2026

CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

ZigBee ZCL protocol dissector crash in 4.6.0 to 4.6.8 allows denial of service

PEAK CAN TRC file parser crash in 4.6.0 to 4.6.8 allows denial of service

Sharkd utility crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

TTL file parser infinite loop in 4.6.0 to 4.6.8 allows denial of service

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 1

An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained

Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating

Apache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly i

Apache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperato

A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4

A flaw was found in dash. The printf builtin reserves four bytes before converting a Unicode \u or \U escape, but the mu

A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recur

Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low

A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected b

A vulnerability has been found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The affected ele

A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/ca

Flatpak's process ID namespace separation does not prevent a sandboxed app's kill(0, signal) or killpg(0, signal) calls

A vulnerability was detected in FastAdmin 1.6.1.20250430/1.6.5.20260602. This affects an unknown function of the file ap

A security flaw has been discovered in MODSetter SurfSense up to 0.0.36. Impacted is an unknown function of the file sur

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escap

A flaw has been found in RaspAP raspap-webgui up to 3.5.5. Affected is the function WiFiManager::writeWpaSupplicant of t

GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that doub

GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in t

GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthe

A security vulnerability has been detected in Trusted Domain Project OpenDMARC up to 1.4.2. This impacts an unknown func

A weakness has been identified in Trusted Domain Project OpenDMARC up to 1.4.2. This affects the function opendmarc_get_

The MCUmgr SMP-over-console transport decodes a base64 frame, reads a 16-bit packet length from it, verifies a CRC and t

parse_write_op() in subsys/net/lib/lwm2m/lwm2m_message_handling.c handles inbound CoAP WRITE/CREATE requests that carry

The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct net_context's vo

mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to

mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorizatio

mall4j through 4.0 fails to enforce authorization checks on GET endpoints in UserAddrController that retrieve customer a

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authentica

mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Un

A security flaw has been discovered in Trusted Domain Project OpenDKIM up to 2.11.0. The impacted element is the functio

httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenti

ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow m

A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PC

A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe

A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the c

A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component

Cotonti through 1.0.0 contains a cross-site request forgery vulnerability in admin.users.php that allows attackers to de

SiYuan before v3.8.4 fails to enforce publish-access checks in the getCurrentAttrViewImages endpoint, allowing publish r