2026

Discord Client Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows loca

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attack

WatchYourLAN Configuration Page Argument Injection Remote Code Execution Vulnerability. This vulnerability allows networ

Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows rem

Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows rem

Langflow PythonFunction Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers t

Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This

Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. This vulnerability allows remote

Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute

GPT Academic upload Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows rem

GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability. This

GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allow

Foundation Agents MetaGPT actionoutput_str_to_mapping Code Injection Remote Code Execution Vulnerability. This vulnerabi

Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. Thi

Katana Network Development Starter Kit executeCommand Command Injection Remote Code Execution Vulnerability. This vulner

mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability. This vulnerability allows l

MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability. This vulnerability allows

github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remo

gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attack

A flaw was found in SIPp. A remote attacker could exploit this by sending specially crafted Session Initiation Protocol

Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerab

Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerab

Anritsu ShockLine SCPI Race Condition Remote Code Execution Vulnerability. This vulnerability allows network-adjacent at

Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerabi

Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote atta

Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote a

Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability. This vulnerability allo

GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote a

7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attacke

Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below conta

sigstore framework is a common go library shared across sigstore services and clients. In versions 1.10.3 and below, the

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.

The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname valid

An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption d

Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information o

Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.

Azure Entra ID Elevation of Privilege Vulnerability

Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, inst

Runtipi is a Docker-based, personal homeserver orchestrator that facilitates multiple services on a single server. Versi

Dragonfly is an open source P2P-based file distribution and image acceleration system. In versions 2.4.1-rc.0 and below,

Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to dis

Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose inf

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view s

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unau

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorize

An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges

This vulnerability occurs when the system permits multiple simultaneous connections to the backend using the same charg

This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unautho

This vulnerability arises because there are no limitations on the number of authentication attempts a user can make. An