2026

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe e

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSock

A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration

A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function us

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log messa

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command,

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitiv

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 retur

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections

Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.

Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions.

Editor SQL Injection in Ultimeter <= 3.0.8 versions.

Subscriber SQL Injection in Tainacan <= 1.2.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.

Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.

Administrator SQL Injection in Email Log <= 2.63 versions.

Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.

Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.

Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the inte

Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificat

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer p

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems.

CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs n

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-rese

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submi

Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local use

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON tok

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's S

Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nes

A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code

A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously

In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivi

MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security contr

MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when