2026

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow an attacker to o

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 could allow a remote attacke

IBM Sterling Partner Engagement Manager 6.2.3.0 through 6.2.3.5 and 6.2.4.0 through 6.2.4.2 is vulnerable to cross-site

Observable response discrepancy vulnerability in OpenText™ Vertica allows Password Brute Forcing.   The vulnerability co

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ Vertica

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ Vertica

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.7_2, and 6.2.0.0 through 6.2.0.5_1, 6.2.

The Honeywell IQ4x building management controller, exposes its full web-based HMI without authentication in its factory-

This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS). In vulne

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_m

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's Byt

ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessa

Black is the uncompromising Python code formatter. Starting in version 24.3.0 and prior to version 26.3.1, Black writes

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

Deno is a JavaScript, TypeScript, and WebAssembly runtime. From 2.7.0 to 2.7.1, A command injection vulnerability exist

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-16 and 6.9

Tolgee is an open-source localization platform. Prior to 3.166.3, the XML parsers used for importing Android XML resourc

Vim is an open source, command line text editor. From 9.1.0011 to before 9.2.0137, Vim's NFA regex compiler, when encoun

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, when using Transfer-Encoding:

Cap'n Proto is a data interchange format and capability-based RPC system. Prior to 1.4.0, a negative Content-Length valu

Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Co

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI

Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC authorization endpoint allows users wit

Tinyauth is an authentication and authorization server. Prior to 5.0.3, the OIDC token endpoint does not verify that the

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-a

Backstage is an open framework for building developer portals. Prior to 3.1.5, authenticated users with permission to ex

Backstage is an open framework for building developer portals. Prior to 0.27.1, a Server-Side Request Forgery (SSRF) vul

Backstage is an open framework for building developer portals. Prior to 0.27.1, the experimental OIDC provider in @backs

ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Valid

ZeptoClaw is a personal AI assistant. Prior to 0.7.6, the generic webhook channel trusts caller-supplied identity fields

Uptime Kuma is an open source, self-hosted monitoring tool. From 2.0.0 to 2.1.3 , the GET /api/badge/:id/ping/:duration?

Shopware is an open commerce platform. /api/_info/config route exposes information about licenses. This vulnerability is

NEXULEAN is a cybersecurity portfolio & service platform for an Ethical Hacker, AI Enthusiast, and Penetration Tester. P

A flaw was found in mirror-registry where an authenticated user can trick the system into accessing unintended internal

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the set_config function. Thi

An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier al

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formSetWizardSelectMode.

Local File Inclusion in Contact Plan, E-Mail, SMS and Fax components in Asseco SEE Live 2.0 allows remote authenticated

Heap buffer overflow vulnerability in LibreDWG versions v0.13.3.7571 up to v0.13.3.7835 allows a crafted DWG file to cau

A privileged Ignition user, intentionally or otherwise, imports an external file with a specially crafted payload, which

A command injection vulnerability has been identified in the Telnet command-line interface (CLI) of TP-Link TL-MR6400 v5

flatted is a circular JSON parser. Prior to 3.4.0, flatted's parse() function uses a recursive revive() phase to resolve

Dataease is an open source data visualization analysis tool. Prior to 2.10.20, By controlling the IniFile parameter, an

Dataease is an open source data visualization analysis tool. In DataEase 2.10.19 and earlier, the static resource upload

Dataease is an open source data visualization analysis tool. Prior to 2.10.20, The table parameter for /de2api/datasourc

soroban-poseidon provides Poseidon and Poseidon2 cryptographic hash functions for Soroban smart contracts. Poseidon V1 (

Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. From 0.21.0