2026

Weblate is a web based localization tool. In versions prior to 5.17, a user with the project.edit permission (granted by

Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't verify downloaded f

OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the c

Weblate is a web based localization tool. In versions prior to 5.17, the ALLOWED_ASSET_DOMAINS setting applied only to t

Weblate is a web based localization tool. In versions prior to 5.17, the project backup didn't filter Git and Mercurial

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpo

Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with

JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker

Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API exposed unintended endpo

Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending

Git for Windows is the Windows port of Git. Versions prior to 2.53.0.windows.3 do not have protections that prevent atta

Slah CMS v1.5.0 and below was discovered to contain a remote code execution (RCE) vulnerability in the session() functio

Missing Authorization vulnerability in Plisio Accept Cryptocurrencies with Plisio allows Exploiting Incorrectly Configur

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Aj

An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a direc

Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_v

Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitra

A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed a

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitra

A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed an unauthenticated,

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with low

A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could all

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal a

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary comman

A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PI

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an au

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitr

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitr

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote att

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote a

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote a

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Mar

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design You

Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Cro

The .NET Remoting framework used by OpenText Fax (RightFax) includes known security vulnerabilities that could be exploi

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simula

Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality. The applica

Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature. The a

LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execut

Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling. A remote attacke

A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim

Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via

In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or p

In Splunk Enterprise versions below 10.2.1, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.26

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.26

In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.26

Nordic Semiconductor IronSide SE for nRF54H20 before 23.0.2+17 has an Algorithmic complexity issue.

Cross-Site Request Forgery (CSRF) vulnerability in DeluxeThemes Userpro userpro allows Cross Site Request Forgery.This i

In Grafana's alerting system, users with edit permissions for a contact point, specifically the permissions “alert.notif