2026

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store

PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number

Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/614

A security vulnerability has been detected in gouguoa up to 5.10.0/6.0.1. This vulnerability affects the function update

A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools

A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tool

Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had com

Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social

UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address ba

Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak s

Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass syst

UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to sp

Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker wh

Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leve

Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromise

WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows una

AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streami

Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and stand

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools

A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.promp

A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bul

ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer wi

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody()

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query help

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the f

Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could allow an authenticated

Buffer overflow vulnerabilities exist in an underlying service of AOS-CX that could lead to an unauthenticated denial-of

A vulnerability has been identified in the API endpoint of AOS-CX that could allow a remote actor to circumvent existing

An out-of-bounds read vulnerability exists in the underlying operating system of AOS-CX that could lead to unauthenticat

An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an

Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authen

A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct

A vulnerability in an API endpoint of AOS-CX could allow a remote unauthenticated attacker to obtain sensitive informati

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authen

Denial-of-service vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow an

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to

Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Ut

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree

phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in ph

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authori

Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Pri

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to informati

Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Acces

Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Acce

A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator