2026

A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature ve

It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To

A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of out-

A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware

A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitr

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitr

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitr

A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitte

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history vali

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action i

WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard

ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attacke

A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from

fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 throu

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A use

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contac

The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public R

The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all ve

Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A use

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated at

In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability

UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may le

Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the

An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.4

Missing Authentication for a Critical Function  in certain ASUS routers allows an unauthorized nearby user to send speci

Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrup

Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstrea

An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code wit

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.8, mac

A privacy issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27. An app may be able to a

An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Go

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7,

A double free issue was addressed with improved memory management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS

A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gat

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7,

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS

An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, m

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. A ma

This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An a

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27. An app may be abl