2026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Su

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App). Support

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supporte

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affec

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver). The supported version that is affec

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported v

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE

Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: General

Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: Pl

Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent). Th

User-controlled header names and values containing newlines can allow injecting HTTP headers.

When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messa

Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in Milner ImageDirector Cap

Use of a Broken or Risky Cryptographic Algorithm (DES) vulnerability in the Password class in C2SConnections.dll in Mi

Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability

Insufficiently Protected Credentials vulnerability in the Credential Field of Milner ImageDirector Capture allows retrie

The use of a hard-coded encryption key in calls to the Password function in C2SGlobalSettings.dll in Milner ImageDirecto

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigati

The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigat

User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not b

HackerOne community member Huynh Pham Thanh Luc (nigh7c0r3) has reported a reflected XSS vulnerability in the afr.php de

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the banner-acl.php script of

HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `ch

HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-dele

HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver setti

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCall

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--

An input validation issue in in Pithikos websocket-server v.0.6.4 allows a remote attacker to obtain sensitive informati

A buffer over-read in the PublicKey::verify() method of Binance - Trust Wallet Core before commit 5668c67 allows attacke

A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e

A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attacker

We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable wh

A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unha

A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freein

NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through co

NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` ev

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using

A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions u

Open 5GS WebUI uses a hard-coded JWT signing key (change-me) whenever the environment variable JWT_SECRET_KEY is unset

A code injection vulnerability in the binary-parser library prior to version 2.3.0 allows arbitrary JavaScript code exec

Race condition in the turbo-frame element handler in Hotwired Turbo before 8.0.x causes logout operations to fail when d

An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the

Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients m

Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in t

A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the contr