2026

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supp

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation

Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authenticati

n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based cr

In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName process

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence sto

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentia

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities all

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role

When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data du

Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - T

Unauthenticated Broken Authentication in miniOrange Discord Integration <= 2.2.4 versions.

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCre

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execu

The Easy Appointments plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: consume only present negotiated TTL

In the Linux kernel, the following vulnerability has been resolved: x86/ftrace: Relocate %rip-relative percpu refs in d

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated

In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensyste

Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) rece

The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not limit zeroing to orig_size when onl

In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a permission check for FSCTL_SET_ZERO_DA

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB write in HT_caps_handle

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in IE loops in is

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in update_beacon_i

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in OnAssocRsp() IE

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into t

The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration reques

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registrat

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip(

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a valida

In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix out-of-bounds read in genelink_

In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-b

This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6, iOS 18.7.

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted in

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2,

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bin

A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based

The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This is

The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affec

Xlight FTP Server before 3.9.5 contains a pre-authentication stack buffer overflow vulnerability that allows unauthentic

Autel MaxiCharger AC Elite Home WebSockets Integer Underflow Remote Code Execution Vulnerability. This vulnerability all