2026

Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated use

Cross-Site request forgery (CSRF) vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Manageme

Missing authentication for critical function vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industri

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TMT Machine Indust

A flaw was found in Jolokia's JSR-160 proxy functionality where insufficient validation of client-controlled JMX service

A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to loc

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges cou

Dell PowerStore contains a Code Injection vulnerability. An authenticated user with limited privileges could potentially

Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could pote

Incorrect access control in the setDevReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attack

The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.

A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by u

Internally found bugs present in Thunderbird 154, Thunderbird ESR 153.1 and Thunderbird ESR 140.14. Some of these bugs s

Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory

Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2

Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Fire

Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2

Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155 and Thunderbird 155.

Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 15

Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155.

Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges cou

Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially

Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authentica

Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests i

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sou

LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget c

LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable

AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attacke

AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform s

Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could p

A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromIns

A OS command injection vulnerability in yast2-auth-client allows an attacker who controls Active Directory configuration

An OS command injection vulnerability was found in yast2-users. When displaying the "Password Settings" tab of a user, g

Improper neutralization of special elements used in an OS command in yast2-samba-client allows an attacker who controls

The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' paramete

The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file

The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vul

The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cr

The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortc

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

A vulnerability was found in hyperledger-firefly firefly up to 1.4.0. The impacted element is the function ValidateOptio

A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_up

A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/

Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowin

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 5.0.0, the fix for CVE-2026-3340

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handl