2026

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content

Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows d

A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown f

Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the sta

SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigContro

A security vulnerability has been detected in SourceCodester Inventory and Monitoring System 1.0. The affected element i

A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability aff

A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/uti

Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privile

SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.0.0, ScpClient places caller-supplied remote paths into

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked w

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privi

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using th

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human language

A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags su

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/dguardint

Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/r

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the

Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability. An unauthent

DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that a

A flaw has been found in WuzhiCMS up to 4.1.0. The impacted element is the function ckditor::saveRemote of the file core

A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search

@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route

Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backst

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, Re

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints b

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Byp

Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-

If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a val

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service respo

RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted en

If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security p

MDC is a tool to take regular Markdown and write documents interacting deeply with a Vue component. Prior to 0.22.1, @nu

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP s

RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in cr

On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a speci

A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DE

zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/pass

zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.

A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/ag-ui-clie

Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framewor

Jenkins OWASP Dependency-Check Plugin 5.6.4 and earlier does not escape CWE values from Dependency-Check reports on the

Jenkins Coverage Plugin 3.3358.v9487dde48783 and earlier does not validate the coverage results ID when a job configurat

Jenkins Warnings Plugin 13.10258.va_17d49a_78c3b_ and earlier does not validate the analysis results ID when a job confi