Browse CVEs

CRITICAL 9.9 CVE-2026-32768 Chall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. In versions prior to 0.6.5, due to a miswritten NetworkPo… Chall Manager 0.6.5+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-4472 A security vulnerability has been detected in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the fi… Online Frozen Foods Ordering System Mitigation only Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-4471 A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /admin/admin_edit_em… Online Frozen Foods Ordering System Mitigation only Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-4470 A security flaw has been discovered in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this issue is some unknown functionality of … Online Frozen Foods Ordering System Mitigation only Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-4469 A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. Affected by this vulnerability is an unknown functionality of… Online Frozen Foods Ordering System Mitigation only Fix from $2,3002026-03-20 CRITICAL 9.1 CVE-2026-33024 AVideo is a video-sharing Platform. Versions prior to 8.0 contain a Server-Side Request Forgery vulnerability (CWE-918) in the public thumbnail endpo… Avideo Encoder 8.0+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-33017 KEVEPSS 96% Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the POST /api/v1/build_public_tmp/{flow_id… Langflow 1.8.2+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-4038 The Aimogen Pro plugin for WordPress is vulnerable to Arbitrary Function Call that can lead to privilege escalation due to a missing capability check… Mitigation only Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-32945 PJSIP is a free and open source multimedia communication library written in C. Versions 2.16 and below have a Heap-based Buffer Overflowvulnerability… Pjsip 2.17+ Fix from $2,3002026-03-20 CRITICAL 9.0 CVE-2026-32891 Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. Versions 1.4.1 and be… Anchorr after 1.4.1 Fix from $2,3002026-03-20 CRITICAL 9.6 CVE-2026-32890 Anchorr is a Discord bot for requesting movies and TV shows and receiving notifications when items are added to a media server. In versions 1.4.1 and… Anchorr after 1.4.1 Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-21992 Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager produc… Identity Manager Mitigation only Fix from $2,3002026-03-20 CRITICAL 9.1 CVE-2026-32817 Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the curre… Admidio 5.0.7+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-32771 The CTFer.io Monitoring component is in charge of the collection, process and storage of various signals (i.e. logs, metrics and distributed traces).… Monitoring 0.2.2+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-32769 Fullchain is an umbrella project for deploying a ready-to-use CTF platform. In versions prior to 0.1.1, due to a mis-written NetworkPolicy, a malici… Fullchain 0.1.1+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-32767 SiYuan is a personal knowledge management system. Versions 3.6.0 and below contain an authorization bypass vulnerability in the /api/search/fullTextS… Siyuan 3.6.1+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-33289 SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, an LDAP… Suitecrm 7.15.1 / 8.9.3+ Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-32985 Xerte Online Toolkits versions 3.14 and earlier contain an unauthenticated arbitrary file upload vulnerability in the template import functionality t… Xerte Online Toolkits after 3.14.0 Fix from $2,3002026-03-20 CRITICAL 9.8 CVE-2026-32760 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions … Filebrowser 2.62.0+ Fix from $2,3002026-03-20 CRITICAL 9.1 CVE-2026-22732 When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will n… Spring Security 5.7.22 / 5.8.24+ Fix from $2,3002026-03-19 CRITICAL 9.3 CVE-2026-32754 FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Versions 1.8.208 and below are vulnerable to Stored Cross-Site Scr… Freescout 1.8.209+ Fix from $2,3002026-03-19 CRITICAL 9.0 CVE-2026-32751 SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the mobile file tree (MobileFiles.ts) renders notebook names via inner… Siyuan 3.6.1+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-32194 Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execu… Bing Images No fix yet Fix from $2,3002026-03-19 CRITICAL 9.0 CVE-2026-32038 OpenClaw before 2026.2.24 contains a sandbox network isolation bypass vulnerability that allows trusted operators to join another container's network… Openclaw 2026.2.24+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-30872 OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based B… Openwrt 24.10.6 / 25.12.1+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-30871 OpenWrt Project is a Linux operating system targeting embedded devices. In versions prior to 24.10.6 and 25.12.1, the mdns daemon has a Stack-based B… Openwrt 24.10.6 / 25.12.1+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-4395 Heap-based buffer overflow in the KCAPI ECC code path of wc_ecc_import_x963_ex() in wolfSSL wolfcrypt allows a remote attacker to write attacker-cont… Wolfssl 5.9.0+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-3849 Stack Buffer Overflow in wc_HpkeLabeledExtract via Oversized ECH Config. A vulnerability existed in wolfSSL 5.8.4 ECH (Encrypted Client Hello) suppor… Wolfssl 5.9.0+ Fix from $2,3002026-03-19 CRITICAL 9.8 CVE-2026-3549 Heap Overflow in TLS 1.3 ECH parsing. An integer underflow existed in ECH extension parsing logic when calculating a buffer length, which resulted in… Wolfssl 5.9.0+ Fix from $2,3002026-03-19 CRITICAL 9.1 CVE-2026-32749 SiYuan is a personal knowledge management system. In versions 3.6.0 and below, POST /api/import/importSY and POST /api/import/importZipMd write uploa… Siyuan 3.6.1+ Fix from $2,3002026-03-19