2026

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion en

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS ve

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan->conn safely in get/s

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BT

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2cap_sock_cleanup_liste

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Validate the FW dump header l

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: restore skb->dev on the slave

In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - allocate async request context when

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsi

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: move hardware offload step af

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: restore NET_IP_ALIGN in the RX DMA off

In the Linux kernel, the following vulnerability has been resolved: slip: remove slip_hangup() to fix use-after-free in

In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx d

SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability.

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing

Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the p

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthe

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in pa

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses t

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

ExifReader is a JavaScript Exif information parser. Prior to 4.41.1, ExifReader parses attacker-controlled HEIC or AVIF

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array obje

Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A lo

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attack

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions bec

A flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (D

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 respo

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerab

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerabilit

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Exposure of Sensitive Information to an Un

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to vers

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthentica

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/

Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerabil

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefi

InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop tha

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authentic

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allo

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.the

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard toge

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises retu

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary cod

vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the