2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A ba

Improper Privilege Management vulnerability in Citrix Secure Access Client for Windows, Citrix Citrix Endpoint Analysis

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OpenMeetings. Th

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw.

A weakness has been identified in Tenda BE12 Pro 16.03.66.23. This vulnerability affects the function fromSafeUrlFilter

A security flaw has been discovered in Tenda BE12 Pro 16.03.66.23. This affects the function fromSafeClientFilter of the

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowed

An attacker with access to an HX 10.0.0  and previous versions, may send specially-crafted data to the HX console. The m

A security issue exists within the 1715-AENTR EtherNet/IP Adapter. The affected product exposes a network-accessible deb

The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Di

A vulnerability was identified in open62541 up to 1.5.5. Affected by this issue is the function responseReadNamespacesAr

In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 aut

A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time

Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated

A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate

A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handl

Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerabilit

DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text. DBI::SQL::Nano,

Privilege escalation in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (

The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block

A vulnerability has been identified in COMOS V10.4.5 (All versions < V10.4.5.0.2), COMOS V10.6 (All versions < V10.6.1),

Eclipse Kura versions prior to 5.6.2 trust the client-supplied X-Forwarded-For HTTP header as the authoritative source o

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of:

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and

Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP/2 server to exhaust memory

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the Enc

Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constra

Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory o

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backen

A flaw was identified in Argo CD, the GitOps engine used by Red Hat OpenShift GitOps, that could allow an unauthenticate

Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can

In versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), the WebClientSession component of Eclipse Ve

In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx

In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existenc

Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line,

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests

A Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in SUSE Virtual Machine Driver Pa

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is parti

An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in B

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user

A security vulnerability has been detected in code-projects Online Job Portal 1.0. This impacts an unknown function of t

A weakness has been identified in code-projects Online Job Portal 1.0. This affects an unknown function of the file /Job

A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown fun

A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of th

A vulnerability was determined in itsourcecode Electronic Judging System 1.0. Impacted is an unknown function of the fil

A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file

The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentica

The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through

The AI Engine WordPress plugin before 3.5.5 does not sanitize a user-supplied filename before using it to write a downl