2026

A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS mod

The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization

Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-im

The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin

DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Stor

Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET

Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Electric MELSEC iQ-F Series FX5-E

The User Admin Simplifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in

An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing l

An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related

Improper input validation in AVer PTC500S, PTC115, PTC500+, and PTC115+ cameras may allow a remote, unauthenticated att

SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-sup

Open redirect in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honoured the user

Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL

HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, regions, and update-server endpoi

Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqledit

Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that th

SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<description>'`` for a user-su

PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs w

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote a

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode appro

PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequ

A static credential embedded in Chef 360 prior to v1.7.0 permitted unauthenticated access to internal message queues.  Q

Impact A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information ove

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, the t

phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryC

Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.

Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthor

Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network.

Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that all

Relyra is a strict-by-default SAML 2.0 Service Provider library for Elixir and Phoenix. Versions 1.0.0 and 1.1.0 accept

mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. In versions 3.0.1 and

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. Vers

OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.untar() creates symbolic

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture in

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.10.0 contain a stack buffer ove

libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink()

OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function wi

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, a symlink

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, when upda

pam_usb provides hardware authentication for Linux using ordinary removable media. In versions prior to 0.9.2, pam_usb c

pam_usb provides hardware authentication for Linux using removable media. In versions prior to 0.9.2, getenv() environm

nanobot is a personal AI assistant. In versions 0.1.5.post3 and prior, the WhatsApp bridge in bridge/src/whatsapp.ts con

Bitnami MariaDB Galera container images and Helm chart are affected by a hardcoded default credential vulnerability in t

Bitnami Cassandra container images are affected by a retained default superuser vulnerability. When a custom administrat

Coturn is a free open source implementation of TURN and STUN Server. Versions prior to 4.11.0 contain a stored cross-sit