2026

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allo

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements

As part of Cisco's ongoing commitment to proactive security and product quality, the engineering team for Cisco License

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team h

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team h

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team h

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team h

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team h

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco networking engineering team h

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has co

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has co

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has co

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has co

Homer is open source telecom observability software. Prior to version 11.0.283, the `V4StatisticsQuery` handler passes t

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker t

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdoc

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to tak

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allow

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote

libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances th

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_index_walk_down() in libntfs-3g/index.c that allows an

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node pack

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node pack

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an att

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an

wger is a free, open-source workout and fitness manager. Prior to version 2.6, a user with only the `gym_trainer` permis

wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corru

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap

llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allo

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remo

A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extrac

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in t

Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerabi

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post

GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell comman

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious reposi

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permiss

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post titl

An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated at

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software So

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynami