2026

A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_t

A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgi

A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the

A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlet

A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a

Nokia 1830 Global Express (GX) is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated atta

Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability which exists in the administrat

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template sub

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component. This vulnerability was fixed in

Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbir

Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.

A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the fil

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the

A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of th

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes withou

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatic

Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers

A flaw was found in cockpit-machines. When saving Virtual Network Computing (VNC) console settings, the configured passw

A flaw was found in cockpit-machines. Red Hat Subscription Management (RHSM) authentication tokens are passed as command

A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function

A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the

A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Cla

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbi

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custo

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0

A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social.

A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pag

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArch

LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthentica

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hij

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft fil

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permis

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor an

uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte c

react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts b

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() t

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenti

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privi

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, de

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any auth

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.p

** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability