EUVD-2026-5038

Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal device behavior by crafting specific messages...

CVE-2026-22626

Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal device behavior by crafting specific messages...

CVE-2026-22625

Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files...

CVE-2026-22625

Technical details for CVE-2026-22625 are not provided in the supplied documents beyond the basic description; monitor for updates from Hiksemi and Red Hat advisories.

CVE-2026-22624

Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without proper authorization...

EUVD-2026-5035

Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specific messages...

BIT-GITEA-2026-20897 Gitea Git LFS Lock Deletion Broken Access Control (Cross-Repo IDOR)

Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to one repository may be able to delete LFS locks belonging to other repositories...

OpenText Vertica security vulnerabilities

OpenText Vertica is a relational database management system RDBMS from OpenText Canada. It can efficiently store massive amounts of data. Versions 23.X, 24.X, and 25.X of OpenText Vertica have security vulnerabilities. These vulnerabilities stem from the storage of sensitive information in...

Hiksemi NAS security vulnerabilities

HIKSEMI NAS is a private cloud storage device of China’s HIKSEMI Corporation. There is a security vulnerability in HIKSEMI NAS, which stems from insufficient access control. This vulnerability may allow authenticated users to operate on other users’ file resources without proper authorization...

Dolibarr cross-site scripting vulnerabilities

Dolibarr is an open-source application developed by Dolibarr developers. It helps manage activities of user organizations. Version Dolibarr 11.0.3 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper cleaning of the host, slave, and port parameters in LDAP...

Sellacious eCommerce cross-site scripting vulnerability

Sellacious eCommerce is an e-commerce platform software developed by the Sellacious company. Version 4.6 of Sellacious eCommerce contains a cross-site scripting vulnerability. This vulnerability arises from improper cleaning of input fields such as names, companies, and addresses in the Manage Yo...

Hiksemi NAS security vulnerabilities

HIKSEMI NAS is a private cloud storage device of China’s HIKSEMI Corporation. There is a security vulnerability in HIKSEMI NAS, which stems from improper handling of file names, potentially leading to the disclosure of sensitive system files...

ZOHO’s various products have security vulnerabilities

ZOHO ManageEngine NetFlow Analyzer is a product of the American company ZOHO. ZOHO ManageEngine NetFlow Analyzer is a web-based bandwidth monitoring tool. ZOHO ManageEngine OpManager is a comprehensive network monitoring software. ZOHO ManageEngine OpUtils is software for managing IP addresses an...

Tryton cross-site scripting vulnerabilities

Tryton is an open-source content management system developed by Tryton. Version 5.4 of Tryton contains a cross-site scripting vulnerability, which stems from improper cleaning of user profile names. This vulnerability may lead to storage-based cross-site scripting attacks...

PT-2026-5432

Cleartext Storage of Sensitive Information vulnerability in OpenText™ Vertica allows Retrieve Embedded Sensitive Data. The vulnerability could read Vertica agent plaintext apikey.This issue affects Vertica versions: 23.X, 24.X, 25.X...

ChurchCRM cross-site scripting vulnerability

ChurchCRM is an open-source CRM system developed for churches. Versions of ChurchCRM prior to 6.7.2 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper cleaning of input fields related to calendar event descriptions, which could lead to storage-based cross-sit...

Active Storage security vulnerability

Active Storage is a plugin that allows for file uploads to various cloud storage services and attaches files to Active Record objects. There is a security vulnerability in Active Storage, which stems from the use of potentially insecure image conversion methods, potentially leading to command...

Hiksemi NAS security vulnerabilities

HIKSEMI NAS is a private cloud storage device of China’s HIKSEMI Corporation. There is a security vulnerability in HIKSEMI NAS, which stems from insufficient validation of interface input parameters. This vulnerability may cause unauthorized users to trigger abnormal behaviors on the device...

IBM Db2 security vulnerabilities

IBM Db2 is a relational database management system developed by IBM. The system can run on various operating systems such as UNIX, Linux, IBMi, z/OS, and Windows server versions. Versions 11.5.0 to 11.5.9, as well as 12.1.0 to 12.1.3 of IBM Db2, have security vulnerabilities. These vulnerabilitie...

Hiksemi NAS security vulnerabilities

HIKSEMI NAS is a private cloud storage device of China's HIKSEMI Corporation. There is a security vulnerability in HIKSEMI NAS, which stems from insufficient validation of interface input parameters. This vulnerability may allow authenticated users to execute arbitrary commands...