CVE-2026-78140 | Medium | 4.7 | 2026-08-23 | A flaw has been found in Dromara UJCMS up to 10.1.3. The impacted element is the function update of the file src/main/java/com/ujcms/cms/ext/web/backendapi/Web… |
CVE-2026-75979 | Medium | 6.3 | 2026-08-19 | A vulnerability was found in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected is the function execSqlText/previewSqlText of the file DesignerController.j… |
CVE-2026-19929 | Medium | 6.3 | 2026-08-16 | A vulnerability was identified in OpenBoxes up to 0.9.6. This impacts the function buildZebraTemplate of the file grails-app/controllers/org/pih/warehouse/core… |
CVE-2026-18632 | Medium | 6.3 | 2026-08-03 | A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/… |
CVE-2026-11998 | High | 7.6 | 2026-06-24 | A flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execut… |
CVE-2026-48208 | Medium | 6.5 | 2026-06-01 | An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SV… |
CVE-2026-9498 | Medium | 6.3 | 2026-05-25 | A vulnerability has been found in Dromara lamp-cloud up to 5.6.2. Impacted is the function GroovyClassLoader.parseClass of the component Message Template Handl… |
CVE-2026-47323 | Critical | 9.8 | 2026-05-19 | Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering
The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilter… |
CVE-2026-8740 | Medium | 6.3 | 2026-05-17 | A flaw has been found in Sanluan PublicCMS 5.202506.d. The impacted element is the function execute of the file publiccms-core/src/main/java/com/publiccms/view… |
CVE-2026-44232 | | | 2026-05-12 | DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.3, every IPv6 category bypasses is_url_safe… |
CVE-2026-7164 | High | 7.5 | 2026-04-30 | Incorrect packet validation allowed unbounded recursion parsing SCTP chunk parameters. This can eventually result in a stack overflow and panic.
Remote attac… |
CVE-2026-6984 | Medium | 4.7 | 2026-04-25 | A security flaw has been discovered in AstrBotDevs AstrBot up to 4.22.1. This affects the function create_template of the file astrbot/dashboard/routes/t2i.py… |
CVE-2026-5987 | Medium | 4.7 | 2026-04-09 | A security vulnerability has been detected in Sanluan PublicCMS up to 6.202506.d. This affects the function AbstractFreemarkerView.doRender of the file publicc… |
CVE-2026-5559 | Medium | 6.3 | 2026-04-05 | A vulnerability has been found in AntaresMugisho PyBlade 0.1.8-alpha/0.1.9-alpha. The affected element is the function _is_safe_ast of the file sandbox.py of t… |
CVE-2026-3725 | Medium | 6.3 | 2026-03-08 | A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3.29. Affected by this issue is the function freemarkerResolverContent of the file sa-base/src/main/… |
CVE-2026-3714 | Medium | 4.7 | 2026-03-08 | A vulnerability has been found in OpenCart 4.0.2.3. Affected by this issue is the function Save of the file admin/controller/design/template.php of the compone… |
CVE-2026-29186 | High | 7.7 | 2026-03-07 | Backstage is an open framework for building developer portals. Prior to version 1.14.3, this is a configuration bypass vulnerability that enables arbitrary cod… |
CVE-2026-2969 | Medium | 4.7 | 2026-02-23 | A flaw has been found in datapizza-labs datapizza-ai 0.0.2. Affected is the function ChatPromptTemplate of the file datapizza-ai-core/datapizza/modules/prompt/… |
CVE-2025-14731 | Medium | 6.3 | 2025-12-16 | A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the library /ctcms/apps/libraries/CT_Parser… |
CVE-2025-59303 | Medium | 6.4 | 2025-10-08 | HAProxy Kubernetes Ingress Controller before 3.1.13, when the config-snippets feature flag is used, accepts config snippets from users with create/update permi… |
CVE-2025-9094 | Medium | 4.3 | 2025-08-17 | A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improp… |
CVE-2025-6761 | High | 7.3 | 2025-06-27 | A vulnerability was found in Kingdee Cloud-Starry-Sky Enterprise Edition 6.x/7.x/8.x/9.0. It has been rated as critical. Affected by this issue is the function… |
CVE-2025-6518 | Medium | 6.3 | 2025-06-23 | A vulnerability was found in PySpur-Dev pyspur up to 0.1.18. It has been classified as critical. Affected is the function SingleLLMCallNode of the file backend… |
CVE-2025-2336 | Medium | 4.8 | 2025-06-04 | Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to b… |
CVE-2025-0324 | Critical | 9.4 | 2025-06-02 | The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. |
CVE-2025-5325 | Medium | 6.3 | 2025-05-29 | A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerabi… |
CVE-2025-0716 | Medium | 4.8 | 2025-04-29 | Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image sou… |
CVE-2025-3841 | Low | 3.3 | 2025-04-21 | A vulnerability, which was classified as problematic, was found in wix-incubator jam up to e87a6fd85cf8fb5ff37b62b2d68f917219d07ae9. This affects an unknown pa… |
CVE-2024-45481 | | | 2025-03-25 | An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to a… |
CVE-2025-2040 | Medium | 6.3 | 2025-03-06 | A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2024-47590 | High | 8.8 | 2024-11-12 | An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, inp… |
CVE-2024-8373 | Medium | 4.8 | 2024-09-09 | Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions… |
CVE-2024-39283 | Medium | 6.0 | 2024-08-14 | Incomplete filtering of special elements in Intel(R) TDX module software before version TDX_1.5.01.00.592 may allow an authenticated user to potentially enable… |
CVE-2024-27489 | High | 7.5 | 2024-07-19 | An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request. |
CVE-2024-39899 | Medium | 5.3 | 2024-07-09 | PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side proxy. The idea was… |
CVE-2024-32162 | Medium | 4.3 | 2024-04-17 | CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion. |
CVE-2020-36827 | Medium | 5.4 | 2024-03-24 | The XAO::Web module before 1.84 for Perl mishandles < and > characters in JSON output during use of json-embed in Web::Action. |
CVE-2023-31172 | Medium | 5.9 | 2023-08-31 |
An Incomplete Filtering of Special Elements vulnerability in the Schweitzer Engineering Laboratories SEL-5030 acSELerator QuickSet Software could allow an att… |
CVE-2023-1076 | Medium | 5.5 | 2023-03-27 | A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While… |
CVE-2022-2132 | High | 8.6 | 2022-08-31 | A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vho… |
CVE-2022-21668 | High | 8.0 | 2022-01-10 | pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files a… |