2026

An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attack

A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attack

A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator ac

A NULL pointer dereference vulnerability has been reported to affect QTS, QVP, QuTS cloud and QuTS hero. If a remote att

QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250

QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version:

A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.3, and 6.0

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.6, 5.3.5, 5.4.4, 5.5.4, and 6.0

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, several ESP-TEE secu

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee componen

ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.2.7, 5.3.5, 5.4.4, 5.5.4, and 6.0

Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version

SimpleBLE is a cross-platform library and bindings for Bluetooth Low Energy (BLE). Prior to version 0.14.0, there are mu

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any aut

BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver that, when user

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authen

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to versio

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardc

SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to versio

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDep

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have t

Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. From version 21.0 to before version 51.2, a guest can

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From versi

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. network-

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any pac

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a

Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persist

Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (app

Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to int

Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on t

When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending r

Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Sup

A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a rep

Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs du

Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, al

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also c

Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowE

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser

Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to int