2026

Reliance on IP Address for Authentication vulnerability in Erlang/OTP ssl (inet_tls_dist module) allows unauthenticated

Observable Timing Discrepancy vulnerability in Erlang/OTP ssh (ssh_auth, ssh_options modules) allows unauthenticated rem

Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and S

Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Dat

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows Fil

OpenFGA is an authorization/permission engine built for developers. Prior to version 1.16.0, when iterator caching is en

Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization

Crawlee is a web scraping and browser automation library. From version 1.0.0 to before version 1.7.0, Crawlee is vulnera

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, om

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, th

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, th

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, Es

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: thr

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manag

A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could a

A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute a

A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese mark

A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticate

libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection

A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN),

A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connecti

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a s

A flaw was found in migration-planner-ui-app. An attacker can register a malicious discovery agent with a specially craf

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PO

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, GE

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, th

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, wr

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ge

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, th

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PO

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, th

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PU

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, ag

A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the oc_superior

During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some

During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller fi

Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before stor

Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-prov

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not ensure that the "from" parameter in the "Delegate to servlet

Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permis

A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permi

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately

Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrar

Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows at

Ghidra before 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values dir