2026

In the Linux kernel, the following vulnerability has been resolved: nvme: fix memory allocation in nvme_pr_read_keys()

In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative data_len in ib_umad_writ

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix potential NULL pointer dereference in

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop triggered by zero-size

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid

In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: fix infinite loop in attr_load_runs_rang

beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality. Malicious

Missing Authorization vulnerability in Ajay Contextual Related Posts contextual-related-posts allows Exploiting Incorrec

The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi

A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metada

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass

A CSRF vulnerability in the Link Aggregation configuration interface allows an unauthenticated remote attacker to trick

A stored cross‑site scripting (XSS) vulnerability in the Link Aggregation configuration interface allows an unauthentica

A stack-based buffer overflow in the device's Telnet/SSH CLI login routine occurs when a unauthenticated attacker send a

A stack-based buffer overflow in the CLI's TFTP file‑transfer command handling allows a low-privileged attacker with Tel

A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send overs

A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged at

A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacke

A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to tri

A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may g

The Writeprint Stylometry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p' GET parameter

Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to conf

The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as c

IncusOS is an immutable OS image dedicated to running Incus. Prior to 202603142010, the default configuration of systemd

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authent

The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the

A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirect

Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQ

The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. In versions on

The Amazon S3 for Craft CMS plugin provides an Amazon S3 integration for Craft CMS. In versions 2.0.2 through 2.2.4, una

music-metadata is a metadata parser for audio and video media files. Prior to version 11.12.3, music-metadata's ASF pars

Kube-router is a turnkey solution for Kubernetes networking. Prior to version 2.8.0, Kube-router's proxy module does not

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of arguments of the `createAnnot

Cockpit is a headless content management system. Any Cockpit CMS instance running version 2.13.4 or earlier with API acc

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server commun

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service

mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customi

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS

DiceBear is an avatar library for designers and developers. Prior to version 9.4.0, the `ensureSize()` function in `@dic

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missi

The [CR]Paid Link Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the URL path in all v

A flaw has been found in itsourcecode University Management System 1.0. Affected is an unknown function of the file /add

The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wpgm

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly val

Kanboard is project management software focused on Kanban methodology. Prior to 1.2.51, Kanboard's user invite registrat

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and inc

LeafKit is a templating language with Swift-inspired syntax. Prior to version 1.14.2, HTML escaping doesn't work correct

OpenClaw versions prior to 2026.2.26 contain an approval bypass vulnerability in system.run execution that allows attack