2026

A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /

A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImage

A vulnerability was detected in itsourcecode Online Cake Ordering System 1.0. This affects an unknown part of the file /

A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the functio

GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() passes unbounded hexadecimal, octal

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() repeatedly slices and rejoins every

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled prope

toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, the toml.parse() compiler's addTableArray() func

The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. From 5.4

Sentry-Javascript is an official Sentry SDKs for JavaScript. From 9.36.0 until 9.47.2, 10.75.2, and 11.0.0-rc.1, the web

Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in

Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framewor

Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl allow memory exhaustion via a never-cleared failure s

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validat

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When

A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function Sa

A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.1. Affected is the function RenameFileHandler o

A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file inte

A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the

Django REST framework is a toolkit for building Web APIs. From 3.6.4 until 3.18.2, JSONParser.parse in rest_framework/pa

Jupyter Server is the backend for Jupyter web applications. From 2.0.0 until 2.6.0, enabling GatewayClient.url replaced

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SD

Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close w

Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.d

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate requir

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one cl

Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers und

Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the s

Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header th

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length valu

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file,

The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse() (drivers/espi/espi_npcx.c),

The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it

The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails

The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmux_select_get() and d

The user-mode verifier for the peci_transfer() system call, z_vrfy_peci_transfer() in drivers/peci/peci_handlers.c, chec

The Bluetooth Classic A2DP host stores a codec Information Element (IE) in struct bt_a2dp_codec_ie, a one-byte len field

A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py

A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of

A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the

A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the fun

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editabl

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library direct

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Tr

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unva