2026

There is an out-of-bounds read vulnerability in DASYLab due to improper validation of user-supplied data.   This results

There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in

There is an out-of-bounds write vulnerability in DASYLab due to improper validation of user-supplied data, resulting in

There is an out-of-bounds write vulnerability in DASYLab due to lack of proper validation of user-supplied data. Success

IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code,

A security flaw has been discovered in itsourcecode Online Medicine Delivery System 1.0. The affected element is the fun

parsedmarc before 11.0.1 decompresses gzip and ZIP attachments in a single unbounded read with no limit on decompressed

toml-node is a TOML parser for Node.js and the browser. Prior to 4.2.0, toml.parse() uses a Peggy 5.1.0 generated recurs

toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked b

Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute

Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary cod

Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code insid

Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside

R2R through 3.6.6 contains a SQL injection vulnerability that allows unauthenticated attackers to inject SQL predicates

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identi

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, t

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly valida

UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any a

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 sign

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deleti

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowin

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrect

Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). El

c-ares is an asynchronous resolver library. From ver 1.32.3 until 1.34.7, a use-after-free / double-free in c-ares' quer

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. Affected by this issue i

Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Ama

Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code exec

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the A

Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.

Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.

Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions.

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents <= 1.51.0 versions.

Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration &amp; Cloning <= 6.65 versions.

Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.

Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.

Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions.

Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions.

Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions.

Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.

Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions.

Contributor PHP Object Injection in RTMKit <= 2.1.5 versions.

Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.