2026

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and BE3600 v1 (vpn modules) allows adjacent authent

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2 and Archer AXE75 v2 (web modules) allows adjacent a

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(vpn modules) and BE3600 v1 allows adjacent authenti

An OS Command Injection vulnerability exists in the Surfshark VPN login functionality in TP-Link Archer BE230 v1.2, BE36

An OS Command Injection vulnerability in TP-Link Archer BE230 v1.2(web modules) and Archer AXE75 v1.0 allows adjacent

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticat

A medium-severity vulnerability has been identified in BeyondTrust Privilege Management for Windows versions <=25.7. Und

Transient DOS when processing a received frame with an excessively large authentication information element.

Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters.

Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers

Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.

Memory corruption while calculating offset from partition start point.

Memory corruption when calculating oversized partition sizes without proper checks.

Memory Corruption when multiple threads simultaneously access a memory free API.

Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inad

IBM Jazz Foundation 7.0.3 through 7.0.3 iFix019 and 7.1.0 through 7.1.0 iFix005 is vulnerable to access control violatio

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive

When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installati

An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password b

A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration pre

An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration pr

An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration pres

An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration pres

A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB.

An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the

It was found that the XPC service offered by the privileged helper of Native Access uses the PID of the connecting clie

During the installation of the Native Access application, a privileged helper `com.native-instruments.NativeAccess.Helpe

A flaw was found in libsoup. This stack-based buffer overflow vulnerability occurs during the parsing of multipart HTTP

A flaw was found in SoupServer. This HTTP request smuggling vulnerability occurs because SoupServer improperly handles r

EAP Legislator is vulnerable to Path Traversal in file extraction functionality. Attacker can prepare zipx archive (defa

A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocat

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Tech

A vulnerability in huggingface/text-generation-inference version 3.3.6 allows unauthenticated remote attackers to exploi

A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in `/api/convos/fork

The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption

In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure wor

A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the serve

In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user

In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to delete p

A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui ap

A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could h

A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated a

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service

In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service

In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service,

In wlan AP/STA firmware, there is a possible system becoming irresponsive due to an uncaught exception. This could lead

In Thread, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o

In pcie, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of p