cve.li

Recent

CVE-2026-2116CWE-89CWE-74

itsourcecode Society Management System edit_expenses.php sql injection

Published 2026-02-07 by VulDB

CVE-2026-2115CWE-89CWE-74

itsourcecode Society Management System delete_expenses.php sql injection

Published 2026-02-07 by VulDB

CVE-2026-2114CWE-89CWE-74

itsourcecode Society Management System edit_admin.php sql injection

Published 2026-02-07 by VulDB

CVE-2026-25859CWE-863

WeKan < 8.20 Migration Functionality Insufficient Permission Checks

Published 2026-02-07 by VulnCheck

CVE-2026-25568CWE-863

WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass

Published 2026-02-07 by VulnCheck

CVE-2026-25567CWE-639

WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId

Published 2026-02-07 by VulnCheck

CVE-2026-25566CWE-863

WeKan < 8.19 Cross-board Card Move Without Destination Authorization

Published 2026-02-07 by VulnCheck

CVE-2026-25565CWE-863

WeKan < 8.19 Read-only Board Roles Can Update Cards

Published 2026-02-07 by VulnCheck

CVE-2026-25564CWE-639

WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation

Published 2026-02-07 by VulnCheck

CVE-2026-25563CWE-639

WeKan < 8.19 Checklist Creation Cross-Board IDOR

Published 2026-02-07 by VulnCheck

CVE-2026-25562CWE-203

WeKan < 8.19 Attachments Publication Information Disclosure

Published 2026-02-07 by VulnCheck

CVE-2026-25561CWE-863

WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass

Published 2026-02-07 by VulnCheck

CVE-2026-25560CWE-90

WeKan < 8.19 LDAP Authentication Filter Injection

Published 2026-02-07 by VulnCheck

CVE-2026-25858CWE-640

macrozheng mall <= 1.0.3 Unauthenticated Password Reset via OTP Disclosure

Published 2026-02-07 by VulnCheck

CVE-2026-25857CWE-78

Tenda G300-F Command Injection via formSetWanDiag

Published 2026-02-07 by VulnCheck

CVE-2025-15564CWE-369CWE-404

Mapnik value.cpp operator divide by zero

Published 2026-02-07 by VulDB

CVE-2026-2113CWE-502CWE-20

yuan1994 tpadmin WebUploader preview.php deserialization

Published 2026-02-07 by VulDB

CVE-2026-2111CWE-22

JeecgBoot Retrieval-Augmented Generation edit path traversal

Published 2026-02-07 by VulDB

CVE-2026-2110CWE-307CWE-799

Tasin1025 SwiftBuy login.php excessive authentication

Published 2026-02-07 by VulDB

CVE-2026-2109CWE-285CWE-266

jsbroks COCO Annotator Delete Category undo improper authorization

Published 2026-02-07 by VulDB

CVE-2026-2108CWE-404

jsbroks COCO Annotator Endpoint long_task denial of service

Published 2026-02-07 by VulDB

CVE-2026-2107CWE-285CWE-266

yeqifu warehouse Log Info LoginfoController.java batchDeleteLoginfo improper authorization

Published 2026-02-07 by VulDB

CVE-2026-2106CWE-285CWE-266

yeqifu warehouse Notice Management NoticeController.java batchDeleteNotice improper authorization

Published 2026-02-07 by VulDB

CVE-2026-2105CWE-285CWE-266

yeqifu warehouse Department Management DeptController.java deleteDept improper authorization

Published 2026-02-07 by VulDB

CVE-2026-2090CWE-89CWE-74

SourceCodester Online Class Record System search.php sql injection

Published 2026-02-07 by VulDB

CVE-2026-2089CWE-89CWE-74

SourceCodester Online Class Record System controller.php sql injection

Published 2026-02-07 by VulDB

CVE-2026-2088CWE-89CWE-74

PHPGurukul Beauty Parlour Management System accepted-appointment.php sql injection

Published 2026-02-07 by VulDB

CVE-2026-2087CWE-89CWE-74

SourceCodester Online Class Record System login.php sql injection

Published 2026-02-07 by VulDB

CVE-2026-2086CWE-120CWE-119

UTT HiPER 810G Management formFireWall strcpy buffer overflow

Published 2026-02-07 by VulDB

CVE-2026-2085CWE-77CWE-74

D-Link DWR-M921 USSD Configuration Endpoint formUSSDSetup sub_419F20 command injection

