2026

phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php.

In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leadin

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages

MinIO through 7aac2a2 does not verify that every x-amz-* header present on a request also appears in the client-supplied

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion (LFI) vulnerability in the Dash

A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. T

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorizat

Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow vulnerability in the JavaScript error stack-trace

The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update proce

A weakness has been identified in songxinjianqwe Chat up to ac63d25297079eed5e4ba7e88d3b7a032637150d. Affected by this i

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoO

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 m

Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers t

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute

The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionalit

The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can rem

Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resourc

The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshnes

An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, l

Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an Improper Certificate Validation vulnerabil

Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low priv

Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function

TREK is a collaborative travel planner. Prior to 3.3.0, TREK allows an authenticated user to store an attacker-controlle

TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for em

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store att

An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerabil

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject craft

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables t

ZITADEL is an open source identity management platform. From 4.0.0 until 4.16.1, ZITADEL Login V2 creates a browser sess

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. F

OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoin

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading mess

zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading mess

DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, settin

Rsdoctor is a build analyzer tailored for projects built with Rspack. Prior to version 1.5.16, the default Rsdoctor repo

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend accep

In the Linux kernel, the following vulnerability has been resolved: gfs2: move quota_init qc iterator increment Move q

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Release m2m_ctx after In

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep XDomain reference during the life

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Set tb->root_switch to NULL when domai

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocate_sdma_queue re

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in get_wave_sta

In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after-free during eventfd

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: purge async notifications upon

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpi_ds_terminate_con