2026

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's leng

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that f

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation Syste

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated att

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options()

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files wi

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to

Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding ro

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verifi

An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establ

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a valu

On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configurat

Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configur

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated admin

An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intende

Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send

Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficie

A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/sche

Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.p

OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capabi

OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway We

OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers t

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimp

An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB i

yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowin

A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a reques

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.

Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Con

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/pa

A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f

UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user ma

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user ma

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel module where an attacker could ca

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker with local access

NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where a user could cause improper lo

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause uncontrol

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a user could cause uncontro

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could c

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a privileged user could trig

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could inject crafted

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could c

NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where a user could cau

NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel module where an unprivileged local user could