Published 2026-02-07 by VulDB

CVE-2026-2084CWE-78CWE-77

D-Link DIR-823X set_language os command injection

Published 2026-02-07 by VulDB

CVE-2026-2083CWE-89CWE-74

code-projects Social Networking Site delete_post.php sql injection

Published 2026-02-07 by VulDB

CVE-2026-2082CWE-78CWE-77

D-Link DIR-823X set_mac_clone os command injection

Published 2026-02-07 by VulDB

CVE-2026-2081CWE-78CWE-77

D-Link DIR-823X set_password os command injection

Published 2026-02-07 by VulDB

CVE-2026-2080CWE-77CWE-74

UTT HiPER 810 formUser setSysAdm command injection

Published 2026-02-07 by VulDB

CVE-2026-2079CWE-285CWE-266

yeqifu warehouse Menu Management MenuController.java deleteMenu improper authorization

Published 2026-02-07 by VulDB

CVE-2025-15476CWE-862

The Bucketlister <= 0.1.5 - Missing Authorization to Authenticated (Subscriber+) Bucket List Modification

Published 2026-02-07 by Wordfence

CVE-2025-15477CWE-89

The Bucketlister <= 0.1.5 - Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes

Published 2026-02-07 by Wordfence

CVE-2026-1573CWE-79

OMIGO <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published 2026-02-07 by Wordfence

CVE-2026-1613CWE-79

Wonka Slide <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published 2026-02-07 by Wordfence

CVE-2026-1611CWE-79

Wikiloops Track Player <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published 2026-02-07 by Wordfence

CVE-2026-1082CWE-352

TITLE ANIMATOR <= 1.0 - Cross-Site Request Forgery to Settings Update

Published 2026-02-07 by Wordfence

CVE-2026-0555CWE-79

Premmerce <= 1.3.20 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'premmerce_wizard_actions' AJAX Endpoint

Published 2026-02-07 by Wordfence

CVE-2026-1608CWE-79

Video Onclick <= 0.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published 2026-02-07 by Wordfence

CVE-2026-1634CWE-79

Subitem AL Slider <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']

Published 2026-02-07 by Wordfence

CVE-2026-1675CWE-1188

Advanced Country Blocker <= 2.3.1 - Unauthenticated Authorization Bypass via Insecure Default Secret Key

Published 2026-02-07 by Wordfence

CVE-2026-1643CWE-79

MP-Ukagaka <= 1.5.2 - Reflected Cross-Site Scripting

Published 2026-02-07 by Wordfence

CVE-2026-1570CWE-79

Simple Bible Verse via Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published 2026-02-07 by Wordfence

CVE-2026-2078CWE-285CWE-266

yeqifu warehouse Permission Management PermissionController.java deletePermission improper authorization

Published 2026-02-07 by VulDB

CVE-2026-2077CWE-285CWE-266

yeqifu warehouse Role Management RoleController.java deleteRole improper authorization

Published 2026-02-07 by VulDB

CVE-2026-2076CWE-285CWE-266

yeqifu warehouse User Management Endpoint UserController.java deleteUser improper authorization

Published 2026-02-07 by VulDB

CVE-2025-15491

Post Slides <= 1.0.1 - Contributor+ Local File Inclusion

Published 2026-02-07 by WPScan

CVE-2025-12159CWE-79

Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published 2026-02-07 by Wordfence

CVE-2025-13463CWE-79

Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid

Published 2026-02-07 by Wordfence

CVE-2025-12803CWE-80

Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode

Published 2026-02-07 by Wordfence

CVE-2025-15267CWE-79

Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

Published 2026-02-07 by Wordfence

CVE-2026-2075CWE-284CWE-266

yeqifu warehouse Role-Permission Binding RoleController.java saveRolePermission access control

