What needs attention now.

Memory overflow vulnerability leading to Denial of Service

• NetScaler ADC
• NetScaler Gateway
• Memory corruption

Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration

• NASA-AMMOS AIT-Core
• Authentication bypass

MLS X.509 credential not bound to the LeafNode signature key

• Legion of the Bouncy Castle Inc. BC-JAVA
• Authentication bypass
• Weak cryptography or TLS

Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output

• beaverbuilder Beaver Builder Page Builder – Drag and Drop Website Builder
• Code injection

VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter

• e4jvikwp VikAppointments Services Booking Calendar
• Path traversal

C4illin ConvertX: In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files…

• C4illin ConvertX
• CWE-829

gitea-runner: workflow container.options passes host namespaces and capability flags to job container when privileged mode is disabled

• Privilege escalation

<1.0.9-0.20260731160927-34bfa1915022 · fixed in 1.0.9-0.20260731160927-34bfa1915022

Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain

• Information disclosure
• Authentication bypass

>=0.1.0, <0.1.7 · fixed in 0.1.7

Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure Compromise

• CWE-653
• CWE-1393

<4.5.6 · fixed in 4.5.6

MikroTik RouterOS Integer Underflow

• MikroTik RouterOS
• Memory corruption

Monta monta.app Missing Authentication for Critical Function

• monta.app
• Authentication bypass

OS Command Injection in Digi Accelerated Linux (DAL OS)

• Digi International IX Family
• Digi International EX Family
• Command injection

UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter

• UTMStack
• Authentication bypass

OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio

• AWS sagemaker-distribution
• Command injection

Missing authentication for critical function in Loom for AWS

• AWS loom
• Authentication bypass
• CWE-1188

H3C CVM Unauthenticated File Upload via fileUpload/upload Token

• H3C CVM
• Unrestricted file upload

Use after free in Google Chrome

• Google Chrome
• Memory corruption

Incorrect authorization in Google Chrome

• Google Chrome
• Broken access control

Out-of-bounds write in Google Chrome

• Google Chrome
• Memory corruption

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader

• demsking image-downloader
• Path traversal

Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

• GitLab AI Gateway
• Code injection

Divi Membership <= 2.2.0 - Unauthenticated Privilege Escalation via 'form_id' Parameter

• DiviEngine Divi Membership
• Privilege escalation

Apache Thrift: C++ THttpTransport grows its line buffer without bound

• Apache Software Foundation Apache Thrift
• Memory corruption
• Denial of service

Tenda AC9 POST Request fast_setting_internet_set stack-based overflow

• Tenda AC9
• Memory corruption

Tenda HG7/HG9/HG10 Boa Web Server formLoopBack boaGetVar stack-based overflow

• Tenda HG7
• Tenda HG9
• Memory corruption

Wasmtime component async-lifted callback result count is unvalidated, causing a native stack buffer overflow

• CWE-20

Published by the maintainers · not yet reviewed by GitHub

>=39.0.0, <48.0.4 || >=49.0.0, <49.0.2 · fixed in 48.0.4, 49.0.2

YesWiki before 4.6.7 Authorization Bypass via Public API Mode

• yeswiki
• Broken access control

Apache Thrift: C++ `THeaderTransport::transform()` heap buffer overflow (write direction)

• Apache Software Foundation Apache Thrift
• Memory corruption

Stack-based buffer overflow in Moxa MGate MB3170 Series and others

• Moxa MGate MB3170 Series
• Moxa MGate MB3270 Series
• Memory corruption

Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements

• Apache Software Foundation Apache Directory LDAP API
• Insecure deserialization

WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter

• amauric WPMobile.App – Android and iOS App Builder
• Broken access control

JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

• parorrey JSON API Auth
• Authentication bypass

MTI/A0 DHAgreement does not validate the peer's ephemeral value

• Legion of the Bouncy Castle Inc. bc-csharp
• CWE-20

Cross-site scripting in Webpros cPanel and others

• Webpros cPanel
• Webpros WP Squared
• Cross-site scripting (XSS)

Cross-site scripting in Webpros cPanel and others

• Webpros cPanel
• Webpros WP Squared
• Cross-site scripting (XSS)

OS command injection in Webpros cPanel and others

• Webpros cPanel
• Webpros WP Squared
• Command injection

Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter

• WebRehab Super Forms – Drag & Drop Form Builder
• CWE-26

Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

• DiviEngine Divi Membership
• Authentication bypass

DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow

• dplugins DevKit Pro
• Authentication bypass

Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership

• Discord libdave
• Broken access control
• CWE-390

agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py).

• Code injection

FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().

• Code injection

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller.

• Broken access control

vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py).

• Code injection

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server file…

• Path traversal

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.

• Broken access control

sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.

• Code injection

389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• CWE-923

Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport

• kvcache-ai Mooncake
• Memory corruption

SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability

• Thales SConnect
• Weak cryptography or TLS
• Memory corruption

Hard-coded cryptographic key in Johnson Controls EasyIO FS32

• Johnson Controls EasyIO FS32
• Hard-coded credentials

Hardcoded Passwords in Teledyne FLIR Robots running Aware2

• Teledyne FLIR Aware2
• Hard-coded credentials

Local File Inclusion in Teledyne FLIR Robots running Aware2

• Teledyne FLIR Aware2
• Path traversal

Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2

• Teledyne FLIR Aware2
• Weak cryptography or TLS

Cadmos LTI exposure of sensitive information via debug mode

• Eummena Cadmos LTI
• CWE-215
• CWE-489

Joyland AI WebView command injection

• Joyland.ai
• CWE-749

GetSimple CMS: Missing CSRF protection in UpdateCE allows forging a privileged server-side update request

• GetSimpleCMS-CE
• Cross-site request forgery (CSRF)

GetSimple CMS: CSRF, SSRF, and Unrestricted Zip Extraction

• GetSimpleCMS-CE
• Cross-site request forgery (CSRF)
• Unrestricted file upload

GetSimple CMS: Predictable Password Reset Password Allows Administrator Account Takeover

• GetSimpleCMS-CE
• Weak cryptography or TLS
• CWE-640

Path traversal in Fortinet FortiMail

• Fortinet FortiMail
• Path traversal