2026

Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with writ

Improper handling of case sensitivity in the configuration validation component of MongoDB Server may cause the authoriz

A security issue in MongoDB Server allows an unauthenticated network user to cause a denial of service on a specific typ

A use-after-free security issue exists in the server's query execution memory tracking subsystem. An authenticated user

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authe

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A

A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-ba

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A s

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitizat

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allow

Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated co

WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php a

AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-s

AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthent

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMedi

AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl:

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sql

AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability

A security flaw has been discovered in aircheng-org iWebShop-5 up to 5.15. Impacted is the function upload_json/uploadFi

In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it

An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers t

Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFr

Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc.

A race condition vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th

Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of t

An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated att

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Ge

Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Ge

The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server

A SQL injection vulnerability in the ap_form_{id} parameter in AppNitro MachForm v30 allows attackers to access sensitiv

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic han

Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver al

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd A

An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier a

A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x a

An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlie

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allow

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unaut

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multi

XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthor

XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthent