HIGH Severity CVEs

The YMC Filter WordPress plugin before 3.11.3 does not properly authorize access to one of its REST API endpoints and do

Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix

A flaw in Node.js WebCrypto implementation can crash the process if the input of `subtle.encrypt()` is a multiple of 2Gi

A flaw in Node.js HTTP/2 client allows a server to send an unlimited number of ORIGIN frames, which could lead to an Out

A flaw in Node.js proxy tunnel error handling could expose proxy credentials in `ERR_PROXY_TUNNEL` error messages. Wh

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authe

The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and earlier uses MD5 to generate a request si

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior encrypts requests between the watch and i

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through

wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message when the key length exceeds the block size, producing a

iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not defined. IP address name constraints are not enforced

PKCS7_verify signer confusion allows forged signatures, where the signer associated with a signature is not correctly bo

HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-length tag could be accepted as valid during HMAC ve

Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversized signature algorithms list, allowing a write pas

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to

The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absenc

vtk vtk-dicom vtkDICOMItem::NewDataElement heap-based buffer overflow vulnerability

Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a

Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the rend

A flaw was found in Apicurio Registry. The WSDLReaderAccessor creates a wsdl4j WSDLReader without disabling the javax.ws

A flaw was found in Apicurio Registry. The ContentTypeUtil.isParsableXml() method creates a SAXParserFactory without ena

A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an a

Missing SNI/ALPN binding on stateful (session-ID) resumption, which previously skipped the binding check performed for t

picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode

Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens aft

Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their accou

Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-fil

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the of

Parse Server before 4.10.0 contains a supply chain vulnerability where incorrect version tags were pushed to the reposit

X.509 name constraint bypass via the Subject Common Name when treated as a DNS-type name. A certificate whose Subject CN

A heap buffer overflow could occur in the DTLS 1.3 ACK serialization path before the connecting peer is authenticated. T

A reachable unwrap in the __assert_fail function (/assert/mod.rs) of relibc commit 61f42d allows attackers to cause a De

An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensit

Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter wit

Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users wi

Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 certificate, bypassing chain validation. A raw pub

Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In tsip_StoreMessage() the capacity check guarding th

The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image cont

The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensit

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensit

GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0 was discovered to contain a SQL injection vulnerabil

Out-of-bounds heap read during SM2/SM3 certificate signature verification. When parsing a certificate with an SM3wSM2 si

X.509 trust-chain bypass in the OpenSSL compatibility certificate verifier (wolfSSL_X509_verify_cert()). This affects on

The X25519 x86_64 assembly implementation fails to clear the most significant bit during the final modular reduction, so

wolfSSL's AVX2-optimized ML-KEM implementation (mlkem_cmp_avx2) compares only 1536 of the 1568 ciphertext bytes during t

A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.

CANBoat through 6.22, fixed in commit a5a22b7, contains an off-by-one global buffer overflow in the searchForPgn() funct

NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that allows