- [webapps] Metabase 0.61.0 - Authenticated Remote Code Execution
- [webapps] FreePBX 17.0.2 - Remote Code Execution (RCE)
- [hardware] Fullhan FH8626V100 - Multiple Vulnerabilities
- [webapps] Langflow 1.10.0 - RCE
- [webapps] Ghost_CMS 6.19.0 - Remote Code Execution
- [webapps] PodcastGenerator 3.2.9 - Stored XSS
- [webapps] Marimo 0.20.4 - RCE
- [webapps] Bludit CMS 3.20.0 - Reflected Cross-Site Scripting
- [dos] EVerest 2025.9.0 - DoS
- [webapps] Payload CMS 3.72.0 - Blind SQL Injection
- [webapps] miniOrange 5.4.3 - Unauthenticated Auth Bypass
- [webapps] Grav CMS 2.0.7 - RCE
- [webapps] Bludit CMS - Stored XSS
- [webapps] Wolf CMS 0.8.3.1 - RCE v
- [webapps] EasyAppointments 1.5.1 - Blind SQL Injection
- [webapps] CubeCart 6.7.4 - SQL injection
- [webapps] C-MOR 6.0104 - Directory Traversal
- [webapps] C-MOR 6.0104 - Cross-Site Scripting (XSS)
- [webapps] Langflow 1.8.4 - Path Traversal to Remote Code Execution
- [webapps] Linksys E1200_2.0.04 - Unauthenticated OS Command Injection