2026

A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1

IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt

Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL al

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could injec

IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attack

IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system

IBM Concert 1.0 through 3.0.0 allows information disclosure through exposure of schema suggestions.

IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privi

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross site scripting. The web app user‑supplied input is not

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 uses weaker than expected cryptographic algorithms that could allow an attacke

IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection.

IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation.

TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareRe

CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connecti

A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportD

A weakness has been identified in Wuxi Wubang Security Software Five-in-One Safety Production Management Information Sys

markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markd

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveSt

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules

Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path.

A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-D

A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-

A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attacker

A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 all

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embe

IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt

IBM Concert 1.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutrali

IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially cra

IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow

IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that trigg

IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed dat

IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certif

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to impro

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous co

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message hea

IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status

IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code

IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information ab

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in

IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to c

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/

A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webku

A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing

A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of t

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloa

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an e

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart reque