2026

CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An att

libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 cont

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 cont

Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / a

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvid

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to i

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a

IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arb

IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applicati

IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or pote

IBM MQ could allow an authenticated attacker to cause a denial of service or potentially escalate privileges due to a he

IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authoriz

IBM MQ could allow a remote attacker to cause a denial of service or execute arbitrary code due to a buffer overflow whe

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's

IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and a

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership

hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and R

Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers to reliably cause Do

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 con

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTT

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly u

A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes fr

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticat

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnera

ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote c

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allow

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_str

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and

ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control ru

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver b

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints,

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-l

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the us

NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php.

Improper handling of length parameter inconsistency vulnerability in ABB Freelance Controller DCP, ABB Freelance Control

A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipeli

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptograp

An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially cr

A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a