2026

The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument.

The imgaug library thru 0.4.0 contains an insecure deserialization vulnerability in its BackgroundAugmenter class within

Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component. T

Guardrails AI thru 0.6.7 contains a code injection vulnerability (CWE-94) in its Hub package installation mechanism. Whe

The CosyVoice project thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserializa

Cognee thru v0.4.0 contains a critical remote code execution vulnerability in its notebook cell execution API endpoint.

The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a command-line argument injection vulnerability in its Kub

The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains an insecure deserialization vulnerability (CWE-502) in its

Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using anoth

A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, Fo

An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDec

An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiN

Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.

Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User App

Out-of-bounds write for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applicati

A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0

An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet

A out-of-bounds write vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0

An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerab

An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] vul

An inconsistent user interface issue was addressed with improved state management. This issue is fixed in iOS 18.7.3 and

An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS S

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no add

YAML::Syck versions before 1.38 for Perl has an out-of-bounds read. The base60 (sexagesimal) parsing code in perl_syck

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool (send_tokens,

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, substring-based blocklist in plugin

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's run_command wrapped

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a

Zulip is an open-source team collaboration tool. Prior to 12.0, With message_edit_history_visibility_policy set to "move

Missing Authorization vulnerability in WPMU DEV Hustle allows Exploiting Incorrectly Configured Access Control Security

Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 2.6.0 within Ring 3: User App

Improper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Appl

Improper access control for some Intel Vision software for all versions within Ring 3: User Applications may allow a den

Divide by zero for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications m

Out-of-bounds write for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ri

Buffer overflow for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1

Unchecked return value for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applic

Buffer overflow for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications

Uncontrolled search path for some Intel(R) Connectivity Performance Suite software installers before version 50.25.1121.

Null pointer dereference for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Appl

Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denia

Integer overflow in the UEFI firmware for the Slim Bootloader may allow an escalation of privilege. System software adve

Out-of-bounds read for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Rin

Untrusted pointer dereference for some Intel(R) QuickAssist Adapter 8960 software before version 1.13 within Ring 3: Use

Incorrect default permissions for some Intel(R) NPU Driver software installers before version 32.0.100.4511 within Ring

Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User App

An issue in Open Source Kubectl MCP Server v1.1.1 allows attackers to execute arbitrary code on a victim system via user

Uncontrolled search path for some AI Playground software before version 3.0.0 alpha within Ring 3: User Applications may

Improper buffer restrictions for some Display Virtualization for Windows OS driver software within Ring 2: Device Driver