2026

In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escalat

In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in

In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass

In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. This cou

In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to

In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to

In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead

In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when

In resolveContentProvider of ComputerEngine.java, there is a possible way to access URIs across users due to a logic err

In multiple locations, there is a possible way to reveal images across users due to improper input validation. This coul

Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain a denial-of-service vulnerability that allows remote

ZeusCart 4.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions o

WP AutoSuggest 0.24 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary S

Joomla Component JE Photo Gallery 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to e

Arm Whois 3.11 contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by overwri

No-Cms 1.0 contains an SQL injection vulnerability in the order_by parameter of the manage_privilege export endpoint tha

Paroiciel 11.20 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL que

Paroiciel 11.20 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL que

Paroiciel 11.20 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL q

Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary co

A flaw was found in gnutls. The PKCS#7 padding check, performed during decryption, was not constant-time. This timing si

The DeepAI endpoint 'https://api.deepai.org/change_user_email' accepts POST requests without any CSRF protection. If an

Nanobot prior to version 0.2.1 contains a denial of service vulnerability in the Matrix channel media download handler t

Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handl

Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the web_fetch tool that allows re

Banana Slides through 0.4.0, patched in commit e8bc490, contains a path traversal vulnerability in the generate_image()

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to acces

CodexBar prior to 0.32.0 contains a privilege escalation vulnerability in the CLI installer that allows local attackers

FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. On disc

Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Dat

A security flaw has been discovered in code-projects Hotel and Tourism Reservation System 1.0. Impacted is an unknown fu

A vulnerability was identified in code-projects Hotel and Tourism Reservation System 1.0. This issue affects the functio

A vulnerability was determined in SourceCodester SEO Meta Tag Extractor 1.0. This vulnerability affects the function get

A vulnerability was found in CodeAstro Payroll System 1.0. This affects an unknown part of the file /home_employee.php.

A vulnerability has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this issue is the functi

A flaw has been found in DevaslanPHP project-management up to 2.0.0-beta1. Affected by this vulnerability is the functio

A NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h of lwext4 1.0.0 allows attacke

Insufficient granularity of access control in ASP (AMD Secure Processor) may allow an attacker with an untrusted user sp

An Improper Access Control vulnerability in Ivanti Neurons for ITSM (cloud and on-premises) allows a remote authenticate

IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deseria

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security co

IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.

IBM i Access Family 1.1.5.0 through 1.1.9.12 IBM i Access Client Solutions (ACS) is vulnerable to remote code execution

AI Tensor Engine for ROCm (AITER) through 0.1.14 contains an unauthenticated remote code execution vulnerability in the

Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Office SharePoin

Nextcloud is an open source content collaboration platform. In Nextcloud Server from versions 31.0.0 to before 31.0.12,

Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to version 1.0.5, a null pointer deref

CloakBrowser is a tool to bypass bot detection tests. Prior to version 0.3.28, the cloakserve CDP multiplexer uses the u