2026

Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from t

Description A topology's `topology.blobstore.map` lets the submitter choose a local name for each blob that the supervi

On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user

An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to pot

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, src/praisonai-agents/praisonaiagents/tools/ema

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts f

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, SpiderTools._validate_url calls _host_is_block

A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corrupti

A flaw was found in GIMP's PSP (Paint Shop Pro) file loader. When processing a compressed selection channel, a heap-base

A flaw was found in GIMP's ICO file loader. When processing an ICO file containing an embedded PNG image, an integer ove

A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is

Incorrect Authorization vulnerability in Apache Syncope. Delegated administration security checks are based on Realm

Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet

LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/p

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allow

LaraDashboard versions 0.9.2 through 1.2.2 contain a path traversal vulnerability in the core-upgrade backup handling. C

File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (res

A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the

Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query f

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequ

Froxlor before 2.2.0 (affected up to and including 2.2.0-rc3) generates /etc/pure-ftpd/db/mysql.conf with mode 0644 via

A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file co

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file

A security flaw has been discovered in Open5GS up to 2.7.x. Affected is the function amf_nnrf_try_old_amf_discovery_fall

Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel m

EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote atta

Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length

Parallels Desktop runs prl_disp_service as root. Local clients reach it on the world-writable socket /var/run/prl_disp_s

A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a

Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access

A security vulnerability has been detected in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The imp

A weakness has been identified in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. The affected elemen

A security flaw has been discovered in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. Impacted is the function formDelWebAuth

SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings. If this vulnerability is explo

Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Convert

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.

An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI

Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series. If a specially crafted file is uplo

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M

Buffer overflow vulnerability exists in Contec EC1000 series. If a remote attacker sends a specially crafted request to

Buffer overflow vulnerability exists in Contec RP-WAH-SR Series. If a remote attacker sends a specially crafted request

Path traversal vulnerability exists in SGA1000. If this vulnerability is exploited, arbitrary files on the server may be

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000. If t

Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000

The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. If there i

An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backen

Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer ove