2026

MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target ema

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verif

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionServi

OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permi

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, the RDPSND async playback thread can p

FreeRDP is a free implementation of the Remote Desktop Protocol. ainput_send_input_event caches channel_callback in a lo

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an inc

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, aAsynchronous bulk transfer completion

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, sdl_Pointer_New frees data on failure,

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, The URBDRC client uses server-supplied

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, A capture thread sends sample response

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, ecam_encoder_compress_h264 trusts serv

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, AUDIN format renegotiation frees the a

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, urb_select_interface can free the devi

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, video_timer can send client notificati

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerabili

A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/cor

A vulnerability was found in janet-lang janet up to 1.40.1. This affects the function os_strftime of the file src/core/o

Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Acce

DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions.  This may allow an att

Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying c

A vulnerability has been found in janet-lang janet up to 1.40.1. The impacted element is the function janetc_pop_funcdef

Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p21, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows

Crafted zones can lead to increased incoming network traffic.

Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.

Hitron HI3120 v7.2.4.5.2b1 allows stored XSS via the Parental Control option when creating a new filter. The device fail

Crafted delegations or IP fragments can poison cached delegations in Recursor.

Crafted delegations or IP fragments can poison cached delegations in Recursor.

A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Uni

Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd

Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co.

Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'Facebook' parameter in '/loggrodemo/jbrain/Con

Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes, via the 'descripción' parameter in the '/loggrodemo/

The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to

Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd. Co. K12net a

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Info

Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Au

In JetBrains Hub before 2025.3.119807 authentication bypass allowing administrative actions was possible

In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible

In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs

Apache Airflow versions 3.0.0 - 3.1.7, has vulnerability that allows authenticated UI users with permission to one or mo

Apache Airflow versions 3.1.0 through 3.1.6 contain an authorization flaw that can allow an authenticated user with cust

A vulnerability was found in D-Link DCS-931L up to 1.13.0. Impacted is the function doSystem of the file /setSystemAdmin

A vulnerability has been found in DouPHP up to 1.9. This issue affects some unknown processing of the file /admin/file.p

Authentication Bypass by Alternate Name vulnerability in Apache Shiro. This issue affects Apache Shiro: before 2.0.7.

A flaw has been found in itsourcecode News Portal Project 1.0. This vulnerability affects unknown code of the file /admi

A vulnerability was detected in code-projects Online Reviewer System 1.0. This affects an unknown part of the file /syst

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any