2026

Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to c

Frappe CRM before 1.74.0 contains a missing authorization vulnerability that allows authenticated Sales Users to modify

Frappe CRM before 1.81.2 contains a missing authorization vulnerability that allows authenticated Sales Users to access

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in s

NoteGen through 0.38.3 contains an external control of file path vulnerability in chat image analysis that allows attack

Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files ou

Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arb

KitchenOwl through 0.7.10 contains a server-side request forgery vulnerability in recipe import that allows authenticate

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load test

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets all

@fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifie

Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 an

A flaw was found in the GStreamer ASF demuxer in gst-plugins-ugly. When parsing a Simple Index object, an attacker-contr

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooComme

A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. A

A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. A

Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exp

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration all

Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElem

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access C

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoi

Deserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Ca

A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates

A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the

A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a2

A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFr

A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the

A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through Tra

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel:

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache C

Insufficient Granularity of Access Control vulnerability in Apache Camel Platform HTTP component. This issue affects Ap

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel gRPC component. This issue a

Improper Input Validation vulnerability in Apache Camel Mail component. This issue affects Apache Camel: from 4.0.0 bef

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects

Improper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 bef

Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0

Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel:

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apach

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel CXF component. This issue af

Improper Handling of Case Sensitivity vulnerability in Apache Camel Platform HTTP component. This issue affects Apache

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue aff

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects

Improper Input Validation vulnerability in Apache Camel Tika component. This issue affects Apache Camel: from 4.0.0 bef