrative

The vulnerability stems from an authorization inconsistency within the User management controller, specifically a “1-of-N” flaw where certain methods lack

The vulnerability resides in how the application validates MCP stdio configurations starting from version 2.0.5. The application attempts to secure

The vulnerability stems from improper neutralization of special elements used in a command, specifically within the MCP stdio test functionality

The vulnerability stems from a complete lack of ownership validation in the tenant management API endpoints. The application parses a

How the CVE Works The vulnerability exists in the database query validation framework’s `validateNode()` function, which fails to recursively inspect

The `POST /api/v1/knowledge-bases/copy` endpoint enqueues an asynchronous task to clone a knowledge base (KB) using a caller-supplied `source_id` without verifying

The vulnerability resides in the `vars_regexp` matcher (vars.go:337) which double-expands user-controlled input through the Caddy replacer. When a placeholder like