آخرین آسیب‌پذیری‌ها

Guest access to Firecracker process memory after a failed memory discard

Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle

Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser

Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication

Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission

Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels

Zulip: Missing content-length limit on POST /messages/render allows denial-of-service via oversized requests

OmniAuth: Host Header Injection Vulnerability

ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary

ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

Linksys E5350 apply.cgi system os command injection

Zammad: Stored XSS in ticket article rendering in the new Vue-based interface

ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsing

Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection

DeepSeek Harness Unauthenticated RPC Command Execution

Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection

In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI contro…

Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal

EmpireSoft EmpireCMS index.php cross site scripting

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root…

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.

InfiniFlow RAGFlow Images API file_utils.py cross site scripting

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain…

DataGerry < 3.3.0 SSTI via DocAPI Template Rendering