2026

TripleLift's ad rendering script (video-bundle.js) contains a DOM-based cross-site scripting vulnerability that allows u

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praison

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, execute_code sandbox mode permits runtime asse

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, SpiderTools.scrape_page validates only the ini

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 Mattermost failed to validate Dynamic Client Re

novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that all

novel-plus through 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endp

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks prop

A security flaw has been discovered in magicblack MacCMS10 2026.1000.4055. Affected by this vulnerability is an unknown

A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the fil

A vulnerability was found in Dvidelabs flatcc up to 0.6.3. This affects the function analyze_struct of the file src/comp

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.8, 10.11.x <= 10.11.22 fail to limit the nesting

Mattermost versions <=11.9 11.0.9 11.4.8 11.7.7 10.22.11.0 fail to recover from handler panics, which allows an authenti

Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and retu

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7 fail to enforce authorization boundaries on the

Yealink SIP-T33G firmware versions 124.86.x.x prior to 124.87.0.0 contain a race condition vulnerability that allows aut

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is config

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authent

Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in

EspoCRM before 10.0.4 contains a field-level security bypass vulnerability in the meeting and call attendees endpoints t

LaraDashboard versions 0.9.0 through 1.2.2 fail to sanitize SVG file content during media upload, allowing authenticated

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reappl

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads e

filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permission

A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of

A vulnerability was detected in marcobambini Gravity up to 0.9.7. This impacts the function parse_number_expression of t

A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the f

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Syncope.

Exposure of sensitive information through data queries vulnerability in Apache Syncope. An administrator with adequate

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequa

Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store,

A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file

A security vulnerability has been detected in Yot CMS up to 3.3.1. Affected by this issue is the function eval of the fi

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a pr

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authe

ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability.

A vulnerability was identified in D-Link DWR-M921 1.1.52. This impacts the function formWsc of the file /boafrm/formWsc.

A vulnerability was determined in D-Link DWR-M921 1.1.52. This affects the function formsysCmd of the file /boafrm/forms

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit size of unpa

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to limit the amount o

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board crea

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate the type

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to parse Markdown aut

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly enforce t

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entr

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel a

A vulnerability was found in D-Link DWR-M921 1.1.52. The impacted element is the function system of the file /boafrm/for

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown functi