2026

In the Linux kernel, the following vulnerability has been resolved: drm: Account property blob allocations to memcg DR

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: restore failed global reservations to s

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not access current->mems_allowed_seq if

ai-scanner is an AI model safety scanner built on NVIDIA garak. From version 1.0.0 to before version 1.4.1, there is a r

CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Pri

math-codegen generates code from mathematical expressions. Prior to version 0.4.3, string literal content passed to cg.p

go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-gi

PraisonAI is a multi-agent teams system. Prior to version 4.6.9, the fix for PraisonAI's MCP command handling does not a

PraisonAI is a multi-agent teams system. Prior to praisonai version 4.6.9 and praisonaiagents version 1.6.9, the fix for

YARD is a Ruby Documentation tool. Prior to version 0.9.42, a path traversal vulnerability was discovered in YARD when u

Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version

The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Requi

Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: fix for dma-fence safe access rules C

In the Linux kernel, the following vulnerability has been resolved: drm/tests: shmem: Hold reservation lock around vmap

In the Linux kernel, the following vulnerability has been resolved: Revert "arm64: zynqmp: Add an OP-TEE node to the de

In the Linux kernel, the following vulnerability has been resolved: spi: cadence-quadspi: Parse DT for flashes with the

In the Linux kernel, the following vulnerability has been resolved: drm/tests: shmem: Hold reservation lock around madv

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_confi

In the Linux kernel, the following vulnerability has been resolved: drm/tests: shmem: Hold reservation lock around purg

Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. The backend

Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This

Account users are allowed by default to register templates to be downloaded directly to the primary storage for deployin

Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as mi

Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which the

The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated u

The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenticated u

The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0. Anyone with authenti

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login han

OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthe

Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of nu

Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform. The vulnerability occurs in

The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id'

The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `sky-custom-scripts` custom pos

A vulnerability in Remote Spark SparkView before build 1122 allows an attacker to bypasses the local connection check an

The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `strava_nmr

The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and includ

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordP

In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.

In uriparser before 1.0.2, there is pointer difference truncation to int in various places.

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb fra

Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::

A vulnerability in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on X86_64, AVX, AVX-512f, Linux, Legion of the

PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes

The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before

In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered wit

Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php. NOTE: the Supplier disputes this

Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP ob