2026

A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the

A vulnerability was determined in automad up to 2.0.0-beta.32. This vulnerability affects the function requestPasswordRe

openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of op

A vulnerability was found in karakeep-app karakeep up to 0.32.0. The affected element is the function authorize of the f

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The support

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security). The support

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The suppor

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The suppo

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to a pat

Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an at

SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the Se

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of t

tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncat

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on bro

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist ca

A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVar

Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock

Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string compar

HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive inf

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/s

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of th

Kimai before 2.54.0 contains a timing oracle vulnerability in TokenAuthenticator that allows unauthenticated attackers t

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network be

In specific scenarios involving multiple clients with different DNS resolver configurations, Reactor Netty may incorrect

HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised possibly allo

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that

NLTK before 3.10.3 contains a regular expression denial of service vulnerability in Pl196xCorpusReader that allows attac

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() gener

Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing an

A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file sr

When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes

Zephyr's WireGuard implementation in subsys/net/lib/wireguard/wg_crypto.c mishandled keepalive packets. In wg_process_da

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter

free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the AUSF component performs cryptograph

### Summary When `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value un

A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866_B20220506. This vulnerability affects the function loginAu

Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.add

An issue has been identified in Arm C1-Pro before r1p2-50eac0, where, under certain conditions, a TLBI+DSB might fail to

Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API ca

Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Access Control vulnerability. A l

Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process

OpenClaw versions prior to 2026.2.19 contain a race condition vulnerability in concurrent updateRegistry and removeRegis

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line. This r

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) s

Permission control vulnerability in the app management and control module. Impact: Successful exploitation of this vulne