2026

Deskin through 3.3.4.3 contains a privilege escalation vulnerability in the com.deskin.service.installer XPC service tha

System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows l

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a server-side request forgery and missin

@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export function

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticat

IBM Guardium Data Protection 12.2 is vulnerable to a signature verification bypass in the patch installer. An attacker w

IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in th

IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component. A low-privi

IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login

IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol pars

IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protoc

Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that all

IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper c

IBM Guardium Data Protection 12.2.2 is affected by a denial-of-service vulnerability in the edge-controller. An unauthen

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlock

dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype b

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.

MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to

An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow

Improper state management in MongoDB libmongocrypt can cause provider-specific data to be treated as an incompatible typ

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-con

webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser perf

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice arc

Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Doc

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard

Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based acc

JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice arc

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte len

An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authentica

A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/d

msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively i

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.

Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue a

Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that a

Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious M

An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c) of wolfSSL v5.9.1 and v5.9.2 allows attackers to

The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 throug

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 throug

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 throug

IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 throug

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 throug

ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQue

Insufficient job validation for service accounts in Jacamar CI prior to v0.30.0 allows authenticated CI users to generat

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.

EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows

league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavo