2026

Bridge versions 15.1.3, 16.0.1 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could re

Bridge versions 15.1.3, 16.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arb

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a craft

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a craft

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a craft

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result i

Substance3D - Stager versions 3.1.6 and earlier are affected by an out-of-bounds write vulnerability that could result i

Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash.

MongoDB Server may experience an out-of-memory failure while evaluating expressions that produce deeply nested documents

Connections received from the proxy port may not count towards total accepted connections, resulting in server crashes i

Inserting certain large documents into a replica set could lead to replica set secondaries not being able to fetch the o

FastGPT is an AI Agent building platform. From 4.14.0 to 4.14.5, attackers can directly access the plugin system through

EverShop is a TypeScript-first eCommerce platform. During category update and deletion event handling, the application e

SiYuan is a personal knowledge management system. Prior to 3.5.5, the /api/file/getFile endpoint uses case-sensitive str

Frappe is a full-stack web application framework. Prior to 14.99.14 and 15.94.0, an attacker could craft a malicious sig

Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered

Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, whe

ClipBucket v5 is an open source video sharing platform. Prior to 5.5.3 - #40, a Time-of-Check to Time-of-Use (TOCTOU) ra

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics)

The internal locking mechanism of the MongoDB server uses an internal encoding of the resources in order to choose what

A series of specifically crafted, unauthenticated messages can exhaust available memory and crash a MongoDB server.

Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core

Docmost is open-source collaborative wiki and documentation software. From 0.20.0 and before 0.25.0, the public share pa

Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose informatio

Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacke

Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an autho

Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over

User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attack

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service loc

Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to e

Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an a

Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio

Improper link resolution before file access ('link following') in Windows App for Mac allows an authorized attacker to e

Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthor

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a net

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a netwo

Deserialization of untrusted data in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a networ

Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.

InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could

InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could

After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary co

After Effects versions 25.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to appl

Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead t

Substance3D - Designer versions 15.1.0 and earlier are affected by an out-of-bounds read vulnerability that could lead t

Substance3D - Designer versions 15.1.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could l