2026

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.Th

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Rootblo

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to v

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTask

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, a malicious or compromis

Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting

Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms all

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor_new_t

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent D

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, le

An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thef

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what

`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (theme) loader indexes the pixelmap table with a value re

`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource as a bare `GX_UBYTE *` with no length, and `GX_BI

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.

The GUIX binary resource loader never checks that a font page's glyph range is well formed. `gx_page_header_first_glyph`

The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has al

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second `SOF0` frame header aft

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function

A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function rueques

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did no

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor-middle

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftReadWriteLock and AsyncSoftReadWrit

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the da

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged proces

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock v

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can break a stale marker

filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder reco

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLit

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symb

filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, StrictSoftFileLock versions from 3.30.

filelock is a platform-independent file lock for Python. Prior to 4.2.1, UnixFileLock can truncate a regular file rename

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can re

Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously S

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, RestHandler.parseRequest

A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSend

A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host w

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the `wTotalLength` field of

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue

Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log rep

Incomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a

Time-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for t

Execution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 throu

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to u