2026

Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after

Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten he

CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers

Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches

Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based acce

Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing

Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credenti

ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticate

OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization,

Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restr

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that

PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where th

Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticat

A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controll

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a

A vulnerability in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow a

A vulnerability in the Online Certificate Status Protocol (OCSP) responder of Cisco ISE and Cisco ISE-PIC could allow an

A vulnerability in an API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to read specific&

A vulnerability in an internal service of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to

A vulnerability in the endpoint posture status reporting functionality of the guest portal web application of Cisco ISE

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an

A vulnerability in the certificate import functionality of the web-based management interface of Cisco ISE and Cisco ISE

A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticate

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remot

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC cou

A vulnerability in the REST APIs of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct

A vulnerability in the offline profiler feed service of Cisco ISE could allow an authenticated, remote attacker to read

A vulnerability in the REST API of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct

A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticat

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthentic

A vulnerability in SSL/TLS certificate parsing in the Snort 2 Detection Engine of Cisco Secure Firewall Threat Defense (

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE

A vulnerability in the web-based management interface of Cisco Identify Services Engine (ISE) could allow an authenticat

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Iden

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbi

A vulnerability in Cisco ISE could allow an authenticated, remote attacker to obtain write access on the underlying oper

A vulnerability in the DNS over TCP implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software a

A vulnerability in the API of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view

A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adapt

A vulnerability in the access control list (ACL) Object Group Search (OGS) implementation of Cisco Secure Firewall Adapt

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obta

MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/

A weakness has been identified in GPAC 26.08-DEV. This impacts the function wait_for_header_and_parse of the file src/ut

Tanium addressed a server-side request forgery vulnerability in Threat Response.

Tanium addressed an improper access controls vulnerability in Threat Response.

Tanium addressed an information disclosure vulnerability in Discover.

Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a cl