Browse CVEs

MEDIUM 5.4 CVE-2026-66029 Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject… No fix yet Fix from $1,6002026-07-27 MEDIUM 6.7 CVE-2026-66028 Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to cr… No fix yet Fix from $1,6002026-07-27 CRITICAL 9.8 CVE-2026-55579 Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default… No fix yet Fix from $2,3002026-07-27 HIGH 8.8 CVE-2026-55578 Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses a… No fix yet Fix from $1,9502026-07-27 HIGH 8.8 CVE-2026-54540 Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass… No fix yet Fix from $1,9502026-07-27 MEDIUM 6.9 CVE-2026-54272 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF thr… No fix yet Fix from $1,6002026-07-27 HIGH 8.8 CVE-2026-51235 LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and fuji_rotate() function (src/decoders/fuji.cpp). No fix yet Fix from $1,9502026-07-27 CRITICAL 9.9 CVE-2026-48030EPSS 5% Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability i… No fix yet Fix from $2,3002026-07-27 HIGH 7.5 CVE-2026-66731 facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated … No fix yet Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-66730 facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker t… No fix yet Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-66729 facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attacke… No fix yet Fix from $1,9502026-07-27 HIGH 7.8 CVE-2026-24252 NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead … No fix yet Fix from $1,9502026-07-27 MEDIUM 5.0 CVE-2026-17531 A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/route… No fix yet Fix from $1,6002026-07-27 HIGH 8.5 CVE-2026-17192 A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to intern… No fix yet Fix from $1,9502026-07-27 CRITICAL 9.1 CVE-2026-17191 An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend q… No fix yet Fix from $2,3002026-07-27 MEDIUM 6.5 CVE-2026-66399 phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-ma… No fix yet Fix from $1,6002026-07-27 CRITICAL 9.4 CVE-2026-66398 phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGUR… No fix yet Fix from $2,3002026-07-27 HIGH 8.6 CVE-2026-66397 phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attacker… No fix yet Fix from $1,9502026-07-27 HIGH 8.4 CVE-2026-66396 SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cr… Mitigation only Fix from $1,9502026-07-27 CRITICAL 9.6 CVE-2026-66395 SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to exe… No fix yet Fix from $2,3002026-07-27 HIGH 8.7 CVE-2026-66394 SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to ex… No fix yet Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-51302 SQLite 3.41 has a use-after-free vulnerability exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temp… SQLite No fix yet Fix from $1,9502026-07-27 CRITICAL 9.1 CVE-2026-51300 A use-after-free vulnerability exists in the expression parsing and memory management logic of SQLite 3.41. After invoking sqlite3ExprDelete to relea… Mitigation only Fix from $2,3002026-07-27 HIGH 7.5 CVE-2026-51304 sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprLi… SQLite No fix yet Fix from $1,9502026-07-27 CRITICAL 9.8 CVE-2026-51303 A use-after-free (UAF) vulnerability was discovered in the core parsing component of SQLite 3.41. The flaw occurs because the program frees an ExprLi… No fix yet Fix from $2,3002026-07-27 MEDIUM 6.2 CVE-2026-51298 sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program… SQLite No fix yet Fix from $1,6002026-07-27 HIGH 8.8 CVE-2026-51297 sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free … SQLite Mitigation only Fix from $1,9502026-07-27 CRITICAL 9.1 CVE-2025-50455 SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vuln… No fix yet Fix from $2,3002026-07-27 MEDIUM 5.3 CVE-2026-66477 Unauthenticated Broken Access Control in Gillion <= 4.13 versions. No fix yet Fix from $1,6002026-07-27 MEDIUM 5.9 CVE-2026-66475 Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce &#8211; Checkout Manager <= 3.0.5 versions. No fix yet Fix from $1,6002026-07-27