2026

Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Reques

VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside t

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 1

The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by usin

Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login,

When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broke

Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentica

Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's manag

The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on

The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied va

The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent

Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting

The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy o

The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Serv

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attac

NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attack

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacen

MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to ex

CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows r

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote a

Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. Th

Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability.

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability

GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote

MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attac

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that vali

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursiv

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG conten

A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli

A security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an

A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The affected element is the func

A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the funct

Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configu

Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer seriali

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by d

Nuxt is an open-source web development framework for Vue.js. From 3.11.0 until 3.21.4 and 4.4.4, Nuxt compares route-rul

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.0, an incomplete fix for CVE-2026-53722 allows

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From

Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats stri

Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS ge

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19,

Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19,

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version

Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured A

NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows

GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote a

A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based acc

When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stor