2026

The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. Th

A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when usin

The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result

The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is speci

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp,

A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. Wh

A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit co

The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple

A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. Th

DDEV is an open-source tool for running local web development environments for PHP and Node.js. Versions prior to 1.25.2

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.3 before 18.9.6, 18.10 before 18.10.4, and

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.2 before 18.9.6, 18.10 before 18.10.4, and

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.4 before 18.9.6, 18.10 before 18.10.4, and

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.9.6, 18.10 before 18.10.4, and

A reflected cross-site scripting (XSS) vulnerability in the AdvancedSearch functionality of Silverpeas Core before versi

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFusion Avada allows Cross Site Request Forgery.This issue affect

Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to

ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and exec

Textpad 8.1.2 contains a denial of service vulnerability that allows local attackers to crash the application by supplyi

ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrar

ICEWARP 10.3.4 and 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML

LanSpy 2.0.1.159 contains a local buffer overflow vulnerability that allows attackers to overwrite the instruction point

UltraISO 9.7.1.3519 contains a local buffer overflow vulnerability in the Output FileName field of the Make CD/DVD Image

Angry IP Scanner 3.5.3 contains a buffer overflow vulnerability in the preferences dialog that allows local attackers to

LanSpy 2.0.1.159 contains a local buffer overflow vulnerability in the scan section that allows local attackers to execu

Angry IP Scanner for Linux 3.5.3 contains a denial of service vulnerability that allows local attackers to crash the app

Iperius Backup 5.8.1 contains a local buffer overflow vulnerability in the structured exception handling (SEH) mechanism

MAGIX Music Editor 3.1 contains a buffer overflow vulnerability in the FreeDB Proxy Options dialog that allows local att

Terminal Services Manager 3.1 contains a stack-based buffer overflow vulnerability in the computer names field that allo

An issue was discovered in guardsix (formerly Logpoint) ODBC Enrichment Plugins before 5.2.1 (5.2.1 is used in guardsix

A flaw was found in libefiboot, a component of efivar. The device path node parser in libefiboot fails to validate that

A flaw was found in GNU Emacs. This vulnerability, a memory corruption issue, occurs when Emacs processes specially craf

A flaw was found in InstructLab. The `linux_train.py` script hardcodes `trust_remote_code=True` when loading models from

A vulnerability in the web application allows standard users to escalate their privileges to those of a super administra

A vulnerability in the web application allows unauthorized users to access and manipulate sensitive data across differen

An insecure direct object reference (IDOR) vulnerability in the Fullstep V5 registration process allows authenticated us

Inadequate access control in the registration process in Fullstep V5, which could allow unauthenticated users to obtain

PackageKit is a a D-Bus abstraction layer that allows the user to manage packages in a secure way using a cross-distro,

An operator allowed to use the REST API can cause the Authoritative server to produce invalid HTTPS or SVCB record data,

A rogue primary server may cause file descriptor exhaustion and eventually a denial of service, when a PowerDNS secondar

Incomplete escaping of LDAP queries when running with 8bit-dns enabled allows users to perform queries of internal domai

An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes sai

A rogue backend can send a crafted UDP response with a query ID off by one related to the maximum configured value, trig

A rogue backend can send a crafted SVCB response to a Discovery of Designated Resolvers request, when requested via eith

A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddres

PRSD detection denial of service

A client might theoretically be able to cause a mismatch between queries sent to a backend and the received responses by

A client can trigger excessive memory allocation by generating a lot of errors responses over a single DoQ and DoH3 conn

A client can trigger excessive memory allocation by generating a lot of queries that are routed to an overloaded DoH bac