2026

Rocq Prover does not restore the universe graph's copy of the universe checking flag when a module that locally disabled

The Lean 4 kernel does not check that the body of an opaque declaration is closed. environment::add_opaque omits the che

The guard checker in Rocq Prover does not follow recursive calls made through a fixpoint's own arguments. A fixpoint may

The guard checker in Rocq Prover does not recheck the recursive tree representation of an inductive type parameter after

The guard checker in Rocq Prover treats a parameter of a nested mutual fixpoint as uniform without examining calls betwe

Dolibarr before 24.0.0 contains a sensitive data exposure vulnerability in the Members REST API that allows authenticate

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers

Dell Client BIOS contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privile

Print Assumptions does not report that a definition was produced while universe checking was disabled when that definiti

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 a

An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC sof

Aria2 version 1.37.0 and below is affected by a Divide By Zero issue in src/bittorrent_helper.cc, which allows a remote

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint t

Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows

Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account w

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration templa

A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin al

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/acco

Multiple DrayTek VigorSwitch models contain a directory traversal vulnerability in the getSyslogFile function. The vulne

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vul

The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set uncondit

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitra

Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Inject

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Came

Improper input validation vulnerability in Apache Camel. This issue affects Apache Camel: from 2.17.0 before 4.14.9,

Multiple vulnerabilities exist in OpenThread's handling of MLE packets. An authenticated attacker on the same Thread net

BookStack before 26.05.4 contains a broken access control vulnerability that allows authenticated API users with image-u

The UMP Stream responder library in lib/midi2/ump_stream_responder.c builds reply packets in a 16-byte struct midi_ump (

The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->si

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without esca

TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arb

HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or creden

A vulnerability was identified in bytebot-ai bytebot 0.0.1. The affected element is an unknown function of the component

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforc

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert

HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker u

HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly.  A

A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validat

Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.

Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form <= 1.4.0 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro <= 2.3.1 versions.

Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions.

Subscriber Server Side Request Forgery (SSRF) in FluentCRM Pro <= 3.1.12 versions.

Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.

Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions.

Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.

It is possible for outbound HTTP requests using a Micrometer-instrumented client to cause a denial-of-service (DoS) cond

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendere