2026

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenS

Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes f

Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the

Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the S

Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an autho

Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally.

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized

Unauthenticated users on the local network can cause the router to become unavailable by sending specially crafted reque

DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.

Issue summary: A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the status_requ

Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges loca

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing P

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the ciphe

Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Base

Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive element whose content exceeds 2 gigabytes

Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allo

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service all

A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended websit

Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.

NVIDIA DALI contains a vulnerability in a component where an attacker could cause an improper index validation. A succes

NVIDIA DALI contains a vulnerability in a component where an attacker could cause a heap-based buffer overflow. A succes

Omnissa Workspace ONE® Assist for macOS contains a Local Privilege Escalation Vulnerability.

An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which co

Insufficient input validation in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in 2014) allows u

Insufficient configuration management in the listed devices allows authenticated administrators connected to the local n

Insufficient input validation vulnerability in the listed NETGEAR devices allows authenticated administrators connected

An insufficient input validation vulnerability in certain NETGEAR router models as listed allows an authenticated admini

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected t

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected t

A buffer overflow vulnerability due to insufficient input validation in the listed NETGEAR models allows authenticated a

Insufficient input validation vulnerability in NETGEAR JR6150 (AC750 WiFi Router 802.11ac Dual Band Gigabit released in

An information disclosure vulnerability in the NETGEAR Orbi satellites (RBR/RBE/RBS Series) could allow a user connected

Authenticated administrators connected to the local network can gain elevated access to the router and make unauthorize

A NETGEAR security issue that could allow an attacker with ability to intercept and tamper with traffic between the rout

CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosu

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information T

Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted s

A improper access control vulnerability in Fortinet FortiPortal 7.4.0 through 7.4.7, FortiPortal 7.2.0 through 7.2.8, Fo

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet F

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability in the privile

Waves Central for macOS versions 13.0.9 through 16.5.5 contain a local privilege escalation vulnerability. A trusted XPC

An OS command injection vulnerability in Ivanti EPMM before 12.9.0.1, 12.8.0.3 and 12.7.0.2 versions allows a remote aut

An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allow