2026

Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.

Memory Corruption when retrieving output buffer with insufficient size validation.

Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.

Cryptographic issue while copying data to a destination buffer without validating its size.

Memory corruption when decoding corrupted satellite data files with invalid signature offsets.

Memory corruption while processing a frame request from user.

Memory corruption while preprocessing IOCTL request in JPEG driver.

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.

Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling.

Twitch Studio version 0.114.8 and prior contain a privilege escalation vulnerability in its privileged helper tool that

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEn

A vulnerability was identified in Free5GC 4.2.0. This affects an unknown function of the component NGSetupRequest Handle

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Medi

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Medi

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, in pull-through cache mod

Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been disco

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking applic

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking applic

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking applic

Homarr is an open-source dashboard. Prior to 1.57.0, the user registration endpoint (/api/trpc/user.register) is vulnera

A stored cross-site scripting (XSS) vulnerability in Bynder before 12 January 2026 allows attackers to execute arbitrary

An issue in the login mechanism of Kaleris YMS v7.2.2.1 allows attackers to bypass login verification to access the appl

Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to

A remote command execution (RCE) vulnerability in the /goform/formReleaseConnect component of UTT Aggressive 520W v3v1.7

UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the selDateType parameter of th

UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the addCommand parameter of the formC

UTT Aggressive HiPER 1200GW v2.5.3-170306 was discovered to contain a buffer overflow in the pools parameter of the form

UTT Aggressive 520W v3v1.7.7-180627 was discovered to contain a buffer overflow in the filename parameter of the formFtp

UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the timestart parameter of the

UTT Aggressive HiPER 810G v3v1.7.7-171114 was discovered to contain a buffer overflow in the notes parameter of the form

A remote command execution (RCE) vulnerability in the /goform/formDia component of UTT Aggressive HiPER 520W v3v1.7.7-18

UTT Aggressive HiPER 1200GW v2.5.3-170306 was discovered to contain a buffer overflow in the timeRangeName parameter of

A double free vulnerability exists in librz/bin/format/le/le.c in the function le_load_fixup_record(). When processing m

GLPI is a free asset and IT management software package. From 10.0.0 to before 10.0.24 and 11.0.6, an authenticated user

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated time-based bli

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, an unauthenticated user can store

GLPI is a free asset and IT management software package. From 11.0.0 to before 11.0.6, template injection by an administ

GLPI is a Free Asset and IT Management Software package. From 0.60 to before 10.0.24, an authenticated technician user c

A vulnerability was determined in itsourcecode Construction Management System 1.0. The impacted element is an unknown fu

A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie._

OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure code or invalid PDU-type. Fo

Mattermost Plugin Legal Hold versions <=1.1.4 fail to halt request processing after a failed authorization check in Serv

A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function

A vulnerability has been found in code-projects Online Application System for Admission 1.0. This issue affects some unk

A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /u

A vulnerability was detected in code-projects Online Shoe Store 1.0. This affects an unknown part of the file /admin/adm

A security vulnerability has been detected in code-projects Easy Blog Site 1.0. Affected by this issue is some unknown f

A weakness has been identified in projectworlds Car Rental System 1.0. Affected by this vulnerability is an unknown func

A flaw was found in libtheora. This heap-based out-of-bounds read vulnerability exists within the AVI (Audio Video Inter

A security flaw has been discovered in Cyber-III Student-Management-System up to 1a938fa61e9f735078e9b291d2e6215b4942af3