21222 matches found
SourceCodester Resort Reservation System SQL Injection Vulnerability
The SourceCodester Resort Reservation System is an open-source resort reservation system developed by SourceCodester. Version 1.0 of the SourceCodester Resort Reservation System has a SQL injection vulnerability. This vulnerability arises from incorrect handling of the parameter “q” in the file...
ThermaKube security vulnerabilities
ThermaKube is a Kubernetes cluster monitoring and visualization tool released under the Open Source Labs beta version. There is a security vulnerability in ThermaKube, which stems from server-side request forgery...
sunbird-portal security vulnerabilities
sunbird-portal is an open-source portal developed by Sunbird-ED. Version 1.13.4 of sunbird-portal contains a security vulnerability, which can be exploited by cross-site request forgery attacks...
FreshRSS licensing issue vulnerabilities
FreshRSS is an open-source, free, and self-hosted RSS aggregator developed by FreshRSS. There are authorization issues with FreshRSS; these vulnerabilities stem from password verification logic flaws, allowing users to successfully pass verification even with incorrect passwords...
DoraCMS authorization issue vulnerability
DoraCMS is an open-source application developed by DoraCMS. It is a content management system built using Node.js, eggjs, and MongoDB. Version 3.0.x of DoraCMS has a vulnerability related to authorization. This vulnerability stems from improper handling of files/api/v1/mail/send, which may lead t...
VoiceSHIELD-Small: Real-Time Malicious Speech Detection and Transcription
Voice interfaces are quickly becoming a common way for people to interact with AI systems. This also brings new security risks, such as prompt injection, social engineering, and harmful voice commands. Traditional security methods rely on converting speech to text and then filtering that text,...
SourceCodester Employee Task Management System SQL Injection Vulnerability
SourceCodester Employee Task Management System is an open-source employee task management system developed by SourceCodester. Versions of the SourceCodester Employee Task Management System prior to 1.0 contained a SQL injection vulnerability. This vulnerability stemmed from the handling of the Da...
Code-Projects Student Web Portal SQL Injection Vulnerability
Code-Projects Student Web Portal is an open-source student portal developed by Code-Projects. Version 1.0 of Code-Projects Student Web Portal has a SQL injection vulnerability, which stems from the handling of the regpasswd parameter in the signup.php file, potentially leading to SQL injection...
Messaging Authorization Vulnerabilities
Messages is an open-source email inbox software developed by La Suite numérique. Version 0.2.0 of Messages contains a vulnerability related to authorization issues. This vulnerability stems from operations on the ThreadAccessSerializer function in the file serializers.py, which may lead to improp...
Itsourcecode Free Hotel Reservation System SQL Injection Vulnerability
itsourcecode Free Hotel Reservation System is an open-source hotel reservation system developed by itsourcecode. Version 1.0 of the itsourcecode Free Hotel Reservation System contains a SQL injection vulnerability. This vulnerability arises from incorrect operations with the parameters amenid and...
PYSEC-2026-121
pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the editpackage function implements insufficient sanitization for the packfolder parameter. The current protection relies on a single-pass string replacement of "../", which can be...
CVE-2026-29193
Technical details for CVE-2026-29193 are not publicly available in the provided documents. No affected products, versions, root cause, or patch specifics are described beyond the initial entry. Monitor for updates from vendors and security advisories.
CVE-2026-27796
Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service...
EUVD-2026-10117
Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. Prior to version 3.4.0, an unauthenticated information disclosure vulnerability exists in the GET /api/v1/status-page/:url...
EUVD-2026-10122
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, Wallos allows an authenticated user to delete avatar files uploaded by other users. The avatar deletion endpoint does not verify that the requested avatar belongs to the current user. As a result, any...
EUVD-2026-10121
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, passwordreset.php outputs $GET"token" and $GET"email" directly into HTML input value attributes using and without calling htmlspecialchars. This allows reflected XSS by breaking out of the attribute...
EUVD-2026-10116
Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. This issue has been patched in version 4.6.2...
EUVD-2026-10112
hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user to delete any other user's PAT by providing its ID, with no ownership verification. This issue has been patched in version 2026.2.1...
