2026

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthentica

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthentica

Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthentica

Multiple Cisco products are affected by a vulnerability in the Snort 3 detection engine that could allow an unauthentica

A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Def

Insertion of Sensitive Information Into Sent Data vulnerability in Roland Murg WP Booking System wp-booking-system allow

Fonoster 0.5.5 before 0.6.1 allows ../ directory traversal to read arbitrary files via the /sounds/:file or /tts/:file V

Due to missing authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal, a user with high privileges cou

An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability i

A flaw was found in Libsoup. The server-side digest authentication implementation in the SoupAuthDomainDigest class does

HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to handle incorrectly reported array le

A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirect

Jexactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af5

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Versions 0.8.2 and below

GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability

Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-i

Wazuh Manager authd service in wazuh-manager packages through version 4.7.3 contains an improper restriction of client-i

The Performance Monitor WordPress plugin through 1.0.6 does not validate a parameter before making a request to it, whic

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to versio

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, Ella Core panics when processing a NGAP ha

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to version

The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url

An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization

An issue that allowed administrators to create and update users outside of their authorized organization scope has been

An issue that could allow a credential to be updated and used for a task from outside of the authorized organization sco

An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS

In JetBrains Junie before 252.549.29 command execution was possible via malicious project file

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Ve

OpenClaw versions 2026.4.7 before 2026.4.15 fail to enforce local-root containment on tool-result media paths, allowing

Encrypted values in Fortra's GoAnywhere MFT prior to version 7.10.0 and GoAnywhere Agents prior to version 2.2.0 utilize

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, an unauthenticated attacker can

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are a

free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core

OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing byp

The Quiz Maker by AYS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rate_reason' parameter

OpenClaw before 2026.4.20 contains a server-side request forgery vulnerability in QQBot direct media upload that skips U

solidtime is an open-source time-tracking app. In version 0.12.0, the PUT /api/v1/organizations/{organization}/time-entr

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutraliz

Outline is a service that allows for collaborative documentation. Prior to 1.7.1, the Slack integration callback for GET

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate

When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjec

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.7 before 18.9.7, 18.10 before 18.10.6, and

css_parser is a Ruby CSS parser. Prior to 2.1.0 and 1.22.0, the CSS Parser gem does not validate HTTPS connections, allo

Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.44, 3.6.15, and 3.7.0-rc.3, there is an information di

Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records. An attacker in con

The Decent Comments WordPress plugin before 3.0.2 does not restrict access to comment author email addresses and post au