2026

A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component e

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c9

A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c9

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processin

Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arb

A security issue was discovered in MongoDB mongos (the sharded cluster router) where an authenticated user with readWrit

MongoDB Server's collection validation feature may not properly handle certain expressions stored in a validator. In som

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during in

Metabase is an open source business intelligence and analytics platform. From 1.55.0 until 1.58.16, 1.59.13, 1.60.9, and

Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthentic

Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes

Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Archit

asteval is a Python expression evaluator designed for restricted execution. Prior to 1.0.9, in asteval/astutils.py, the

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

With its original introduction, GNTTAB_cache_flush was made available uniformly. XSA-232 (CVE-2017-14318) then covered

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to whi

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy trea

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via t

An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a c

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogi

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via t

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoin

Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker

The network messaging layer contained improper handling of highly compressed data affecting service availability. Softw

QAPI contained a stack-based buffer overflow affecting service availability. Software customers upgrade to resolved mai

An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in lib

Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via

mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allo

An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.

Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via t

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allow

SFTPGo is an open source, event-driven file transfer solution. Prior to 2.7.5, an authenticated SSH user can send a malf

MediaAgent contained a heap-based buffer overflow issue affecting service availability. Software customers upgrade to r

CVFS contained an input validation issue affecting command execution. Software customers upgrade to resolved maintenanc

CVFS contained a missing authentication condition affecting command execution. Software customers upgrade to resolved m

CvFWD contained a null pointer dereference affecting service availability. Software customers upgrade to resolved maint

CvFWD contained an out-of-bounds write affecting service availability. Software customers upgrade to resolved maintenan

CvFWD contained an integer overflow affecting service availability. Software customers upgrade to resolved maintenance

CVFS contained an XML external entity (XXE) reference handling issue affecting information dislcosure. Software custome

The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privil

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker wh

H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/co

MCP Context Forge provides an MCP Admin UI for managing gateway resources. From 0.2.0 until 0.3.1, the Global Prompts fe

MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example s

Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalat

Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an