2026

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to

Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticate

Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge

Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect de

SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails t

A flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a syml

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory co

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary JavaScript code due t

IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileg

Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, We

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior t

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior t

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In vers

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() ha

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS par

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS par

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the SF2 parser com

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Fr

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior t

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions and access inte

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to cause a denial of service due to improper validation of FTP

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 a

IBM WebSphere Application Server 9.0 and 8.5 is affected by a deserialization vulnerability in the Name Service componen

IBM WebSphere Application Server 8.5 is affected by an HTTP request smuggling vulnerability due to improper handling of

IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 a

IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0

IBM WebSphere Application Server 9.0 and 8.5 could allow a remote attacker to obtain sensitive information about the fil

IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX conne

In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context

Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level enc

A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlon

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails t

A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails

A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM

A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running p

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process met

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt()

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker cou

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core

Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Se

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_parse() trusts the attacker-controlled ANCOUNT, NS

A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, s

A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file ap

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivi

Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows una