2026

Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not en

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on to

A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogs_pfcp_parse_volume_measurement in the lib

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the

Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict serv

On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI)

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the spl

IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, a

A vulnerability has been found in Open5GS up to 2.8.0. Affected by this issue is the function smf_n4_handle_session_repo

A flaw has been found in Artifex MuPDF up to b6d17493700c621c0e70036980a6ebd06d2202c9. Affected by this vulnerability is

kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-

vLLM is an inference and serving engine for large language models. Prior to 0.28.0, request bodies for Chat Completions

Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invokin

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission def

Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysU

A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affect

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint bel

Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unau

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go a

Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload quest

MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to 6.6.16 a

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the input_audio handling path for /v

A flaw was found in flightctl. The configureRepoHTTPSClient() function in the device-render worker builds a per-reposito

Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerabi

Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privileg

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial a

FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege att

reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that f

MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows

TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update

Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns sched

A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserControl

Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records o

Plate is a rich-text editor with AI and shadcn/ui. Prior to 53.3.11, and in the discontinued 54.0.0-beta.0 through 54.0.

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search e

Zope AccessControl provides a general security framework for use in Zope. Prior to 7.4, applications that allow untruste

A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure deleg

In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SO

OpenFGA is an authorization and permission engine built for developers. Prior to 1.18.1, the ListUsers API could return

A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular k

For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer

Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Use of a Broken o

zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service

A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the