2026

YouPHPTube <= 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrar

WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attac

Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens

Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JW

NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by othe

Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter fram

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exis

GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safe_extract() function does not

Eigent is a multi-agent Workforce. A critical security vulnerability in the CI workflow (.github/workflows/ci.yml) allow

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced

go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of Internatio

Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to

Substance3D - Modeler versions 1.22.4 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to

Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could le

Substance3D - Modeler versions 1.22.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could le

Substance3D - Modeler versions 1.22.4 and earlier are affected by an out-of-bounds write vulnerability that could result

Substance3D - Modeler versions 1.22.4 and earlier are affected by an out-of-bounds write vulnerability that could result

Improper Input Validation (CWE-20) in Kibana's Email Connector can allow an attacker to cause an Excessive Allocation (C

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-1

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana Fleet can lead to Excessive Allocation (CAPEC-1

Improper Validation of Array Index (CWE-129) exists in Metricbeat can allow an attacker to cause a Denial of Service thr

A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking Virtual Intranet Access (VIA)

A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw i

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.11.4, there is a flaw i

@adonisjs/lucid is an SQL ORM for AdonisJS built on top of Knex. Prior to 21.8.2 and 22.0.0-next.6, there is a Mass Assi

tarteaucitron.js is a compliant and accessible cookie banner. Prior to 1.29.0, a Regular Expression Denial of Service (R

Substance3D - Designer versions 15.0.3 and earlier are affected by an Out-of-bounds Read vulnerability that could lead t

Substance3D - Designer versions 15.0.3 and earlier are affected by an out-of-bounds write vulnerability that could resul

Substance3D - Sampler versions 5.1.0 and earlier are affected by an out-of-bounds write vulnerability that could result

Substance3D - Painter versions 11.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result

Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbi

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, AES/CBC/PKCS5Padding

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't val

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.uti

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft(

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses determin

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Enc

Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data

Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data

An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors runnin

A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject s

Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either A

Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors run

An improper input handling vulnerability exists in the web-based management interface of mobility conductors running eit

Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors runni

Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors runni

Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors runni