2026

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() all

Handlebars provides the power necessary to let users build semantic templates. From 4.0.0 until 4.7.10, Handlebars.preco

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large widt

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character ou

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed s

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Re

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the ma

Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.

Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL ch

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCE

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (H

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before bei

Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed imag

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that cau

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested r

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Alloc

Uncaught Exception (CWE-248) in Elastic Endpoint can lead to denial of service via a specially crafted file name. When E

Incorrect Authorization (CWE-863) in Kibana can lead to sensitive information disclosure via Accessing Functionality Not

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excess

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Co

Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an El

Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expressi

Incorrect Authorization (CWE-863) in Elasticsearch can lead to unauthorized data stream modification via Accessing Funct

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAP

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a ca

On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Ca

Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an

An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authen

Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticate

Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, whe

Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct re

Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct re

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS a

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote a

Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain a Plaintext Storage of Password vulnerability. A low

In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permissio

In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This

In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code.

Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system a

Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromise

Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the rend

Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin po

Incorrect calculation in API in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging

Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social eng

Code injection in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social enginee

Information leak in Enterprise in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to leak sensitive infor

Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the rend

Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromis

Protection mechanism failure in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to by

Incorrect authorization in GetUserMedia in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compro