2026

A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The f

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Fir

Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 150.0.3.

JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.

Incorrect boundary conditions in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3,

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause un

sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot. In sealed-env enterp

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.76

pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes. Prior

An attacker can cause uncontrolled memory usage with excessive bracing over IMAP. The fix in CVE-2026-27857 was incomple

Dell PowerScale InsightIQ, versions 5.0.0 through 6.2.0, contains an execution with unnecessary privileges vulnerability

Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_all

Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits

Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted

Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could

CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the networ

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Trave

Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Retrieve Emb

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elemento

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR wo

Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Exploiting

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExpe

Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPF

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms V

A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an uninte

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in

The application does not impose strict enough restrictions on directory access permissions, posing a risk that other mal

Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry an

[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/f

[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/f

[email protected] and lower versions are vulnerable to denial of service via regular expression backtracking in the Conte

Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Boar

Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have cre

The Continually plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up

The FastBots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to,

Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd. Co. BAPSİS allows Exploitation of

A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which

A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected applications con

A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5). The affected application is v

A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerab

A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions), blu

A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2

A vulnerability has been identified in Teamcenter V2312 (All versions < V2312.0014), Teamcenter V2406 (All versions < V2

Affected devices do not properly restrict access to the web browser via the Control Panel when no corresponding security

Affected devices do not properly validate and sanitize filenames on the Firmware Update page. This could allow a remote

Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagn

Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page