2026

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allow

quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allow

BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads enti

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated or

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which co

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenti

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows att

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter th

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows atta

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allo

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying cra

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() a

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that al

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribu

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver

Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ing

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other

Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context wh

Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inc

Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other worksp

PhysicsFS through 3.2.0 contains an out-of-bounds read vulnerability in __PHYSFS_utf8codepoint() that allows attackers t

office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands

Gravitee API Management through 4.12.22 contains an authentication bypass vulnerability that allows unauthenticated remo

DevIL through 1.8.0 contains a heap-based buffer overflow in iGetPalette() in il_gif.cpp that allows attackers to write

L-SMASH through 2.14.5 contains an infinite loop vulnerability in vc1_importer_probe() in importer/vc1_imp.c that allows

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Fix mmap_lock/disassociation_lock circ

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is regi

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep EQ resources alive while IRQ is regi

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fir

In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per deque

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MS

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't warn when an IBSS has no chan

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: undo netns switch if renaming the w

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: don't hand frames to mac80211

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the AP_VLAN tailroom counter

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer station for TDLS set

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ks

In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix out-of-bounds write in reset_per_

In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migration warning for proxy

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transpor

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference i

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of int

In the Linux kernel, the following vulnerability has been resolved: memcg: avoid charging the root memcg from obj_cgrou

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avc_has_perm_n

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: fix NULL-pointer dereference in

In the Linux kernel, the following vulnerability has been resolved: watchdog: da9063: fix suspend/resume handling of HW

In the Linux kernel, the following vulnerability has been resolved: watchdog: rtd119x: Avoid division by zero clk_get_

In the Linux kernel, the following vulnerability has been resolved: watchdog: rzv2h: Avoid division by zero clk_get_ra