2026

Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a netw

Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an unauthori

Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a networ

Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution (R

A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function u

A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function member_list o

A use of uninitialized variable vulnerability in Fortinet FortiAnalyzer 7.6.3 through 7.6.6 may allow attacker to denial

A unverified ownership vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.7, FortiClientWindows 7.2 all vers

A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5

An integer overflow in the query planning component of MongoDB Server can allow an authenticated user with ordinary data

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user wit

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges t

A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privile

A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal asse

A heap out-of-bounds read security issue exists in the query planning component of MongoDB Server. An authenticated user

A security issue in the MongoDB Server's storage engine integration layer allows an authenticated user with collection c

A use-after-free security issue in the cursor management component of MongoDB Server allows an authenticated user to cau

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled f

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store d

An internal aggregation expression in MongoDB Server was incorrectly registered as accessible to any authenticated user

A flaw in MongoDB's JSON Schema validation error generation code allows an authenticated user with readWrite privileges

A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod

A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert

A security issue exists in MongoDB's 2dsphere index key generation that can cause a server crash due to a null pointer d

A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a

The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a Mon

An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.

An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10

A malicious webpage could repeatedly trigger external URL schemes, causing system prompts or external application launch

snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. A

snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authentic

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule th

Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint,

Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (t

AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticat

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in pl

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulne

L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList c

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() funct

A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. Th

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Ge

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Ge

Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Dri

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Ge

A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x an

A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allow

XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated at

XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attac

XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthen