2026

NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious

NVIDIA BioNemo for Linux contains a vulnerability where a user could cause a deserialization of untrusted data. A succes

NVIDIA TensorRT contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of t

XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to

Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitra

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.26

In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.1

In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could a

Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering she

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation.

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not

The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0]

InfoScale CmdServer before 7.4.2 mishandles access control.

Cross-Site Request Forgery (CSRF) vulnerability in InfoScale v.9.1.3 Operations Manager (VIOM) allows an attacker to for

InfoScale VIOM 9.1.3 allows XSS.

SQL injection in InfoScale VIOM before v9.1.3 allows remote attackers to escalate privileges.

A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthentica

A vulnerability in the BrowserBot component of Cisco ThousandEyes Enterprise Agent could have allowed an authenticated,

A vulnerability in the SSL certificate handling of Cisco ThousandEyes Virtual Appliance could allow an authenticated, re

A vulnerability in the Border Gateway Protocol (BGP) enforce-first-as feature of Cisco Nexus 3000 Series Switc

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based

An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not requi

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessi

Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Da

Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Floodin

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Beyaz Computer Sof

The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be

Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Prin

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerabilit

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause i

Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This i

Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthentic

Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanit

Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session P

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface

A heap-based buffer overflow vulnerability exists in the Channel Splitting functionality of MediaInfoLib (version(s): 26

The HCL DominoIQ RAG feature is affected by a Broken Access Control vulnerability.  Under certain circumstances, documen

An unbounded resend loop vulnerability exists in the BIND 9 resolver state machine during bad-server handling, enabling

Undefined behavior may result due to a race condition leading to a use-after-free violation. If BIND receives an incomi

Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`

Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.

Microsoft Defender Denial of Service Vulnerability

Missing Authorization vulnerability in ADD-ONS.ORG PDF for Elementor Forms + Drag And Drop Template Builder allows Explo

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITH YITH WooComme

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to el

A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.

BIND resolvers are vulnerable to an amplified resource consumption/exhaustion attack. If a victim resolver makes a quer

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory

Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that