2026

Improper initialization in the UEFI firmware for some Intel platforms within Ring 0: Bare Metal OS may allow an informat

Improper input validation for some Intel Endpoint Management Assistant (EMA) software before version 1.14.5 within Ring

Exposure of sensitive information caused by shared microarchitectural predictor state that influences transient executio

Uncontrolled search path for some Intel(R) Server Firmware Update Utility Software before version 16.0.12. within Ring 3

Use after free for some Linux kernel driver for the Intel(R) Ethernet 800 series before version 2.3.14 within Ring 0: Ke

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Ap

Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat. This issue affects Apache Tomca

Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat. This issue affects Apache Tomcat:

DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat. This issue affects Ap

Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomca

Improper Input Validation vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0

Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat:

Improper Neutralization of Special Elements used in an SQL Command vulnerability allows SQL Injection via graph containe

The Adversarial Robustness Toolbox (ART) thru 1.20.1 contains a remote code execution vulnerability in its Kubeflow comp

The TinyZero project thru commit 6652a63c57fa7e5ccde3fc9c598c7176ff15b839 (2025-58-24) contains a critical command injec

The superduper project thru v0.10.0 contains a critical remote code execution vulnerability in its query parsing compone

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the MultitaskClassifier

The snorkel library thru v0.10.0 contains a critical insecure deserialization vulnerability (CWE-502) in the BaseLabeler

The snorkel library thru v0.10.0 contains an insecure deserialization vulnerability (CWE-502) in the Trainer.load() meth

PyTorch-Lightning versions 2.6.0 and earlier contain an insecure deserialization vulnerability (CWE-502) in the checkpoi

PySyft (Syft Datasite/Server) versions 0.9.5 and earlier are vulnerable to remote code execution due to insufficient val

The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370

The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370

The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file m

The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch

The torch-checkpoint-shrink.py script in the ml-engineering project in commit 0099885db36a8f06556efe1faf552518852cb1e0 (

Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension. This issue affects Pand

Session Fixation vulnerability allows Session Hijacking via crafted session ID. This issue affects Pandora FMS: from 777

Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page. This i

Insecure Default Initialization of Resource vulnerability allows Authentication Bypass via API access. This issue affect

An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other use

An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a c

Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Fir

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirect

SQL injection in the web console of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authenticated attack

Incorrect permissions assignment in the agent of Ivanti Endpoint Manager before version 2024 SU6 allows a local authenti

An exposed dangerous method on the Core Server of Ivanti Endpoint Manager before version 2024 SU6 allows a remote authen

OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read

A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges

An incorrect permission assignment for critical resource of Ivanti Secure Access Client   before 22.8R6 allows a local a

CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclo

The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper tha

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.6.0, Th

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the thread posting and reply feature acc

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger (YAFNE

YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects

Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval. Prior to

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgr