2026

HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetD

An issue in ClipBucket v5 v.5.5.2 allows an attacker to execute arbitrary code via the Authentication interface, login p

Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execu

Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and e

Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensit

TypeBot is a chatbot builder tool. In versions prior to 3.16.0, SSRF protection for Webhook / HTTP Request blocks valida

Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST /api/v1/typebots/{typeb

Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate a

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth

Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the RatingButton component in the embed package renders

Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the getResultLogs API endpoint authorizes the caller ag

Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authentica

Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the pr

Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write acce

Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissi

Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated r

Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory

Missing authorization in the vault import feature in Devolutions Server  2026.1.16.0 and earlier allows a low-privileged

Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows

Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server al

Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authentica

Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For e

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged

Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service.

Dell Unisphere for PowerMax vApp version prior to 10.0.0.2, contains an authorization bypass vulnerability in the  Unisp

Dell ECS, versions 3.5 and 3.6, contain an Improper Access Control in the Identity and Access Management (IAM) module. A

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module. This vulnerability exists w

An improper certificate validation vulnerability in Ivanti Secure Access Client before 22.8R6 allows a remote unauthenti

Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inje

Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog

Concrete CMS 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. Victim with edit_file_contents perm

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability

Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 allows remote attac

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. A low

Dell VxRail versions before 7.0.200 contain a Plain-text Password Storage Vulnerability in VxRail Manager. A sys-admin u

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The

vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json)

Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Atta

Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default User

Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows R

Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session ID

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerabilit

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. An un

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Improper Certificate Validation vulnerability. An unauthentica