2026

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashb

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-co

A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service

Use of Externally-Controlled format string vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue af

: Improper Authentication vulnerability in Unitronics Unitronics UniStream Pro/UniLogic. This issue affects Unitronics

: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Unitronics Unitronics UniStre

: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Unitronics

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build mes

In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitr

In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to e

In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration

A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724. The impacted element is an unknown function of the file

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML Na

kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler val

kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls rege

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil r

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRe

kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the rout

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A

An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information an

An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a cr

A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to

A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause out-of-bounds memory write, which may result

A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.

A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application cras

A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application cr

EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit

EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attack

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PD

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Fo

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator c

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-adm

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator c

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can ac

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Impor

A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_1

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads

A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentica

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport c

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.

In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templat