2026

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can cr

pypdf is a free and open-source pure-python PDF library. Prior to 6.12.0, an attacker who uses this vulnerability can cr

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via f

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability in th

TinyMCE is an open source rich text editor. From 6.8.0 to before 7.1.0, TinyMCE contains an XSS vulnerability caused by

TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via u

Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in FileSystemLoader and Cac

mapfish-print is a component of MapFish for printing templated cartographic maps. From 3.23.0 to before 3.28.28, 3.30.30

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, the legacy router first ret

Espressif Shared GitHub DangerJS is a reusable GitHub Action CI DangerJS workflow for Espressif GitHub projects. Prior t

CryptX versions before 0.088_001 for Perl have a stack buffer overflow in four AEAD decrypt_verify helpers. The gcm_dec

phpMyFAQ before 4.1.3 contains an unauthenticated password reset vulnerability in the user password update API endpoint

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthe

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientT

phpMyFAQ before 4.1.3 contains an insecure direct object reference vulnerability in the admin API user password endpoint

Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core (HardenedObjectInputStream (logback-

A user with physical access to a smartphone can bypass authentication mechanism of Kidsview mobile application and grant

The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to privilege escalation. An authenticated low-priv

The Mennekes Amtron series (firmware versions ≤ 5.22.3) is vulnerable to an authentication bypass. An unauthenticated re

An issue was discovered in Canonical Multipass before version 1.16.3. The host-side SFTP server component (sshfs_server)

An issue was discovered in Canonical Multipass for macOS before version 1.16.3 due to an incomplete fix for CVE-2025-519

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the applicatio

An issue in SMSGate sms-core<=2.1.13.6 allows a remote attacker to execute arbitrary code via the Cmpp7FDeliverRequestMe

An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbitrary

Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header injections in request paths. T

A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that

FlowIntel up to version 3.3.0 contains a server-side request forgery (SSRF) vulnerability in the external reference URL

Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it

Improper Certificate Validation vulnerability in ex-aws ex_aws_sns (ExAws.SNS, ExAws.SNS.PublicKeyCache modules) allows

In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: fix use-after-free on registration fa

In the Linux kernel, the following vulnerability has been resolved: media: iris: Fix use-after-free in iris_release_int

In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5647: Fix runtime PM refcount leak in

In the Linux kernel, the following vulnerability has been resolved: batman-adv: stop caching unowned originator pointer

In the Linux kernel, the following vulnerability has been resolved: media: rc: xbox_remote: heed DMA restrictions The

In the Linux kernel, the following vulnerability has been resolved: media: saa7164: add ioremap return checks and clean

In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping order In vsock_upd

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: only purge non-released claims Wh

In the Linux kernel, the following vulnerability has been resolved: HID: playstation: Clamp num_touch_reports A device

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: put backbone reference on failed c

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn3: Prevent OOB reads when parsing dec

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Clear VRAM on allocation to prevent sta

In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix devres lifetime USB drivers bind t

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_

In the Linux kernel, the following vulnerability has been resolved: spi: fsl: fix controller deregistration Make sure

In the Linux kernel, the following vulnerability has been resolved: spi: rspi: fix controller deregistration Make sure

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix bo leak in xe_dma_buf_init_obj() on all

In the Linux kernel, the following vulnerability has been resolved: cgroup: Defer css percpu_ref kill on rmdir until cg

In the Linux kernel, the following vulnerability has been resolved: media: rockchip: rkcif: Add missing MUST_CONNECT fl

In the Linux kernel, the following vulnerability has been resolved: EDAC/versalnet: Fix device name memory leak The de