2026

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap b

On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted requ

On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated us

On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially

On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gN

On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sens

XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve t

QND contains an improper access control vulnerability in a named pipe, which may allow a local attacker who is logged in

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by send

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by send

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by send

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sendi

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/aj

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_param

A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_i

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_paramete

A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload end

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage en

A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info

GitLab has remediated an issue in GitLab EE affecting all versions from 19.0 before 19.1.8, 19.2 before 19.2.6, and 19.3

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 1

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute

The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to it

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an

The Ni WooCommerce Sales Report WordPress plugin before 4.2.0 does not sanitise and escape a parameter before using it

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate the type, extension or content of files it re

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing expo

The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Obje

The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unaut

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Requ

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may al

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMe

A vulnerability has been found in a2ui-project a2ui up to 0.10.7. Affected by this vulnerability is the function httpx.g

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially c

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a net

A flaw was found in the file-psd plugin in GIMP. When generating a thumbnail preview for a specially crafted PSD (Photos

Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The suppo