2026

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attacker

Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side

pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, a

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoin

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, CommandValidator in src/praisonai-ts/src/cli/features/s

PraisonAI is a multi-agent teams system. From 1.2.3 until 1.7.2, SandboxExecutor network-isolated mode in src/praisonai-

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, MCPSecurity.evaluatePolicy() in src/praisonai-ts/src/mc

PraisonAI is a multi-agent teams system. From 1.5.1 until 1.7.2, the shell() helper exported from src/praisonai-ts/src/t

PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, Tool

Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation. This issue affects Ga

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, SessionRequestHandler in the session

The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micr

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and acce

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 a

A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository).

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compos

The Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privile

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown

A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /c

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. Affected by this vulnerability is

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Af

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. This impacts a

A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown f

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element

A vulnerability has been found in luben zstd-jni up to 1.5.7-13. This vulnerability affects the function ZstdCompressCtx

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by th

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function th

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing

A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. Impacted is an unknown function of the fi

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of

A security vulnerability has been detected in SabyasachiRana WebMap up to 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. This

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is a

A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attack

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoi

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) atta

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSe

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequo

A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 an

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27. M

An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 2