2026

** UNSUPPORTED WHEN ASSIGNED ** A buffer overflow vulnerability in the formWep(), formWlAc(), formPasswordSetup(), formU

** UNSUPPORTED WHEN ASSIGNED ** An insecure storage of sensitive information vulnerability in the configuration file of

** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware versio

** UNSUPPORTED WHEN ASSIGNED ** An improper restriction of excessive authentication attempts vulnerability in the web ma

The Salesforce module before 1.x-1.0.1 for Backdrop CMS does not properly use a random state parameter to protect the au

SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when

SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions tem

An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that all

Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users

Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthoriz

Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), a

SQL injection vulnerability exists in @sap/hdi-deploy package, where SQL queries are dynamically constructed using user

Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an authenticat

Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious in

SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacke

Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administ

SAPUI5 (Search UI) allows an unauthenticated attacker to manipulate specific URL parameters on the Search UI to include

Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based

Due to insufficient CSRF protection in SAP BusinessObjects Business Intelligence Platform ,an authenticated user could b

A vulnerability chain in Cribl Edge for Windows before 4.17.1 allows a local authenticated user to escalate privileges t

DOM-based cross-site scripting (XSS) in Cribl Stream before 4.17.1 allows a remote attacker to execute arbitrary JavaScr

A command injection vulnerability in Cribl Edge for Linux versions 3.2.0 through 4.17.0 allows a local unprivileged user

Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were publ

A flaw has been found in omec-project amf up to 2.1.1. This vulnerability affects unknown code of the component NGAP Mes

A vulnerability was detected in D-Link DIR-816 1.10CNB05_R1B011D88210. This affects the function portForward. Performing

A security vulnerability has been detected in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this issue is the funct

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.4, there is a security vulnerability in Vaul

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organiz

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a group

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when t

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.

DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.

Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a rem

barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe

barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_

A weakness has been identified in D-Link DIR-816 1.10CNB05_R1B011D88210. Affected by this vulnerability is the function

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. Th

Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET

Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. The

exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifToo

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.7.0, the subscriptions.create API end

Outline is a service that allows for collaborative documentation. Prior to 1.7.0, the shares.create API accepts both col

Outline is a service that allows for collaborative documentation. Prior to 1.7.0, ZipHelper.extract computes the extract

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, the Outline comment section perm

Outline is a service that allows for collaborative documentation. From 0.84.0 to 1.6.1, a logic error in OAuthInterface.

WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read API

WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsyn

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.jso