2026

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modu

An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

An authenticated user may view private Puppet module metadata without repository read access.

An authenticated user without repository read permission may access private OCI referrer metadata under specific conditi

An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

A bundle writer may create misleading release promotion information under specific conditions.

Apache Airflow's secrets masker hides values stored under sensitive key names when they are displayed in the UI. The mas

In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API

An authenticated user without repository read permission may access package metadata under specific conditions.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to add unexpected parameters to a command due t

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to imp

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 1

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/s

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to inject arbitrary content into Navigator log

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race c

GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that u

GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolatio

GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the c

An incorrect authorization check in the v2 Alarm REST API in OpenNMS Meridian and Horizon allows a low-privileged authen

Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a tab

Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and

HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. I

@jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version

RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Public-only API token restriction is not enforced on team API routes

Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private rep

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on pu

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads

IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive inform

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a heap b

A flaw has been found in Calix GigaSpire 26.1.0. Impacted is an unknown function of the file utilities_configurationsave

A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file tracer

Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malf

Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Fu

Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915) in the case management function

A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small docu

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a path t

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to a byte-count and eleme

Russh is a Rust SSH client & server library. Prior to 0.62.4, an authenticated SSH client can cause a denial of service

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Disciplin

A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the fi