2026

jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resour

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to mo

jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authen

jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authen

jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authen

A weakness has been identified in ColorFul iGameCenter 1.0.3.4. This impacts the function sub_140001AF0 in the library e

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in war

Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log

The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_

Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at

HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data

HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceE

HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1

A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries an

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/config

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_bl

Tinyauth is an authentication and authorization server. Prior to 5.1.2, Tinyauth compares forwarded hostnames case-sensi

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scri

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, Va

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticate

A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcar

A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signature

nginx ignition is a user interface for the nginx web server. In versions 2.29.0 through 2.40.0, the gin i18n middleware

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish

BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0

A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing th

UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint tha

An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker

A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object

A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work

A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentia

A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into me

A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and ex

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container t

A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to

The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the

A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file

A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orde

A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulner

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an

A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. This vulnerability affects the function sub_1105

A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of