2026

Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally.

TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src

Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers

SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the public web-client partial ZIP

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause kernel memory corruption due to insu

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 A stack memory corruption vulnerability exists in the AIX IPsec ESP decaps

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a stack-

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to uncontrol

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security restrictions due to impro

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to an out-of

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a buffer

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to a NULL po

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information or cause a de

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to disclose sensitive kernel memory due to an

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information due to impro

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to intercept messages and forge replies due

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-o

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to uncontrol

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local authenticated attacker to execute arbitrary code due t

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a stack-base

tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of re

Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-stre

Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg rev

Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS.

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate optio

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attach

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit reads SMTP commands through internal/s

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to

The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. ver

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 u

BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and ant

msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes

A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of wha

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing

An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 1

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static

A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayContro

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-enco

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage retur

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file c

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML pa