2026

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handl

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute fo

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the a

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11,

IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation o

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a

A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be

A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workfl

An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can

SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/r

Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection vi

PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP serv

The Management Console and product files expose sensitive data, including remote log server credentials, truststore pass

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid ac

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowin

The authentication endpoint of WSO2 Identity Server fails to provide a consistent system response when a username does n

Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another S

The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against th

The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expressio

Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting

An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated par

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that all

docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local ima

@rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows at

sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by su

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged u

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role

docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints

GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_reso

A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function same_check of the

A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted element is the function re

A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This

A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacf

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4,

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/gu

FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the w

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit we

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryV

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-r

Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a loca

Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticate

Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through

Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote un