2026

A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.j

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the f

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recov

UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to

UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recov

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenti

A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.5.0. This affects an unknown part of the file Intercepti

A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. Affected by this issue is some unknown functionalit

A vulnerability was found in ntegrals openbrowser up to 067fc45d649baa961750da8e2f4a75d87c5c75c8. Affected by this vulne

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_mu

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.

libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers

Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account hold

An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) i

A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an ov

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized iden

DSpace open source software is a repository application which provides durable access to digital resources. From version

DSpace open source software is a repository application which provides durable access to digital resources. Prior to ver

DSpace open source software is a repository application which provides durable access to digital resources. Prior to ver

agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to

claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md wh

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pyca

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 00b7c3c, the endpo

Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 3a5ac85, a securit

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio Dashboard e

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco

Multiple vulnerabilities in the Secure/Multipurpose Internet Mail Extensions (S/MIME) decryption functionality of Cisco

Jenkins update-center2 3.18.3 and earlier does not escape plugin-provided values (plugin names, descriptions, and versio

Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier stores tokens unencrypted in job config.xml files on the J

Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read per

Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history record

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler d

A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and ear

Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream bui

A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream bui

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that co

Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a construc

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission w

A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permiss

Jenkins 2.579 and earlier, LTS 2.568.2 and earlier does not escape map keys when serializing objects as JSON and Python

In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration d

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deseriali

An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo fi

The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting t