2026

IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to cause a denial of service due to improper

IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated att

IBM Concert 1.0.0 through 3.0.0 could allow a local attacker to obtain sensitive information due to recursive copying of

IBM Concert 1.0.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decry

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted reg

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to enforce a request

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to apply the internal

OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as pub

e621ng versions before 26.09.16 pass untrusted request parameters directly to Rails url_for in PaginatorComponent and co

ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper functi

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability

A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticat

Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:fea

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of

An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc().

A reachable assertion vulnerability exists in YARA 4.5.8 when loading crafted .yrc compiled rule files. An attacker can

A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). T

Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkf

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.37 and 3.1.8, a user with extras.add

Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.

A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive inf

Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or deni

An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::Po

MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP

CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an applicati

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-s

Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive

icalendar is an RFC 5545 compatible parser and generator of iCalendar files for Python. From 6.1.0 until 7.2.2, vInt.fro

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, up

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, HT

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, th

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Ji

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Ji

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security featur

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-s

Bridge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security featur

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security featur

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application de

js-toml is a TOML parser for JavaScript. Prior to 1.1.3, load() does not bound nesting or dotted-key depth in the recurs

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to in

pH7Software pH7Builder (pH7 Social Dating CMS) through 18.2.0 resolves the client IP address in _protected/framework/Ip/

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Soc

A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function o

The Tauri updater plugin's 'check' IPC command accepts an allowDowngrades boolean parameter directly from frontend JavaS

Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/