2026

Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action

SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/A

Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. A

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_mess

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term

A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Aff

A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4

A vulnerability was identified in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Thi

A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of

Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to ca

FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers

FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite pro

FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows aut

BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner te

CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, mod

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource inde

Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cr

Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script b

Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permis

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that

Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenti

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers t

libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the

VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points(

VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attacke

libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/d

libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attac

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_bmpcache2() in orders.c that allows m

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allow

rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_plane() in bitmap.c that allows malic

Netpbm through 11.16.00 contains a heap out-of-bounds read vulnerability in rasttopnm that allows attackers to read heap

Netpbm through 11.16.00 contains a heap out-of-bounds write vulnerability in the rasttopnm Sun rasterfile run-length dec

libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers t

libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows rem

Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.

libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in dis

SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability

SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on t

sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of th

SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that al

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight

LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers

BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary

Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell

RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and

Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control S

A vulnerability was detected in D-Link E15, M32, R15 and R32. This issue affects some unknown processing of the file /et

A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the func

A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. T

A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f42538