Published 2026-02-07 by VulDB

CVE-2026-2074CWE-611CWE-610

O2OA HTTP POST Request check xml external entity reference

Published 2026-02-07 by VulDB

CVE-2026-2073CWE-89CWE-74

itsourcecode School Management System index.php sql injection

Published 2026-02-07 by VulDB

CVE-2025-31990CWE-770

HCL DevOps Velocity is susceptible to a Denial of Service vulnerability

Published 2026-02-07 by HCL

CVE-2026-2071CWE-120CWE-119

UTT 进取 520W formP2PLimitConfig strcpy buffer overflow

Published 2026-02-07 by VulDB

CVE-2020-37079CWE-352

Wing FTP Server < 6.2.7 - Cross-site Request Forgery

Published 2026-02-06 by VulnCheck

CVE-2020-37171CWE-120

TapinRadio 2.12.3 - 'username' Denial of Service

Published 2026-02-06 by VulnCheck

CVE-2020-37170CWE-120

TapinRadio 2.12.3 - 'address' Denial of Service

Published 2026-02-06 by VulnCheck

CVE-2020-37166CWE-120

AbsoluteTelnet 11.12 - 'SSH2/username' Denial of Service

Published 2026-02-06 by VulnCheck

CVE-2020-37165CWE-120

AbsoluteTelnet 11.12 - "license name" Denial of Service

Published 2026-02-06 by VulnCheck

CVE-2020-37164CWE-120

AbsoluteTelnet 11.12 - "license entry" Denial of Service

Published 2026-02-06 by VulnCheck

CVE-2020-37163CWE-89

QuickDate 1.3.2 - SQL Injection

Published 2026-02-06 by VulnCheck

CVE-2020-37162CWE-122

Wedding Slideshow Studio 1.36 - 'Key' Buffer Overflow

Published 2026-02-06 by VulnCheck

CVE-2020-37161CWE-121

Wedding Slideshow Studio 1.36 - 'Name' Buffer Overflow

Published 2026-02-06 by VulnCheck

CVE-2020-37160CWE-276

SprintWork 2.3.1 - Local Privilege Escalation

Published 2026-02-06 by VulnCheck

CVE-2020-37159CWE-121

Cuckoo Clock 5.0 - Buffer Overflow

Published 2026-02-06 by VulnCheck

CVE-2020-37157CWE-306

DBPower C300 HD Camera - Remote Configuration Disclosure

Published 2026-02-06 by VulnCheck

CVE-2020-37155CWE-120

Core FTP Lite 1.3 - Denial of Service (PoC)

Published 2026-02-06 by VulnCheck

CVE-2020-37154CWE-89

eLection 2.0 - 'id' SQL Injection

Published 2026-02-06 by VulnCheck

CVE-2020-37147CWE-89

ATutor 2.2.4 - 'id' SQL Injection

Published 2026-02-06 by VulnCheck

CVE-2020-37146CWE-306

Aptina AR0130 960P 1.3MP Camera - Remote Configuration Disclosure

Published 2026-02-06 by VulnCheck

CVE-2020-37141CWE-89

AMSS++ v 4.31 - 'id' SQL Injection

Published 2026-02-06 by VulnCheck

CVE-2020-37135CWE-798

AMSS++ 4.7 - Backdoor Admin Account

Published 2026-02-06 by VulnCheck

CVE-2020-37122CWE-121

SpotFTP-FTP Password Recover 2.4.8 - Denial of Service

Published 2026-02-06 by VulnCheck

CVE-2020-37109CWE-120

aSc TimeTables 2020.11.4 - Denial of Service

Published 2026-02-06 by VulnCheck

CVE-2020-37107CWE-120

Core FTP LE 2.2 - Denial of Service

Published 2026-02-06 by VulnCheck

CVE-2020-37106CWE-352

Business Live Chat Software 1.0 - Cross-Site Request Forgery (Add Admin)

Published 2026-02-06 by VulnCheck

CVE-2020-37095CWE-121

Cyberoam Authentication Client 2.1.2.7 - Buffer Overflow (SEH)

Published 2026-02-06 by VulnCheck

CVE-2026-25804CWE-287CWE-770

Antrea has invalid enforcement order for network policy rules caused by integer overflow

Published 2026-02-06 by GitHub_M

CVE-2026-25793CWE-347

Nebula Has Possible Blocklist Bypass via ECDSA Signature Malleability

Published 2026-02-06 by GitHub_M

CVE-2026-25803CWE-798

3DP-MANAGER Uses Hard-coded Credentials

Published 2026-02-06 by GitHub_M

CVE-2026-25762CWE-400CWE-770

AdonisJS vulnerable to Denial of Service (DoS) via Unrestricted Memory Buffering in PartHandler during File Type Detection

