2026

A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of t

Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability

Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability that allows network-

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (wi

Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure fil

Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure fil

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js

BrowserStack Runner through 0.9.5 contains a remote code execution vulnerability in the /_log HTTP handler that allows u

authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Sou

CloudburstMC Protocol is a protocol library for Minecraft Bedrock Edition. Prior to version 3.0.0.Beta12-20260420.182526

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of st

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-

A vulnerability has been found in SourceCodester Human Resource Management 1.0. Affected by this vulnerability is an unk

A flaw has been found in code-projects Student Admission System 1.0. Affected is an unknown function of the file /index.

A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This

Improper input validation in NI-PAL may allow a local authenticated user to access arbitrary system memory, potentially

Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service

An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item. Thi

The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, a

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_priv

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory

Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authen

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the IPv4 packet parser. In src/simple_packe

Improper Encoding or Escaping of Output vulnerability in elixir-tesla tesla allows multipart part header injection via u

Allocation of Resources Without Limits or Throttling vulnerability in elixir-tesla tesla allows denial of service via at

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in elixir-te

Improper Handling of Case Sensitivity vulnerability in elixir-tesla tesla allows credential leakage to a third-party ori

Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-tesla tesla allows a denial of

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set wit

React Router is a router for React. In versions 7.0.0 through 7.14.x of react-router and versions 2.10.0 through 2.17.4

React Router is a router for React. In versions 7.0.0 through 7.14.1, when using Framework Mode, a combination of steps

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response proces

React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to th

CrowCpp Crow through v1.3.1 HTTP is vulnerable to response header injection via unvalidated response header values.

Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has

wire-ios is an iOS client for the Wire secure messaging application. Prior to version 4.16.0, upon receiving a crafted m

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJ

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Co

Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS.

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Co

Cross Site Scripting vulnerability in usememos Memos v.0.26.0 allows a remote attacker to obtain sensitive information v

SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause

The Content Visibility for Divi Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up t

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 151.0.3.

Incorrect boundary conditions in the Graphics: Text component. This vulnerability was fixed in Firefox 151.0.3.

A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.11.3. This affects the function resolveAut

A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function TeamTasksTo

A security flaw has been discovered in DedeCMS 5.7.88. This affects the function RemoveXSS of the file /plus/carbuyactio