2026

Sylius is an Open Source eCommerce Framework on Symfony. An authenticated stored cross-site scripting (XSS) vulnerabilit

Sylius is an Open Source eCommerce Framework on Symfony. A cross-site scripting (XSS) vulnerability exists in the shop c

Sylius is an Open Source eCommerce Framework on Symfony. The POST /api/v2/shop/orders/{tokenValue}/items endpoint does n

Sylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (IDOR) vulner

Sylius is an Open Source eCommerce Framework on Symfony. CurrencySwitchController::switchAction(), ImpersonateUserContro

OliveTin gives access to predefined shell commands from a web interface. Prior to 3000.11.2, when the saveLogs feature i

Unicorn adds modern reactive component functionality to your Django templates. Prior to 0.67.0, component state manipula

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, u

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in gleam-wisp wisp allows a

Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bu

Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerabil

Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by an Improper Certificate Val

Acrobat Reader versions 24.001.30307, 24.001.30308, 25.001.21265 and earlier are affected by a Use After Free vulnerabil

SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) checks href attr

file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in

SiYuan is a personal knowledge management system. Prior to 3.5.10, SiYuan's SVG sanitizer (SanitizeSVG) blocks dangerous

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. From 1.3.0

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-al

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-a

LinkAce is a self-hosted archive to collect website links. In 2.1.0 and earlier, the processTaxonomy() method in LinkRep

LinkAce is a self-hosted archive to collect website links. When a user creates a link via POST /links, the server fetche

liquidjs is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.0, the layout, render

Sequelize is a Node.js ORM tool. Prior to 6.37.8, there is SQL injection via unescaped cast type in JSON/JSONB where cla

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-a

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alph

Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communi

There is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege

In EfwApTransport::ProcessRxRing of efw_ap_transport.cc, there is a possible out of bounds write due to a missing bounds

In multiple places, there is a possible out of bounds write due to memory corruption. This could lead to remote code exe

In VPU, there is a possible use-after-free read due to a race condition. This could lead to local information disclosure

In modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execu

In usim_SendMCCMNCIndMsg of usim_Registration.c, there is a possible out of bounds write due to memory corruption. This

In oobconfig, there is a possible bypass of carrier restrictions due to a logic error. This could lead to local escalati

In mfc_dec_dqbuf of mfc_dec_v4l2.c, there is a possible out of bounds write due to an incorrect bounds check. This could

In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check. T

In Trusted Execution Environment, there is a possible key leak due to side channel information disclosure. This could le

In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execu

In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This

In vpu_open_inst of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local es

In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check. This

In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption. This could lead to remote

In dhd_tcpdata_info_get of dhd_ip.c, there is a possible Denial of Service due to a precondition check failure. This cou

The register protection of the PowerVR GPU is incorrectly configured. This could lead to local information disclosure wi

In gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a confused deputy. Th