2026

ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This v

Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypass URL scheme validat

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisi

Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attackers to achieve remo

Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymou

Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() function that allows a

Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remote attackers to issue

OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/applicati

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within t

LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (SSRF). An unauthenti

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthentica

Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be

Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the

Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its

Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote u

Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generato

Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to m

mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that allows attackers to re

Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or rea

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy completion for multi-skb

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leak in hci_le_big_

Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record. retr

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect re

In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-DAGs permission reso

The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling S

Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload fu

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php en

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint

Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() routine). This issue

Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could b

Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaust

Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may

A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged d

A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an unknown part of the

The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API respons

A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. Affected by this issu

Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability. The flaw is located

Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels per

Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams end

Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration change

Self Cross-Site Scripting (Self-XSS) vulnerability in the RD Station Conversas chat feature. The vulnerability lies in t

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Co

Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectl

Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Acc

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-sea

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Ele

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-re

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-pictu

Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbn