2026

A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `userna

Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements use

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inje

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject

Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements use

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allo

n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that all

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exp

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailch

n8n versions before 1.123.73, 2.35.4, and 2.36.2 pass message content in the Gmail (v1) and Brevo nodes to the mail comp

n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes

AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authe

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lac

AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbi

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cance

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes

WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables

WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to

A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFro

A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file

A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentS

Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retriev

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the oper

FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during A

FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserv

Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval o

A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(s

XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence

Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who ca

An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical acces

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the RES

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability

A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untru

A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute m

A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with a

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the

The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared se

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerabl

RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL

Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and

An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in run

A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell_exec o

A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality o

A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageDa

A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agen

A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the c