2026

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the

IP2Location Country Blocker plugin for WordPress before 2.45.0 contains an access control bypass vulnerability that allo

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() metho

Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updat

Snipe-IT versions before 8.7.0 contain a stored cross-site scripting vulnerability in DepartmentPresenter::formattedName

Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API en

Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with

Snipe-IT versions before 8.7.0 fail to apply company scope filtering to the GET /hardware/requested endpoint when Full M

Snipe-IT versions up to and including 8.6.3 contain a race condition (TOCTOU) in the consumable checkout API endpoint (P

Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset

Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GE

snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to e

Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0) contain an incorrect authorization flaw in app/Http/Controllers/U

Snipe-IT before 8.7.0 fails to properly enforce the viewKeys authorization gate in CSV export and API index endpoints, a

Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox

Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlContro

Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST,

snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset

snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on que

Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequ

Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint.

Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endp

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization o

Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never include

Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated

Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. Rep

PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authe

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that all

PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows re

PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with ST

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when pr

PocketMine-MP versions before 5.25.2 fail to limit the explode() function in packet parsing, allowing malicious clients

PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_P

PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes t

PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers

PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing tha

PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attac

PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in Bl

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains