2026

An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all

Spring for GraphQL's Spring Data pagination support resolves arguments of a scrollable query and forwards the client-sup

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacke

The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Inte

Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. Spri

There is no allow list for property keys when Spring Cloud Commons writable /actuator/env is enabled. Spring Cloud Commo

Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a

Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-downlo

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the default-on "Safe impor

An integer overflow in the SMF component of Open5GS v2.7.6 allows attackers to cause a Denial of Service (DoS) via suppl

Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allow

A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user te

An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrat

SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary c

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloa

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by us

nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of serv

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allo

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature pol

openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key wh

openssl-encrypt before 1.4.9 fails to redact the file password in its --debug argv dump when the password is supplied vi

openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile

openssl_encrypt versions before 1.4.9 fail to properly validate key derivation function costs in crafted files, allowing

openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI bl

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attack

openssl_encrypt (pip: openssl-encrypt) versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples f

openssl_encrypt versions before 1.4.9 fail to validate server URLs in login and register_with_email functions, accepting

openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist s

openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of th

openssl_encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metada

openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext w

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST AP

AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extr

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch

The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with repl

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/co

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in librar

An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource:

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 1

A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket

Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could r

An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Se

A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (D

An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted

An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a