2026

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copyi

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enab

Memory Corruption when multiple threads issue concurrent IOCTL requests to the device control handler due to improper sy

Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operat

Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.

Memory Corruption when copying large input data exceeds normal allocation limits.

A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or

The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when pa

A remote attacker who controls a container registry may be able to direct a client's token request to a host of the atta

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression de

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows re

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fi

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirec

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun c

AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.js

In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClie

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a

In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title

HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docke

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to ar

changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attac

phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form ha

Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactiv

Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL re

OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verif

GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated use

OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing

Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated att

Coze Studio through 0.5.1 fails to validate that table names in workflow SQL customization nodes belong to the caller's

LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to wr

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist val

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source co

Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with r

Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated a

KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set hel

Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to a

Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it

Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks perm

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project arch

Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather

WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform pri

PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that

metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in