Published 2026-02-06 by GitHub_M

CVE-2026-25754CWE-1321

AdonisJS multipart body parsing has Prototype Pollution issue

Published 2026-02-06 by GitHub_M

CVE-2026-25749CWE-122

Heap Overflow in Vim

Published 2026-02-06 by GitHub_M

CVE-2026-25644CWE-295

DataHub's LDAP Ingestion Source vulnerable to MITM attack through TLS downgrade

Published 2026-02-06 by GitHub_M

CVE-2026-25757CWE-639

Unauthenticated Spree Commerce users can view completed guest orders by Order ID

Published 2026-02-06 by GitHub_M

CVE-2026-2070CWE-120CWE-119

UTT 进取 520W formPolicyRouteConf strcpy buffer overflow

Published 2026-02-06 by VulDB

CVE-2026-25763CWE-78

Command Injection on OpenProject repositories leads to Remote Code Execution

Published 2026-02-06 by GitHub_M

CVE-2026-25764CWE-80

OpenProject vulnerable to Stored HTML injection

Published 2026-02-06 by GitHub_M

CVE-2026-2069CWE-121CWE-119

ggml-org llama.cpp GBNF Grammar llama-grammar.cpp llama_grammar_advance_stack stack-based overflow

Published 2026-02-06 by VulDB

CVE-2026-1731CWE-78

Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)

Published 2026-02-06 by BT

CVE-2026-1727CWE-200

Information Disclosure via Bucket Squatting in Google Cloud Agentspace.

Published 2026-02-06 by GoogleCloud

CVE-2026-25760CWE-22

Website Path Traversal / Arbitrary File Read (Authenticated) in Sliver

Published 2026-02-06 by GitHub_M

CVE-2026-2068CWE-120CWE-119

UTT 进取 520W formSyslogConf strcpy buffer overflow

Published 2026-02-06 by VulDB

CVE-2026-25758CWE-639CWE-284

Spree allows unauthenticated users can access all guest addresses

Published 2026-02-06 by GitHub_M

CVE-2025-68621CWE-208

Trilium Notes has a Timing Attack Vulnerability in /api/login/sync

Published 2026-02-06 by GitHub_M

CVE-2026-25123CWE-918

Homarr affected by Unauthenticated SSRF / Port-Scan Primitive via widget.app.ping

Published 2026-02-06 by GitHub_M

CVE-2026-25533CWE-835

Enclave has a sandbox escape via infinite recursion and error objects

Published 2026-02-06 by GitHub_M

CVE-2026-25516CWE-79

NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content

Published 2026-02-06 by GitHub_M

CVE-2026-25732CWE-22

NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write

Published 2026-02-06 by GitHub_M

CVE-2026-25544CWE-89

Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters

Published 2026-02-06 by GitHub_M

CVE-2026-25574CWE-639

Payload Affected by Cross-Collection IDOR in payload-preferences Access Control (Multi-Auth Environments)

Published 2026-02-06 by GitHub_M

CVE-2026-2067CWE-120CWE-119

UTT 进取 520W formTimeGroupConfig strcpy buffer overflow

Published 2026-02-06 by VulDB

CVE-2026-25580CWE-918

Pydantic AI Affected by Server-Side Request Forgery (SSRF) in URL Download Handling

Published 2026-02-06 by GitHub_M

CVE-2026-25581CWE-79

SCEditor affected by DOM XSS via emoticon URL/HTML injection

Published 2026-02-06 by GitHub_M

CVE-2026-25593CWE-78CWE-306

OpenClaw Affected by Unauthenticated Local RCE via WebSocket config.apply

Published 2026-02-06 by GitHub_M

CVE-2026-25597CWE-208

PrestaShop has a time based enumeration in FO login form

Published 2026-02-06 by GitHub_M

CVE-2026-25628CWE-73

Qdrant affected by arbitrary file write via `/logger` endpoint

Published 2026-02-06 by GitHub_M

CVE-2026-25592CWE-22

Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDK

Published 2026-02-06 by GitHub_M

CVE-2026-25631CWE-20

Domain allowlist bypass enables credential exfiltration

Published 2026-02-06 by GitHub_M

CVE-2026-2066CWE-120CWE-119

UTT 进取 520W formIpGroupConfig strcpy buffer overflow

Published 2026-02-06 by VulDB

CVE-2026-25729CWE-863

DeepAudit Affected by User Enumeration via Broken Access Control

Published 2026-02-06 by GitHub_M

CVE-2026-25632CWE-502

EPyT-Flow has unsafe JSON deserialization (__type__)

Published 2026-02-06 by GitHub_M

CVE-2026-25634CWE-119CWE-123CWE-628CWE-682

iccDEV memcpy-param-overlap in CIccTagMultiProcessElement::Apply()

Published 2026-02-06 by GitHub_M

Load more ↓