2026

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to e

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The pr

A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogi

A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the fil

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as q

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will messa

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending pe

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter th

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and

Frictionless before 5.19.1 contains an OS command injection vulnerability in the explore console command that allows an

BusyBox romfs volume ID parsing uses unbounded strlen on attacker-controlled metadata, causing a heap buffer overflow wh

A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated

webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into execut

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database querie

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to access sensitive informati

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive informati

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to bypass authentication and

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host f

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Infor

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Cr

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and

A flaw was found in sudo. When sudoers rules use NOTBEFORE or NOTAFTER time-based access restrictions with timestamps th

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy s

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue t

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue t

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administ

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized S

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payme

A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authenticat

Race condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirement

Buffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a Do

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vul

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vu

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection

ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable

Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling wh

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Con

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Con

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalat

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allo

Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause on

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP reques

Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomc