2026

A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbn

pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested pat

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, the selector parser in src

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soups

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HT

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL po

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applicati

A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/c

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Certificate Validation vulnerabil

Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and fac

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that f

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL gl

vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary.

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowin

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting.

vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the

A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/

A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Res

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerab

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerabi

Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.

Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.

Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.

Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.

Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.

Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.

In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requir

Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.

Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.

Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <=

Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.

Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.

Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.

Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.

Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.

Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.

Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.

Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.

admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivatio

admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain a

A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish key

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A