CVE-2026-23481: Improper Limitation of a Pathname to a Restricted Directory

Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an authenticated arbitrary file write vulnerability in saveAdditionalDevFile. This issue has been patched in version 1.8.4...

CVE-2026-1940: Out-of-bounds Read

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gstwavparseadtlchunk function. The patch added a size validation check lsize + 8 size, but it does not account for the GSTROUNDUP2lsize used in the actual offset calculation. When lsize is an odd number, the parser advances more...

CVE-2026-32969: Improper Neutralization of Special Elements used in an SQL Command

An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality...

Exploit for Integer Overflow or Wraparound in Qualcomm Sm7675P_Firmware

CVE-2026-21385 Scanner Languages / Idiomas: Englishen...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +220 more potentially affected by unknown CVE via h3 (>=1.0.1, <=1.15.6)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.1.0-0, =3.2.0 - @enrypase/solidstart-endpoint 0.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15745711...

CVE-2025-63261: Improper Neutralization of Special Elements used in an OS Command

AWStats 8.0 is vulnerable to Command Injection via the open function...

CVE-2026-22902: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability has been reported to affect QuNetSwitch. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version: QuNetSwitch 2.0.5.0906 and later...

CVE-2025-62846: Improper Neutralization of Special Elements used in an SQL Command

An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit the vulnerability to execute unauthorized code or commands. We have already fixed the vulnerability in the following version: QuRouter 2.6.2.007 and later...

CVE-2026-31926: Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

CVE-2026-28204: Insufficiently Protected Credentials

Charging station authentication identifiers are publicly accessible via web-based mapping platforms...

CVE-2026-25192: Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...

CVE-2026-31382: Improper Neutralization of Input During Web Page Generation

The errordescription parameter is vulnerable to Reflected XSS. An attacker can bypass the domain's WAF using a Safari-specific onpagereveal payload...

CVE-2026-31903: Improper Restriction of Excessive Authentication Attempts

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain...

CVE-2025-46597: Integer Overflow or Wraparound

Bitcoin Core 0.13.0 through 29.x has an integer overflow...

CVE-2026-31381: Use of GET Request Method With Sensitive Query Strings

An attacker can extract user email addresses PII exposed in base64 encoding via the state parameter in the OAuth callback URL...

CVE-2026-29796: Missing Authentication for Critical Function

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then...

CVE-2026-32663: Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

CVE-2026-22163: Missing Synchronization

Requires malware code to misuse the DDK kernel module IOCTL interface. Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages. The product utilises a shared resource in a concurrent manner but does not attempt t...

CVE-2024-44722: Improper Control of Generation of Code

SysAK v2.0 and before is vulnerable to command execution via aaa;cat /etc/passwd...

CVE-2026-4519: Improper Input Validation

The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open...